generic Daily Triage :: Triage Party

Assi	Unprioritized issues older than 7 days	Uncommented older than 7 days	Important soon, but no updates in 90 days	Important longterm, but no updates in 180 days	Pull Requests: Review Ready	Unkinded Issues	Unprioritized Recent Issues	New, has multiple commenters, but not important-soon	Recently updated issue has a question
					website#948 add note to ingress class definition 🌊
	cert-manager#5197 cert-manager-webhook to provide logs when handling a k8s api-server request 🌊
	cert-manager#5160 Support loading controller configuration from a versioned file 🌊 5337
	csi-lib#33 Create e2e test to validate CertificateRequest garbage collection 🌊
	release#27 Create cert-manager specific testing infrastructure 🌊 28					website#459 cert manager is no longer on the OpenShift operator list 🌊 release#2 Set up periodic job to publish an experimental release build 🌊
		cert-manager#4722 High memory usage on cluster with many secrets 🌊			cert-manager#5093 Add relabeling and metricRelabelings settings for ServiceMonitor. 🌊 csi-lib#48 Retry pending request when issue is called 🌊
					cert-manager#5876 helm: add support for TLS configuration and application protocol 🌊	cert-manager#4824 Repo Migration Followup Task List 🌊 4826
nobody	cert-manager#5862 http01.ingress.class doesn't work cert-manager#5855 DNS-01 : error : Found recursive CNAME record to cert-manager#5851 CA cert in Secret not updated when self-signed CA itself gets renewed. cert-manager#5864 Certmgr allows creating certificates expiring after ca expiration. cert-manager#5847 Issuance flow is not consistent in non-success cases (i.e denied CRs) cert-manager#5817 Uninstalling the cert-manager Helm chart removes all my Issuers and Certificate/ CertificateRequest CRs cert-manager#5806 CA Injector MinimumReplicasUnavailable cert-manager#5845 Error presenting challenge: Unable to check the TXT record: ### Unexpected HTTP status: 401 during certificate renewal cert-manager#5800 Found no Zones for domain _acme-challenge.mydomain.com cert-manager#5784 After migration from 1.6.1 to 1.8.2 cainjector remains in crashloopbackoff - OOMKill cert-manager#5783 Add k8s.io/client-go/applyconfigurations style ApplyConfigurations for the included CRDs 5383 cert-manager#5782 Misleading error for Vault issuer cert-manager#5780 error instantiating route53 challenge solver: unable to assume role: AccessDenied cert-manager#5785 Store OCSP response in kubernetes secret 5830 cert-manager#5775 Atos IDnomic ACME Gateway cert-manager#5774 Add descriptions for container image repos cert-manager#5779 cloudDNS 's hostedZoneName is not sufficient to replace the dns01-recursive-nameservers flag cert-manager#5772 Develop new Helm chart for cert-manager CRD manifests cert-manager#5767 force renew others when root cert renews cert-manager#5773 add support for encrypted Private keys in PKCS8 format cert-manager#5756 Challenge is stuck at "Waiting for DNS-01 challenge propagation" cert-manager#5760 Feature/Bug: Filter Ingress Url by ACME Solvers 5761 cert-manager#5752 Waiting for HTTP-01 challenge propagation: wrong status code '404', expected '200' cert-manager#5751 Wildcard DNS domains and `cnameStrategy: Follow` don't work nicely together cert-manager#5755 JKS truststore.jks not found in resulting secret in v1.11.0 5597 cert-manager#5717 clarification on semantic versioning cert-manager#5750 Tag associated with Fix for pavlo-v-chernykh/keystore-go library version 5730 cert-manager#5708 Cert Manager working with only example.com not with svc.cluster.local cert-manager#5700 Support for issuing public certs using AWS ACM and DNS verification cert-manager#5699 Customize Cloudflare base url cert-manager#5697 Support PodSecurityAdmission cert-manager#5673 Error presenting challenge: init sdk: get token: extract secret: resource name may not be empty cert-manager#5665 Allow defining keystore password as litteral instead of SecretRef cert-manager#5716 Certificate renewal fails during DNS challenge with Route53 