Once every quarter, look for stale issues, reprioritize, and de-duplicate.
Issues nearing expiration (20)
Resolution: Close or label as frozen
Average age: 622.4d, Avg wait: 131.5d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags |
| 8023 |  |
ACME issuer fails when CA includes Name Constraints with x509: unhandled critical extension | 6mo | 8d | 6mo |  |
lifecycle/stale
|
commented contributor-last recv recv-q
|
||
| 7914 |  |
Output tls.crt in CA cert to another secret | 7mo | 4wk | 7mo |
kind/feature
lifecycle/stale
|
contributor-last recv
|
|||
| 7829 |  |
Support to auto delete Certificaterequest |
|
8mo | 2mo | 8mo |  |
kind/feature
lifecycle/stale
|
commented contributor-last send similar
|
|
| 7422 |  |
Please provide standalone helm chart for CRDs |
20
|
1y | 4d | 1y |    |
kind/feature
lifecycle/stale
|
contributor-last recv
|
|
| 6179 |  |
CRDs shouldn't be templated in Helm |
5
2
30
|
2y | 2d | 6mo |           |
priority/backlog
lifecycle/stale
|
commented contributor-last recv-q send
|
|
| 2820 |  |
Add ability to set `pathlen:0` for CA certs in `X509v3 Basic Constraints`
|
|
|
5y | 8d | 7mo |        |
area/api
good first issue
kind/feature
priority/important-longterm
lifecycle/stale
|
assigned assignee-updated commented contributor-last pr-closed pr-merged send
|
| 7741 |  |
Certmanager attempts infinite renewals if the Issuer Certificate read from Vault has expired |
3
|
10mo | 6wk | 6wk |   |
good first issue
kind/bug
priority/important-soon
lifecycle/stale
|
commented member-last send
|
|
| 7684 |  |
Add support for namespaced deployment
|
11mo | 2mo | 11mo |  |
kind/feature
lifecycle/stale
|
contributor-last pr-merged recv recv-q similar
|
||
| 7906 |  |
fix: Venafi call GetRefreshToken only when access token invalid for password/username authentication |
2
|
7mo | 6d | 6mo | |
release-note
size/S
kind/bug
lifecycle/stale
dco-signoff: yes
ok-to-test
|
commented contributor-last send unreviewed
|
|
| 7399 |  |
Add renew window to restrict when certificate renewal can happen | 1y | 11d | 1y |  |
size/L
release-note
needs-rebase
area/api
kind/feature
needs-ok-to-test
lifecycle/stale
dco-signoff: yes
area/testing
area/deploy
|
contributor-last recv recv-q similar unreviewed
|
||
| 7662 |  |
Fix the issue of webhook routes generating duplicate operation IDs | 11mo | 2mo | 11mo | |
do-not-merge/release-note-label-needed
needs-ok-to-test
size/M
lifecycle/stale
area/acme
dco-signoff: yes
needs-kind
|
contributor-last recv recv-q unreviewed
|
||
| 7289 | |
Design proposal for delayed certificate activation | 1y | 3mo | 1y |   |
size/L
release-note-none
kind/design
needs-ok-to-test
lifecycle/stale
dco-signoff: yes
|
commented contributor-last recv recv-q reviewed-with-comment
|
||
| 650 |  |
Pod goes out of readiness | 8mo | 2mo | 8mo |
lifecycle/stale
|
contributor-last recv
|
|||
| 645 |  |
Unable to pass helm lint due to certificate yaml stripping too much whitespace | 8mo | 2mo | 8mo | |
lifecycle/stale
|
commented contributor-last send
|
||
| 629 |  |
The crds is not installed automatically when trust-manager is a sub-chart | 10mo | 2mo | 10mo |  |
lifecycle/stale
|
contributor-last recv recv-q
|
||
| 142 |  |
expose bundles CRD as release artifact |
2
11
|
2y | 4wk | 7mo |    |
help wanted
lifecycle/stale
|
commented contributor-last recv-q send
|
|
| 222 | |
[Feature] - Ability to inject a CA cert into a cert-manager managed secret resource
|
16
|
2y | 6d | 6mo |      |
lifecycle/stale
|
commented contributor-last pr-merged send
|
