Skip to content

Commit b6badee

Browse files
myasnikovdaniilmyasnikovdaniil
committed
fix(cert-manager): bump chart to v1.20.2
cert-manager v1.20.0 introduced the acme.cert-manager.io/http01-ingress-ingressclassname Ingress annotation (cert-manager#8244). Cozystack templates already emit it (since 2b6e20c) but v1.19.x silently ignored it, so cert-manager fell back to the ClusterIssuer's solver class. HTTP-01 solver Ingresses for non-publishing tenants ended up on the wrong IngressClass, breaking Let's Encrypt issuance for any tenant ingress not on tenant-root. Targeting v1.20.2 picks up cert-manager#8655 (clusterissuers/issuers finalizer RBAC restored after v1.20.0 dropped it) and #8665 (webhook helm-template fix). Verified live on dev10: - v1.19.3: Challenge solver class = "tenant-root" (BUG) - v1.20.2: Challenge solver class = "<tenant>" (FIXED) Notable upgrade considerations: - Container UID/GID change 1000/0 -> 65532/65532 - New per-component NetworkPolicy templates (gated, default off) - Image template signature refactored (cozystack values.yaml empty, renders identically) - CRDs gain selectableFields (k8s >=1.30) and Azure DNS01 zoneType - RBAC adds clusterissuers/issuers finalizers + listenersets Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
1 parent 5786afe commit b6badee

27 files changed

Lines changed: 1215 additions & 240 deletions

‎packages/system/cert-manager-crds/templates/_helpers.tpl‎

Lines changed: 59 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -180,11 +180,65 @@ Any changes to this function should also be made in cert-manager, trust-manager,
180180
See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linked PRs.
181181
*/}}
182182
{{- define "image" -}}
183-
{{- $defaultTag := index . 1 -}}
184-
{{- with index . 0 -}}
185-
{{- if .registry -}}{{ printf "%s/%s" .registry .repository }}{{- else -}}{{- .repository -}}{{- end -}}
186-
{{- if .digest -}}{{ printf "@%s" .digest }}{{- else -}}{{ printf ":%s" (default $defaultTag .tag) }}{{- end -}}
187-
{{- end }}
183+
{{- /*
184+
Calling convention:
185+
186+
- (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>)
187+
188+
We intentionally pass imageRegistry/imageNamespace as explicit arguments rather than reading
189+
from `.Values` inside this helper, because `helm-tool lint` does not reliably track `.Values.*`
190+
usage through tuple/variable indirection.
191+
*/ -}}
192+
193+
{{- if ne (len .) 4 -}}
194+
{{- fail (printf "ERROR: template \"image\" expects (tuple <imageValues> <imageRegistry> <imageNamespace> <defaultReference>), got %d arguments" (len .)) -}}
195+
{{- end -}}
196+
197+
{{- $image := index . 0 -}}
198+
{{- $imageRegistry := index . 1 | default "" -}}
199+
{{- $imageNamespace := index . 2 | default "" -}}
200+
{{- $defaultReference := index . 3 -}}
201+
202+
{{- $repository := "" -}}
203+
{{- if $image.repository -}}
204+
{{- $repository = $image.repository -}}
205+
206+
{{- /*
207+
Backwards compatibility: if image.registry is set, additionally prefix the repository with this registry.
208+
*/ -}}
209+
{{- if $image.registry -}}
210+
{{- $repository = printf "%s/%s" $image.registry $repository -}}
211+
{{- end -}}
212+
{{- else -}}
213+
{{- $name := required "ERROR: image.name must be set when image.repository is empty" $image.name -}}
214+
{{- $repository = $name -}}
215+
216+
{{- if $imageNamespace -}}
217+
{{- $repository = printf "%s/%s" $imageNamespace $repository -}}
218+
{{- end -}}
219+
220+
{{- if $imageRegistry -}}
221+
{{- $repository = printf "%s/%s" $imageRegistry $repository -}}
222+
{{- end -}}
223+
224+
{{- /*
225+
Backwards compatibility: if image.registry is set, additionally prefix the repository with this registry.
226+
*/ -}}
227+
{{- if $image.registry -}}
228+
{{- $repository = printf "%s/%s" $image.registry $repository -}}
229+
{{- end -}}
230+
{{- end -}}
231+
232+
{{- $repository -}}
233+
{{- if and $image.tag $image.digest -}}
234+
{{- printf ":%s@%s" $image.tag $image.digest -}}
235+
{{- else if $image.tag -}}
236+
{{- printf ":%s" $image.tag -}}
237+
{{- else if $image.digest -}}
238+
{{- printf "@%s" $image.digest -}}
239+
{{- else -}}
240+
{{- printf "%s" $defaultReference -}}
241+
{{- end -}}
188242
{{- end }}
189243