cert-manager#5650 provider rfc2136 send updates to top level zone cert-manager#5664 Error: INSTALLATION FAILED: failed post-install: timed out waiting for the condition cert-manager#5630 provider rfc2136: updates are sent to wrong dns zone cert-manager#5643 AdditionalOutputFormat is still in alpha cert-manager#5626 Helm: Allow configuration of readiness, liveness and startup probes for all created Pods 5670 cert-manager#5615 Integrate cert-manager with DigitalOcean LBs cert-manager#5611 ACME HTTP challenge pods blocked by OpenShift cert-manager#5608 Unable to inject linkerd sidecar proxy to Cert-Manager pods cert-manager#5596 Current PSP is not sufficient to work with CSI volume cert-manager#5594 Graduate ExperimentalGatewayAPISupport feature to beta cert-manager#5590 Configure cluster resource namespace in ClusterIssuer spec cert-manager#5588 --must-staple attribute for OCSP Stapling cert-manager#5585 ClusterIssuer cannot read the ServiceAccount token secret cert-manager#5616 Allow Gateway API feature to be enabled in clusters that don't have GWAPI CRDs installed 5624 cert-manager#5580 Mounting emptyDir to /tmp directory (webhook) cert-manager#5581 Best way to migrate a Nginx ingress to cert-manager without downtime cert-manager#5566 upload Helm charts to OCI registry and sign them with cosign cert-manager#5565 cert-manager aws route53 hosted zone automatically add records. cert-manager#5572 Add the possibility to use two cluster issuers in a single ingress cert-manager#5557 error instantiating route53 challenge solver: unable to assume role: AccessDenied: cert-manager#5553 Cert manager is looking for wrong service name cert-manager#5549 unknown field "enabled" in io.k8s.api.core.v1.PodSecurityContext cert-manager#5558 Will auto-renewal of the root certificate automatically renew the certificate issued by the root certificate? cert-manager#5545 openssl version used cert-manager#5543 Using Azure workload identity instead of AAD Pod Identities to configure the AzureDNS DNS01 challenge. cert-manager#5540 Changelog annotations to chart cert-manager#5548 Pod is not running due to AppArmor not Enabled cert-manager#5537 Left over artifacts from cert-manager cert-manager#5536 Challenge stack on self check when host is unavailable from cluster. cert-manager#5531 Question regarding Apigee Hybrid cert-manager webhook support with CSI driver cert-manager#5538 Unable to set IPv6 podDNS config from values cert-manager#5520 CrashLoopBackOff after restart of all deployments cert-manager#5516 Forbidden: seccomp may not be set pod.metadata.annotations cert-manager#5515 stuck on propagation check failed DNS record not yet propagated cert-manager#5524 cert-manager v1.10.0 always tries to access clusterissuers at cluster scope cert-manager#5514 Venafi Issuer Read `caBundle` from Configmap or Secret cert-manager#5486 Aggressive Retries from "error instantiating route53 challenge solver" cert-manager#5513 Deploy of cert-manager-webhook/cainjector:v1.9.1 got permission error cert-manager#5437 Issuer/ClusterIssuer support to specify vault token on local filesystem 5438 cert-manager#5433 Support certs that live for < 1h cert-manager#5298 Complete the Migration Away From Jetstack Names cert-manager#5430 Improving DNS-01 challenge performance 5446 5447 cert-manager#5230 Timeouts on Every Controller Reconcile Loop 5226 cert-manager#5171 TPP Allowed Domains can cause valid certificate to error cert-manager#5220 Investigate improving resource consumption and performance in clusters with large amount of resources 5639 cert-manager#5069 Error presenting challenge: the server could not find the requested resource even though resource exists cert-manager#5031 ValidateCAA test function is flaky cert-manager#5062 Cert-manager stops processing order request in "processing" status after several attempts cert-manager#4979 Overhaul the DNS01 solver 5143 cert-manager#4956 cert-manager created multiple CertificateRequest objects with the same certificate-revision 4987 5484 5485 5487 cert-manager#4931 