|
| 33 |  |
Support CRDs as target |
5
|
3y | 2mo | 8mo | |
priority/backlog
lifecycle/stale
|
commented contributor-last send
|
|
| 4 | |
Feature: By default, require only self-signed certificates in a bundle |
|
4y | 2mo | 8mo |  |
kind/feature
help wanted
good first issue
lifecycle/stale
|
commented contributor-last send
|
|
| 683 | |
feat: Add a very basic pre-commit configuration | 7mo | 3wk | 6mo | |
dco-signoff: yes
size/XS
lifecycle/stale
|
commented contributor-last new-commits
|
Features that deserve a follow-up comment (10)
Resolution: Comment or close the issue
Average age: 362.0d, Avg wait: 140.3d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags |
| 8209 |  |
Add revocation at certificate deletion |
3
|
4mo | 4mo | 4mo |  |
kind/feature
|
recv similar
|
|
| 8121 |  |
Support for Creating CertificateRequest from Kubernetes Secret | 5mo | 4mo | 5mo |  |
kind/feature
triage/needs-information
|
contributor-last recv recv-q similar
|
||
| 7868 |  |
Metrics for webhook certificate |
3
|
7mo | 4mo | 7mo | |
kind/feature
|
recv
|
|
| 8235 |  |
Cert-manager support for Issuer-managed keys | 4mo | 4mo | 4mo | |
kind/feature
|
commented recv
|
||
| 7817 |  |
Support `global.nodeSelector` in the Helm chart
|
2
|
8mo | 4mo | 8mo | |
kind/feature
|
contributor-last pr-merged recv
|
|
| 6662 |  |
support overriding of ttl in cloudflare |
2
|
2y | 3mo | 2y | |
kind/feature
priority/backlog
|
commented recv
|
|
| 7747 |  |
[suggestion] Add Kustomize install documentation |
5
6
|
10mo | 5mo | 10mo |   |
kind/feature
|
commented recv recv-q
|
|
| 6010 |  |
Support the ACME Renewal Information (ARI) extension |
13
|
2y | 3mo | 9mo |     |
kind/feature
|
commented recv recv-q
|
|
| 7561 |  |
Feature Request RFC: Push notifications from cert-manager to <other service> when certificates are issued | 1y | 4mo | 4mo | |
kind/feature
|
commented recv recv-q
|
||
| 742 |  |
Add option to disable webhook in Helm chart | 6mo | 3mo | 6mo | |
kind/feature
|
commented recv
|
Features that have not been commented on within 90 days (28)
Resolution: Comment or close the issue
Average age: 957.2d, Avg wait: 50.1d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags | |
| 8194 |  |
Update e2e Documentation - for the make e2e-setup command | 4mo | 4mo | 4mo |  |
kind/feature
|
collaborator-last commented send
|
|||
| 7879 | |
Remove no-op certificate metrics controller |
| 7mo | 5mo | 7mo |  |
kind/feature
priority/backlog
|
assigned assignee-updated commented
|
||
| 7788 |  |
Be able to default `acme.cert-manager.io/http01-edit-in-place: "true"` behavior in deployment/chart values |
4
|
9mo | 3mo | 3mo |   |
kind/feature
|
collaborator-last commented send
|
||
| 7598 |  |
More fine-grained control of powerful RBAC permission granted via Helm chart
|
|
2
5
|
1y | 5mo | 8mo | |
kind/feature
priority/important-longterm
|
assigned assignee-updated commented pr-merged recv-q send
|
|
| 7520 |  |
ClusterIssuer read caBundle from Secret |
7
|
1y | 3mo | 10mo |  |
kind/feature
|
commented pr-unreviewed send
|
||
| 6470 |  |
ingress-shim: allow to impersonate ingress-creator instead of using cert-manager serviceaccount |
2
|
2y | 1y | 2y | |
lifecycle/frozen
kind/feature
priority/backlog
|
commented contributor-last send
|
||
| 6224 |  |
Option to store certificate history in individual secrets |
2
|
2y | 5mo | 6mo |  |
kind/feature
|
commented contributor-last recv-q send
|
||
| 6051 |  |
Detecting Gateway hostnames based on attached HTTPRoutes
|
7
31
|
2y | 7mo | 8mo |        |