190244
{{/*

‎packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_challenges.yaml‎

Lines changed: 31 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,22 @@ spec:
283283
The TenantID of the Azure Service Principal used to authenticate with Azure DNS.
284284
If set, ClientID and ClientSecret must also be set.
285285
type: string
286+
zoneType:
287+
description: |-
288+
ZoneType determines which type of Azure DNS zone to use.
289+
290+
Valid values are:
291+
- AzurePublicZone (default): Use a public Azure DNS zone.
292+
- AzurePrivateZone: Use an Azure Private DNS zone.
293+
294+
If not specified, AzurePublicZone is used.
295+
296+
Support for Azure Private DNS zones is currently
297+
experimental and may change in future releases.
298+
enum:
299+
- AzurePublicZone
300+
- AzurePrivateZone
301+
type: string
286302
required:
287303
- resourceGroupName
288304
- subscriptionID
@@ -406,7 +422,7 @@ spec:
406422
description: |-
407423
The IP address or hostname of an authoritative DNS server supporting
408424
RFC2136 in the form host:port. If the host is an IPv6 address it must be
409-
enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
425+
enclosed in square brackets (e.g [2001:db8::1]); port is optional.
410426
This field is required.
411427
type: string
412428
protocol:
@@ -456,17 +472,17 @@ spec:
456472
description: |-
457473
The AccessKeyID is used for authentication.
458474
Cannot be set when SecretAccessKeyID is set.
459-
If neither the Access Key nor Key ID are set, we fall-back to using env
460-
vars, shared credentials file or AWS Instance metadata,
475+
If neither the Access Key nor Key ID are set, we fall back to using env
476+
vars, shared credentials file, or AWS Instance metadata,
461477
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
462478
type: string
463479
accessKeyIDSecretRef:
464480
description: |-
465481
The SecretAccessKey is used for authentication. If set, pull the AWS
466482
access key ID from a key within a Kubernetes Secret.
467483
Cannot be set when AccessKeyID is set.
468-
If neither the Access Key nor Key ID are set, we fall-back to using env
469-
vars, shared credentials file or AWS Instance metadata,
484+
If neither the Access Key nor Key ID are set, we fall back to using env
485+
vars, shared credentials file, or AWS Instance metadata,
470486
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
471487
properties:
472488
key:
@@ -555,8 +571,8 @@ spec:
555571
secretAccessKeySecretRef:
556572
description: |-
557573
The SecretAccessKey is used for authentication.
558-
If neither the Access Key nor Key ID are set, we fall-back to using env
559-
vars, shared credentials file or AWS Instance metadata,
574+
If neither the Access Key nor Key ID are set, we fall back to using env
575+
vars, shared credentials file, or AWS Instance metadata,
560576
see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
561577
properties:
562578
key:
@@ -1913,9 +1929,10 @@ spec:
19131929
operator:
19141930
description: |-
19151931
Operator represents a key's relationship to the value.
1916-
Valid operators are Exists and Equal. Defaults to Equal.
1932+
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
19171933
Exists is equivalent to wildcard for value, so that a pod can
19181934
tolerate all taints of a particular category.
1935+
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
19191936
type: string
19201937
tolerationSeconds:
19211938
description: |-
@@ -3124,9 +3141,10 @@ spec:
31243141
operator:
31253142
description: |-
31263143
Operator represents a key's relationship to the value.
3127-
Valid operators are Exists and Equal. Defaults to Equal.
3144+
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
31283145
Exists is equivalent to wildcard for value, so that a pod can
31293146
tolerate all taints of a particular category.
3147+
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
31303148
type: string
31313149
tolerationSeconds:
31323150
description: |-
@@ -3274,6 +3292,10 @@ spec:
32743292
- metadata
32753293
- spec
32763294
type: object
3295+
selectableFields:
3296+
- jsonPath: .spec.issuerRef.group
3297+
- jsonPath: .spec.issuerRef.kind
3298+
- jsonPath: .spec.issuerRef.name
32773299
served: true
32783300
storage: true
32793301
subresources:

‎packages/system/cert-manager-crds/templates/crd-acme.cert-manager.io_orders.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,10 @@ spec:
267267
- metadata
268268
- spec
269269
type: object
270+
selectableFields:
271+
- jsonPath: .spec.issuerRef.group
272+
- jsonPath: .spec.issuerRef.kind
273+
- jsonPath: .spec.issuerRef.name
270274
served: true
271275
storage: true
272276
subresources:

‎packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificaterequests.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,10 @@ spec:
312312
type: string
313313
type: object
314314
type: object
315+
selectableFields:
316+
- jsonPath: .spec.issuerRef.group
317+
- jsonPath: .spec.issuerRef.kind
318+
- jsonPath: .spec.issuerRef.name
315319
served: true
316320
storage: true
317321
subresources:

‎packages/system/cert-manager-crds/templates/crd-cert-manager.io_certificates.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -451,9 +451,6 @@ spec:
451451
will be generated whenever a re-issuance occurs.
452452
Default is `Always`.
453453
The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
454-
The new default can be disabled by setting the
455-
`--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
456-
the controller component.
457454
enum:
458455
- Never
459456
- Always
@@ -809,6 +806,10 @@ spec:
809806
type: integer
810807
type: object
811808
type: object
809+
selectableFields:
810+
- jsonPath: .spec.issuerRef.group
811+
- jsonPath: .spec.issuerRef.kind
812+
- jsonPath: .spec.issuerRef.name
812813
served: true
813814
storage: true
814815
subresources:

0 commit comments

Comments
 (0)