Enable Testing on ARM64 cert-manager#4899 Certificate.Spec.RenewEvery instead of RenewBefore cert-manager#4877 HTTP01 solver fails self-check/propagation check on 1.7.1 when used with client-certificate auth on nginx Ingress 1.1.1 cert-manager#4797 Automatically renew certificates if OCSP indicates that it was revoked cert-manager#4685 Unexpected EOF during watch stream event decoding: unexpected EOF cert-manager#4594 TLS handshake error: EOF cert-manager#4561 Ability to specify secret ownerReference as part of the Certificate request cert-manager#4423 Cert renewal loop cert-manager#4349 allowing greater configuration for the cloud provider tests cert-manager#4950 General flakiness of our end-to-end suite 4960 5136 5141 5317 5318 5323 5325 cert-manager#3896 Cert Manager failing to renew certificate cert-manager#3592 Ability to not create ca.crt cert-manager#3958 Sane defaults for Certificate revision history limit cert-manager#5792 Helm CVE-2023-25165 cert-manager#5821 Allow renewBefore to be a percentage cert-manager#2380 Helm chart version is not SemVer-compatible cert-manager#5826 ACMEDNS, cnameStrategy: Follow (follow CNAME records recursively), dns01-recursive-nameservers-only - NXDOMAIN cert-manager#5818 Remove code-level dependency on Helm where possible website#1194 Confusing paragraph - cert-manager integration. website#1186 Document that/why we don't use Helm's CRD installation mechanism website#1159 Why the sample issuer still uses kubebuilder version 2 ? website#1168 Rendering issues for generated API docs 1169 1170 website#1101 Feature request for updating documentation. website#1063 "Securing Ingresses with Venafi" tutorial contains link to missing manifest 1090 website#1062 Document process for offboarding maintainers website#1125 Describe cert-manager feature policy website#1054 Run spell checker in a pre-commit hook website#1006 Use descriptive text instead of alt for `feature icon` website#998 Documentation venafi configuration references venafi documentation page which returns 403 website#993 Document which resources do/do not get garbage collected website#981 The `kubectl operator install` instructions are broken (after upgrading kubectl operator v0.3.0 -> v0.4.0) website#974 Investigate styled 404 page website#975 Some pages do not make it clear what the user should read next website#955 Document when the vault pki role required setting `require_cn=false` website#931 Improve upgrade instructions using helm website#899 Upgrading from v1.7 to v1.8 check command should exclude null. website#866 Securing NGINX-ingress website#847 missing documentation/information olm based installation metric prometheus website#844 Document feature gates website#868 Document RBAC website#836 Syncing Secrets Across Namespaces website#841 remove dependency on golang from cmctl and kubectl-plugin installation documentation 807 website#776 Explain that you can pre-provision a Secret and Certificate.Spec.SecretName can refer to an existing Secret website#802 Spelling errors are unclear in pull request CI results and spell checker is unmaintained 806 807 1175 website#758 API reference docs: enum values not documented with typedef website#706 Default key usages website#693 Azure DNS pod identity incorrectly documents principal_id website#672 List required Google CloudDNS permissions exhaustively website#662 Using "azureDNS" for the DNS01 Solver results "Multiple user assigned identities exist, please specify the clientId / resourceId" website#645 Investigate & add an FAQ/warning about images rolled back after GitOps upgrade website#642 Move/ link to Webhook debugging docs website#697 [IRSA] Needs `runAsUser: 1001` website#583 cert-manager with ZeroSSL website#604 Make it so that it is easier to find the doc for fixing webhook issues website#568 Add a diagram for LetsEncrypt cert issuance flow to the docs website#554 HTTP Validation, privateKeySecretRef website#561 Certificate Resources website#549 Effort towards a more user-friendly website website#542 Document the