lifecycle/frozen
kind/feature
priority/important-longterm
|
commented pr-merged send
|
||
| 5566 |  |
upload Helm charts to OCI registry and sign them with cosign
|
4
56
|
3y | 5mo | 5mo |              |
kind/feature
|
commented member-last pr-merged send
|
||
| 3521 | |
Integration with ExternalDNS |
4
52
|
5y | 6mo | 1y |              |
help wanted
lifecycle/frozen
kind/feature
priority/important-longterm
|
commented recv-q
|
||
| 2178 | |
Handling 'unregistering' certificates from Venafi TPP |
22
|
6y | 2y | 2y |       |
lifecycle/frozen
kind/feature
priority/important-longterm
area/venafi
|
commented member-last send
|
||
| 3298 |  |
Let's encrypt certificate caching to mitigate rate limits problems |
3
5
24
|
5y | 4mo | 2y |           |
help wanted
kind/feature
priority/backlog
|
commented send
|
||
| 3381 |  |
Setup separate package for cert-manager API |
|
5
|
5y | 1y | 1y | |
lifecycle/frozen
kind/feature
priority/important-soon
|
assigned assignee-updated commented member-last send
|
|
| 2930 |  |
Mirror to gcr.io or dockerhub |
|
2
29
|
5y | 1y | 1y |          |
lifecycle/frozen
kind/feature
priority/important-soon
area/deploy
|
assigned assignee-updated commented contributor-last send
|
|
| 2525 |  |
Better support multi-namespace & single-namespace deployments
|
27
|
6y | 10mo | 2y |         |
lifecycle/frozen
kind/feature
priority/important-longterm
area/deploy
|
commented contributor-last pr-closed send similar
|
||
| 2538 |  |
cert-manager does not use ingress.class from Ingress annotated with cert-manager.io/cluster-issuer |
75
|
6y | 2y | 2y |                    |
area/api
help wanted
lifecycle/frozen
kind/feature
priority/backlog
|
commented send
|
||
| 155 | |
Add 'unreleased version' & 'old version' warning banner to non-latest versions of docs | 6y | 5y | 6y | |
kind/feature
priority/backlog
|
commented contributor-last
|
|||
| 154 | |
Publish SBOMs | 2y | 2y | 2y | |
kind/feature
good first issue
|
commented member-last send
|
|||
| 10 previously listed items omitted: #8235 #8209 #8121 #7868 #7817 #7747 #7561 #6662 #6010 #742 | |||||||||||
Bugs that deserve a follow-up comment (16)
Resolution: Comment or close the issue
Average age: 556.0d, Avg wait: 260.0d
Bugs that have not been commented on within 60 days (29)
Resolution: Comment or close the issue
Average age: 624.7d, Avg wait: 143.5d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags | |
| 8234 |  |
Vault Issuer: certmanager spams thousands of CertificateRequest resources if Issuer is configured to use the Vault issue endpoint rather than the sign endpoint |
|
4mo | 4mo | 4mo | |
kind/bug
|
commented member-last send
|
||
| 8102 |  |
cert-manager-startupapicheck erroring while installation |
4
|
5mo | 2mo | 2mo |   |
kind/bug
triage/needs-information
|
commented member-last send
|
||
| 7845 |  |
ClusterIssuer.cert-manager.io "letsencrypt" is invalid: spec.acme.privateKeySecretRef: Required value... |
6
|
8mo | 5mo | 6mo | |
kind/bug
priority/awaiting-more-evidence
area/acme
triage/needs-information
|
collaborator-last commented send
|
||
| 7828 |  |
Cert-manager created multiple CertificateRequests (over 30k) for a valid certificate |
|
8mo | 4mo | 7mo |  |
kind/bug
|
commented send similar
|
||
| 7476 |  |
[Helm Chart] - Wrong handling of image registry and repository
|
4
|
1y | 3mo | 3mo |   |
kind/bug
|
commented member-last pr-closed send
|
||
| 5959 |  |
`ImagePullBackoff` on `cm-acme-http-solver` pod, if using private registries |
23
|
2y | 3mo | 2y |     |