Istio VirtualService HTTP01 configuration options website#543 Add getting started documentation for users who want to quickly use cert-manager to issue LetsEncrypt certificates website#486 OpenShift - broken link website#532 Rework of the landing page (cert-manager.io) website#466 installation/compatiblity website#457 cainjector docs are missing the option to inject certs in apiservice resources website#425 Document ocspServers website#422 Page last modified date incorrect website#386 Uninstalling on Kubernetes - How to delete all those user created resources? website#330 Case for CertificatePrivateKey (encoding, algorithm) is wrong (v1) website#326 Securing Ingresses with Venafi website#295 Route53 website#469 DNS01: Delegated Domains for DNS01 example yaml solvers list items website#1061 Document onboarding process for new maintainers website#426 Create a sequence diagram that shows how a certificate gets issued with let's encrypt 582 release#42 Publish latest release number as part of creating a final release release#50 Move cert-manager-release infrastructure to CNCF's GCP account release#19 Incorrect command line help: should include a --branch argument release#79 Design for partial automation of release process release#31 Move the manual steps of our release process to cmrel commands 32 istio-csr#197 add the compatibility matrix for Kubernetes versions to README istio-csr#161 updating ConfigMap data doesn't stop istio-csr#155 Invalid certificate chain when using Vault with Intermediate CA istio-csr#153 It is possible to have several CAs within the same cluster. istio-csr#145 Not able to use Istio-CSR in istio(1.13.) 146 istio-csr#144 add a support kubernetes client QPS and Burst config istio-csr#141 Istio-csr pods were hung unable to handle request causes entire cluster downtime for new pods/expired pods. istio-csr#138 istio-csr doesn't retry upon failed certificate requests istio-csr#137 Documentation on rotating the root certificate istio-csr#136 Document available metrics istio-csr#133 latest supported cert-manager version with cert-manager-istio-csr? istio-csr#132 Allow override of istiod-tls certificate common name in helm chert (for non-standard istiod deployments) istio-csr#131 metrics to check certificate expiry for istio workloads ? istio-csr#130 Document best-practices for minimal vault role configuration for istio-csr istio-csr#118 E2E tests running against the wrong k8s version istio-csr#117 public ca.crt aka caBundle is not being updated/propagated until the cert-manager and istiod components are restarted istio-csr#176 certificateDuration is not used for the Istio CSR generated certificate requests istio-csr#108 [doc] confusion with `ca.pem` and Readiness probe failed on ingress and egress gateways istio-csr#106 Helm chart is failing with "certificate.spec.revisionHistoryLimit" issue istio-csr#87 Failing to integrate with GCP CAS istio-csr#84 csr readiness probe failed, istio ingress pod also failed istio-csr#83 commonName required for AWS PCA istio-csr#64 Is there way to hot restart envoy proxy using istio-csr? I'm trying to renew root certificate by changing the istio-ca secret manually. The workload does not pick the new root certificate unless I delete the workload pods istio-csr#53 Generate workload certificates with DNS in the SAN istio-csr#94 Can't get aws pca to work istio-csr#113 Integrating with istio helm chart installs approver-policy#207 Setting .Values.nameOverride makes the pod not have rights to update secret cert-manager-approver-policy-tls approver-policy#179 group 'cert-manager.io' does not work approver-policy#203 Improve CRD fields for specifying key requirements approver-policy#169 Webhook Custom CA approver-policy#61 Flakey Tests in pull-cert-manager-approver-policy-verify 57 60 approver-policy#62 CertificateRequestPolicy based on which namespace the certificate request belongs to 96 208 approver-policy#149 Regex to disallow wildcard certificates trust-manager#72 Add the configmap on all pod via mutatingWebhookConfiguration