lifecycle/frozen
kind/bug
priority/important-longterm
|
commented contributor-last recv-q send
|
||
| 5867 |  |
Controller can't handle hitting request rate limits of zerossl ACME API
|
7
12
31
|
3y | 11mo | 2y |               |
lifecycle/frozen
kind/bug
priority/important-soon
|
commented pr-closed pr-merged recv-q send
|
||
| 6969 | |
Should upgrade status managed fields from CSA to SSA when ServerSideApply feature gate enabled | 2y | 1y | 2y | |
lifecycle/frozen
kind/bug
priority/important-longterm
|
commented contributor-last send
|
|||
| 5101 |  |
No backoff/delay when failing to create challenge solver pods |
9
|
3y | 3mo | 3mo |  |
kind/bug
priority/important-longterm
triage/needs-information
|
commented member-last pr-unreviewed send
|
||
| 6716 |  |
leader election namespace should default to `.Release.Namespace`, not `kube-system` |
3
41
|
2y | 2mo | 2y |        |
lifecycle/frozen
kind/bug
triage/not-reproducible
|
commented pr-closed pr-unreviewed recv-q send
|
||
| 6331 |  |
CSR not signed by referenced private key |
10
|
2y | 3mo | 2y |     |
lifecycle/frozen
kind/bug
priority/important-soon
|
commented contributor-last recv-q send
|
||
| 6230 |  |
DigitalOcean: cert-manager DDoSes DNS-01 solver - infinite rate limiting
|
6
|
2y | 3mo | 4mo |         |
lifecycle/frozen
kind/bug
priority/critical-urgent
area/acme/dns01
|
commented member-last pr-closed pr-merged send
|
||
| 5864 |  |
Certmgr allows creating certificates expiring after ca expiration. |
4
33
|
3y | 4mo | 10mo |       |
lifecycle/frozen
kind/bug
cybr
|
commented pr-new-commits recv-q send
|
||
| 16 previously listed items omitted: #8095 #8086 #8058 #7864 #7862 #7826 #7768 #7522 #7438 #7388 #7486 #6741 #5751 #4749 #4685 #7234 | |||||||||||
Items that deserve a follow-up comment (88)
Resolution: Comment or close the issue
Average age: 846.5d, Avg wait: 783.2d
Items that have not been commented on within 60 days (143)
Resolution: Comment or close the issue
Average age: 953.1d, Avg wait: 474.3d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags | |
| 8201 |  |
Timeout contacting Cloudflare API during cert-manager DNS-01 challenge | 4mo | 3mo | 4mo |  |
commented send
|
||||
| 8183 | |
Add helm diff output to cert-manager PRs |
| 4mo | 3mo | 4mo | |
assigned assignee-updated collaborator-last commented send
|
|||
| 7822 |  |
Tracking: Kubernetes Gateway API follow up tasks
|
5
|
8mo | 3mo | 3mo | |
commented member-last pr-merged send
|
|||
| 6709 | |
1.14 Release Review |
3
|
2y | 2y | 2y | |
lifecycle/frozen
priority/important-soon
|
commented contributor-last send
|
||
| 5298 | |
Complete the Migration Away From Jetstack Names | 3y | 2y | 2y | |
lifecycle/frozen
kind/cleanup
priority/important-soon
|
commented member-last send
|
|||
| 2334 |  |
Add network policy allowance into documentation
|
2
24
|
6y | 4mo | 2y |       |
good first issue
help wanted
kind/documentation
priority/backlog
area/deploy
|
commented pr-merged send
|
||
| 4191 | |
Setting default values for Pod's "resources"? |
7
|
4y | 1y | 1y |  |
lifecycle/frozen
priority/important-longterm
|
commented contributor-last recv-q send
|
||
| 4950 | |
General flakiness of our end-to-end suite
|
3
|
4y | 2y | 3y |  |
lifecycle/frozen
priority/important-longterm
kind/flake
|
commented member-last pr-closed pr-merged send
|
||
| 1546 | |
Self upgrade PRs don't run checks |
|
2y | 4mo | 2y | |
cybr
|
commented member-last
|
||
| 1262 | |
v1.9 to v1.10 upgrade instructions does not mention container name change |
| 2y | 1y | 2y | |
priority/backlog
|
assigned assignee-updated commented member-last send
|
||
| 1194 |  |
Confusing paragraph - cert-manager integration. | 3y | 2y | 2y | |
documentation
priority/important-longterm
|
commented member-last send
|
|||
| 1186 | |
Document that/why we don't use Helm's CRD installation mechanism |
| 3y | 2y | 2y | |
good first issue
priority/important-longterm
kind/documentation
|
assigned assignee-updated commented member-last send
|
||
| 1174 |  |
Document the docker images and how to find them |
|
3y | 3y | 3y | |
good first issue
priority/important-soon
kind/documentation
|
commented member-last send
|
||
| 1101 |  |
Feature request for updating documentation. | 3y | 2y | 2y | |
priority/backlog
|
commented member-last send similar
|
|||
| 697 |  |
[IRSA] Needs `runAsUser: 1001`
|
4y | 1y | 1y | |
commented member-last pr-merged send
|
||||
| 414 | |
Explain cert-manager repo structure
|
|
2
|
5y | 5y | 5y | |
priority/backlog
kind/documentation
|
assigned assignee-updated commented member-last pr-closed pr-merged send
|
|
| 401 | |
Bring tutorials up to date | 5y | 3y | 3y | |
priority/important-longterm
|
commented member-last send
|
|||
| 320 | |
Document how to install cert-manager using gitops and known issues with particular gitops implementations
|
5
|
5y | 2y | 5y |   |
documentation
help wanted
priority/backlog
|
commented pr-merged recv-q
|
||
| 234 |  |
Backup and Restore Resources
|
3
|
5y | 5y | 5y |  |
priority/backlog
kind/documentation
|
commented member-last pr-merged send
|
||
| 223 | |
Document wildcard certificate tutorial | 5y | 5y | 5y |  |
priority/important-longterm
kind/documentation
|
commented contributor-last send
|
|||
| 195 | |
Document keystores | 5y | 3y | 5y | |
priority/important-soon
kind/documentation
|
commented contributor-last send
|
|||
| 174 |  |
Add documentation for CRD conversion webhook ca injection | 5y | 5y | 5y | |
help wanted
priority/important-soon
kind/documentation
|
commented member-last send
|
|||
| 153 |  |
It is possible to have several CAs within the same cluster. |
3
|
3y | 1y | 2y |   |
commented send
|
|||
| 394 |  |
Limit number of SANs by policy |
|
2y | 2y | 2y | |
commented member-last send
|
|||
| 203 | |
Improve CRD fields for specifying key requirements |
3
|
3y | 1y | 1y | |
commented member-last send
|
|||
| 169 |  |
Webhook Custom CA | 3y | 10mo | 10mo | |
help wanted
|
commented contributor-last recv-q send
|
|||
| 216 | |
Simplify configuration by creating RBAC by default |
2
|
3y | 11mo | 11mo | |
help wanted
|
commented contributor-last pr-merged pr-unreviewed recv-q send
|
||
| 288 | |
Feature: Take control of approval for the whole cluster |
2
|
2y | 2y | 2y | |
commented member-last
|
|||
| 741 |  |
Using an Image Volume to deploy certifiats |
|
6mo | 5mo | 6mo | |
commented member-last send
|
|||
| 592 | |
Feature: ClusterTrustBundle as Sources |
|
11mo | 4mo | 4mo |  |
commented member-last send similar
|
|||
| 591 | |
Feature: ClusterTrustBundle as Target
|
12
|
11mo | 4mo | 4mo | |
commented member-last pr-merged send similar
|
|||
| 297 |  |
Allow all resources to be namespaced |
7
|
2y | 5mo | 5mo |  |
priority/backlog
|
commented member-last send
|
||
| 245 | |
Split Bundle controller into multiple controllers
|
|
2y | 1y | 1y | |
lifecycle/frozen
|
commented member-last pr-merged send
|
||
| 242 | |
New version of Bundle API
|
2
4
|
2y | 11mo | 1y |   |
lifecycle/frozen
|
commented pr-closed pr-merged
|
||
| 131 |  |
Feature: per namespace trust bundle |