trust-manager#63 nit: Rename "Bundle" to "ClusterBundle" trust-manager#62 Webhook error when creating a bundle trust-manager#113 Branch from "old" trust-manager name to add deprecation warning. trust-manager#59 Trust part 2 - How to use a bundle? trust-manager#60 overriding trusted namespace trust-manager#58 Support injection pem into an existing configmap trust-manager#54 Allow auto-trust Bundles tracking a certain Issuer trust-manager#44 Specialise `Bundle` for X.509 Certificates trust-manager#23 Way to add labels/annotations to target trust-manager#39 Don't sync targets to all namespaces by default trust-manager#13 Allow node selection based on nodeSelector, tolerations, affinities and topologySpreadConstraints 117 trust-manager#11 Add support for image pullsecret and installing the CRD - helm chart trust-manager#10 Feature: support secret target 108 trust-manager#4 Feature: By default, require only self-signed certificates in a bundle trust-manager#17 Support distribution of PKCS12/JKS truststores trust-manager#112 Move away from buildx trust-manager#100 Modifying Bundle target can result in CA certs not being available for a while trust-manager#99 Allow removing Bundles whilst keeping the synced CA certs trust-manager#33 Support CRDs as target csi-driver#134 Volume empty csi-driver#136 SubPath support is broken or missing csi-driver#119 Certificate is re-requested when container restarts csi-driver#116 Does csi-driver support Wìndows nodes? csi-driver#130 JKS support csi-driver#45 Unable to mount and read only file error csi-driver#26 Cannot `chmod` a read only filesystem 31 csi-driver#125 Is it too late to align cert-manager annotations? csi-driver#17 ability to specify pod IP in volume attributes csi-driver#74 Investigate and change the default mounted host path for driver csi-driver#33 New key being used with old certificate csi-driver#29 Deleting a pod with a cert-manager-csi volume mounted results in the pod termination hanging. csi-driver#128 Support all subject attributes 129 csi-driver#21 MountVolume.SetUp failed: cannot set blockOwnerDeletion: cannot find RESTMapping for APIVersion core/v1 Kind Pod csi-driver-spiffe#19 Add support for certificate expiry configuration openshift-routes#14 Annotation generates CertificatesRequests repeatedly until blocked by letsencrypt openshift-routes#13 Can the plugin be configured to use a wildcard certificate? openshift-routes#12 Does this plugin support DNS validation? openshift-routes#10 Support for the route subdomain enhancement openshift-routes#4 Feature: Allow specification of privateKey.rotationPolicy openshift-routes#15 Feature: Support for ECC certs cert-manager-olm#70 OLM deployment with ArgoCD is OutOfSync cert-manager-olm#17 Operator prevents passing extraArgs helm value cert-manager-olm#22 Customize the deployment of cert-manager installed via OLM cert-manager-olm#46 Cert-manager operator fails to issue certificates cert-manager-olm#3 Restrict operator RBAC permissions csi-lib#45 Exponential backoff handling does not apply to certificate renewal in pending phase csi-lib#40 Optional auto rotating/renewing certificates csi-lib#47 Race condition: CertificateRequests may never be fulfilled if the issuer was overwhelmed csi-lib#8 Drivers can create CertificateRequests for pods that don't exist in very rare edge cases sample-external-issuer#22 Question: figuring this out as I go, could use a little guidence on this step: add 'kubebuilder CRD Markers' sample-external-issuer#4 Create Kubernetes Events logging significant operations and errors	cert-manager#3898 Allow setting PodDisruptionBudget policies via helm chart 3931 4992 4993 cert-manager#3655 Specify Name Constraints in CA Certificate website#850 Document available cert-manager Prometheus metrics website#76 Upgrading from v0.10 to v0.11 - missing cainjector annotation	website#174 Add documentation for CRD conversion webhook ca injection	cert-manager#2178 Handling 'unregistering' certificates from Venafi TPP website#223 Document