8
|
2y | 5mo | 8mo |    |
lifecycle/frozen
|
commented send
|
||
| 63 |  |
nit: Rename "Bundle" to "ClusterBundle"
|
18
|
3y | 8mo | 8mo |  |
lifecycle/frozen
|
commented member-last open-milestone pr-merged send
|
||
| 39 | |
Don't sync targets to all namespaces by default
|
8
|
3y | 10mo | 10mo | |
lifecycle/frozen
|
commented member-last open-milestone pr-merged send
|
||
| 99 | |
Allow removing Bundles whilst keeping the synced CA certs
|
5
|
3y | 10mo | 10mo | |
lifecycle/frozen
|
commented member-last pr-unreviewed
|
||
| 58 |  |
Support injection pem into an existing configmap |
|
8
|
3y | 10mo | 10mo | |
priority/important-longterm
lifecycle/frozen
|
assigned assignee-updated commented member-last pr-closed pr-merged pr-unreviewed send
|
|
| 204 |  |
clarify SetCAOnCertificateRequest deprecation status | 1y | 8mo | 8mo | |
commented member-last send
|
||||
| 171 | |
E2E Test Cleanup | 2y | 2y | 2y | |
good first issue
|
commented member-last
|
|||
| 45 |  |
Unable to mount and read only file error |
5
|
4y | 2y | 2y |     |
priority/awaiting-more-evidence
|
commented send
|
||
| 38 |  |
Route with cert-manager annotations is not created |
4
|
2y | 9mo | 2y |    |
commented send
|
|||
| 70 |  |
OLM deployment with ArgoCD is OutOfSync |
|
3y | 3y | 3y |  |
commented send
|
|||
| 33 | |
Create e2e test to validate CertificateRequest garbage collection |
| 3y | 2y | 2y | |
priority/backlog
|
assigned commented member-last send
|
||
| 56 |  |
Struggling to get controller running in local KIND cluster |
|
1y | 10mo | 10mo | |
commented member-last send
|
|||
| 264 | |
commands should provide help when called w/o arguments if they require inputs | 7mo | 7mo | 7mo | |
commented member-last send
|
||||
| 59 | |
Process regarding worrying emails sent to the maintainers mailing list |
|
6mo | 5mo | 5mo | |
commented member-last
|
|||
| 81 | |
Configuring Peribolos for Github org management | 7y | 2y | 2y | |
priority/backlog
|
commented member-last send
|
|||
| 202 | |
Makefile Modules, Go Versions and Vendoring |
|
1y | 1y | 1y | |
commented contributor-last
|
|||
| 3 | |
Migrating all cert-manager projects to "Makefile modules" | 2y | 3mo | 8mo | |
priority/backlog
|
commented member-last
|
|||
| 451 | |
Re-enable testing with specific kubernetes versions in subprojects | 4mo | 4mo | 4mo | |
cybr
|
commented member-last send
|
|||
| 64 | |
Open Standup: Updating an event didn't send new invitations to already registered people |
|
3mo | 3mo | 3mo | |
commented member-last send
|
|||
| 63 | |
CNCF-paid GitHub Actions runners | 4mo | 3mo | 3mo | |
commented member-last
|
||||
| 60 | |
Lazy vote: Zoom for standup meetings to be able to add the standups to the LFX calendar |
|
4mo | 3mo | 3mo | |
commented member-last
|
|||
| 43 | |
Allow non-Venafi employee maintainers full release capabilities |
|
3
|
1y | 3mo | 3mo | |
priority/backlog
|
assigned assignee-updated commented member-last
|
|
| 35 | |
Post-Graduation Suggestion Tracker
|
|
2y | 2y | 2y | |
commented member-last pr-merged
|
|||
| 27 |  |
failed with: OpenAPI spec does not exist
|
2
6
|
4y | 2y | 2y |        |
priority/critical-urgent
|
commented pr-closed pr-unreviewed send
|
||
| 3 | |
Make unit testing easier/make examples work
|
6y | 2y | 4y |    |
priority/important-longterm
|
commented member-last pr-closed send
|
|||
| 197 |  |
Kubectl One-line Installation Support | 2y | 1y | 1y | |
commented member-last send similar
|
||||
| 83 previously listed items omitted | |||||||||||