wildcard certificate tutorial	cert-manager#5880 Separate binaries/tests into separate modules with minimal dependencies cert-manager#5824 Controller partial metadata cert-manager#4330 Add client certificate auth method for Vault issuer cert-manager#5879 Deprecate klog flags and add a deprecation message cert-manager#5324 Create 20220720-per-certificate-owner-ref.md cert-manager#5874 Cleanup certificate request approval webhook cert-manager#5447 Allow extra DNS-01 propagation time to be configured cert-manager#5777 helm: Add option to keep CRDs when helm chart is uninstalled cert-manager#5446 Allow concurrent same-FQDN DNS-01 challenges when using route53 cert-manager#5778 [helm] Add support for relabelings and metricRelabelings an serviceMonitor cert-manager#5747 BUGFIX: if a LiteralSubject is set, the RequestMatchesSpec function does skip too many checks cert-manager#5701 feat: added custom endpoint override flag for http solver cert-manager#5686 Add missing healthz port to PSP in Helm Chart when hostNetwork is used website#1203 Clarify ingress-shim annotations website#1197 doc about new option default-cleanup-policy website#1201 Faster ./scripts/gendocs/generate script website#1199 Webhook troubleshooting: advise people to set `timeoutSeconds` to 30 seconds website#1198 Bump webpack from 5.70.0 to 5.76.1 website#1192 release-process: explain how and when to merge master into release-next website#1195 Fix description of what happens to denied CertificateRequest website#1071 Improved the summary on the docs homepage website#1005 Route53 accessKeyIDSecretRef docs release#120 Bump golang.org/x/text from 0.3.7 to 0.3.8 release#118 Bump helm.sh/helm/v3 from 3.9.4 to 3.11.1 release#121 Bump golang.org/x/net from 0.0.0-20220225172249-27dd8689420f to 0.7.0 istio-csr#187 Add the ability to ignore cluster scoped resources. istio-csr#194 Add IstioOperator CR for v1.17.0 istio-csr#202 Support adding pod annotations approver-policy#208 Templating in policy trust-manager#116 feat: add support for additional pod annotations/labels trust-manager#43 Add a design for public trust bundles trust-manager#98 Cert formats proposal trust-manager#117 fixes #13 - Allow node selection based on nodeSelector, tolerations, affinities and topologySpreadConstraints csi-driver#139 Bump golang.org/x/text from 0.3.7 to 0.3.8 in /hack/tools csi-driver#138 Bump golang.org/x/net from 0.2.0 to 0.7.0 csi-driver#129 Add attribute support for certificate subject openshift-routes#24 Document release process and update the versions of the GitHub Actions workflows csi-lib#46 Add timeout to renewal issuance logic sample-external-issuer#28 Cleanup make files	cert-manager#5799 kubectl apply error couldn't get resource list for external.metrics.k8s.io/v1beta1: Got empty response for: external.metrics.k8s.io/v1beta1 cert-manager#4918 Leader election timeout (?) causes exit cert-manager#3992 Add non-CRD yaml file cert-manager#5881 Whats the impact of removing the auto mount of access token for cert manager service accounts. website#1132 New version of adcs-issuer website#753 Route53 - AWS IAM Account Setup is confusing website#401 Bring tutorials up to date website#354 DigitalOcean access-token should not be base64-encoded website#320 Document how to install cert-manager using gitops and known issues with particular gitops implementations website#56 Route53: document use of "region" field	cert-manager#5877 Adding Domains.Google.com as an option for DNS-01 cert-manager#5867 Controller can't handle hitting request rate limits of zerossl ACME API	cert-manager#5861 cert manager API showing error - "x509: certificate has expired or is not yet valid"	cert-manager#2334 Add network policy allowance into documentation 5417
	website#944 Document how to install cert-manager in a different namespace 🌊
	website#851 create Cilium ingress tls example 🌊				cert-manager#5158 Added certificate owner ref field 🌊 website#1183 Docs: Clarify zeroSSL setup instructions 🌊

Daily Triage

323 unique items

Completion ETA: ~2023-03-23