queue to be emptied once a week in a team triage meeting
Important soon, but no updates in 60 days (14)
Resolution: Downgrade to important-longterm
Average age: 1544.3d, Avg wait: 74.7d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags |
| 5298 |  |
Complete the Migration Away From Jetstack Names | 4y | 2y | 2y |  |
lifecycle/frozen
kind/cleanup
priority/important-soon
|
commented member-last send
|
||
| 3992 |  |
Add non-CRD yaml file |
5
|
5y | 5mo | 2y |       |
priority/important-soon
area/deploy
|
commented recv
|
|
| 7895 |  |
if certificate is already expired, it shown like a True |
2
|
1y | 5mo | 5mo |        |
help wanted
priority/important-soon
|
collaborator-last commented pr-closed pr-reviewed-with-comment pr-unreviewed send
|
|
| 6709 | |
1.14 Release Review |
3
|
2y | 2y | 2y | |
lifecycle/frozen
priority/important-soon
|
commented contributor-last send
|
|
| 3381 |  |
Setup separate package for cert-manager API | 
|
6
|
6y | 2y | 2y |    |
lifecycle/frozen
kind/feature
priority/important-soon
|
assigned assignee-updated commented member-last send
|
| 5867 |  |
Controller can't handle hitting request rate limits of zerossl ACME API
|
7
12
31
|
3y | 2y | 2y |                |
lifecycle/frozen
kind/bug
priority/important-soon
|
commented pr-closed pr-merged recv-q send
|
|
| 6741 |  |
ACME account private key and URI are not updated if the path of the ACME server is changed |
7
|
2y | 10mo | 2y |  |
lifecycle/frozen
kind/bug
priority/important-soon
|
pr-unreviewed recv
|
|
| 2930 |  |
Mirror to gcr.io or dockerhub |
|
2
29
|
6y | 4mo | 2y |            |
lifecycle/frozen
kind/feature
priority/important-soon
area/deploy
|
assigned assignee-updated commented recv-q send
|
| 955 | |
Document when the vault pki role required setting `require_cn=false` |
2
|
4y | 2y |  |
priority/important-soon
|
|||
| 802 | |
Spelling errors are unclear in pull request CI results and spell checker is unmaintained
|
4y | 2y |  |
kind/bug
priority/important-soon
|
contributor-last pr-merged
|
|||
| 195 | |
Document keystores | 6y | 3y | 6y | |
priority/important-soon
kind/documentation
|
commented contributor-last send
|
||
| 174 |  |
Add documentation for CRD conversion webhook ca injection | 6y | 6y | 6y | |
help wanted
priority/important-soon
kind/documentation
|
commented member-last send
|
||
| 1425 | |
The `issuer.vault.spec.caBundleSecretRef` docs are missing | 2y | 2y |
priority/important-soon
|
pr-reviewed-with-comment
|
||||
| 127 | |
cmctl version reports only the old CRD version if I upgrade cert-manager without including the CRDs | 2y | 2y |
priority/important-soon
|
Important longterm, but no updates in 120 days (25)
Resolution: Downgrade to backlog
Average age: 1630.2d, Avg wait: 278.9d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags |
| 7514 |  |
Replace some of the webhook functionality with `ValidatingAdmissionPolicy` & CEL |
|
2y | 8mo | 1y | |
kind/feature
priority/important-longterm
|
commented recv
|
|
| 6820 | |
Ongoing dependency evaluation |
|
2y | 2y | 2y | |
lifecycle/frozen
priority/important-longterm
|
contributor-last recv
|
|
| 6969 | |
Should upgrade status managed fields from CSA to SSA when ServerSideApply feature gate enabled | 2y | 2y | 2y | |
lifecycle/frozen
kind/bug
priority/important-longterm
|
commented contributor-last send
|
||
| 5959 |  |
`ImagePullBackoff` on `cm-acme-http-solver` pod, if using private registries |
23
|
3y | 10mo | 2y |      |
lifecycle/frozen
kind/bug
priority/important-longterm
|
commented contributor-last recv-q send
|
|
| 4191 | |
Setting default values for Pod's "resources"? |
7
|
5y | 2y | 2y |  |
lifecycle/frozen
priority/important-longterm
|
commented contributor-last recv-q send
|
|
| 3706 |  |
renewal-hooks |
4
3
23
|
5y | 4mo | 4mo |       |
kind/feature
priority/important-longterm
lifecycle/rotten
|
commented pr-reviewed-with-comment recv recv-q
|
|
| 6051 |  |
Detecting Gateway hostnames based on attached HTTPRoutes
|
7
35
|
3y | 1y | 1y |        |
lifecycle/frozen
kind/feature
priority/important-longterm
|
commented pr-merged send
|
|
| 3521 | |
Integration with ExternalDNS |
4
55
|
5y | 1y | 2y |            |
help wanted
lifecycle/frozen
kind/feature
priority/important-longterm
|
commented recv-q
|
|
| 4685 | |
Unexpected EOF during watch stream event decoding: unexpected EOF -- possibly due to api server upgrades / restarts |
12
|
4y | 1y | 1y |        |
lifecycle/frozen
kind/bug
priority/important-longterm
|
commented contributor-last recv
|
|
| 2478 |  |
Allow CA issuer secret rotation |
2
72
|
6y | 4mo | 4mo |                     |
kind/feature
priority/important-longterm
area/ca
|
commented member-last send
|
|
| 2820 |  |
Add ability to set `pathlen:0` for CA certs in `X509v3 Basic Constraints`
|
|
|
6y | 7mo | 7mo |     |
area/api
good first issue
kind/feature
priority/important-longterm
|
assigned assignee-updated commented pr-closed pr-merged recv-q send
|
| 2525 |  |
Better support multi-namespace & single-namespace deployments
|
30
|
6y | 1y | 2y |        |
lifecycle/frozen
kind/feature
priority/important-longterm
area/deploy
|
commented contributor-last pr-closed send
|
|
| 1194 |  |
Confusing paragraph - cert-manager integration.
|
3y | 6mo | 3y |  |
documentation
priority/important-longterm
|
commented contributor-last pr-merged send
|
||
| 1063 |  |
"Securing Ingresses with Venafi" tutorial contains link to missing manifest
|
4y | 2y | 4y | |
priority/important-longterm
|
pr-merged recv
|
||
| 975 | |
Some pages do not make it clear what the user should read next | 4y | 2y |
priority/important-longterm
|
|||||
| 1186 | |
Document that/why we don't use Helm's CRD installation mechanism |
| 3y | 2y | 2y | |
good first issue
priority/important-longterm
kind/documentation
|
assigned assignee-updated commented member-last send
|
|
| 401 | |
Bring tutorials up to date | 5y | 3y | 3y | |
priority/important-longterm
|
commented member-last send
|
||
| 223 | |
Document wildcard certificate tutorial | 6y | 6y | 6y |  |
priority/important-longterm
kind/documentation
|
commented contributor-last send
|
||
| 850 | |
Document available cert-manager Prometheus metrics |
|
4y | 3y | 4y |  |
documentation
good first issue
priority/important-longterm
|
pr-closed pr-unreviewed recv recv-q
|
|
| 58 |  |
Support injection pem into an existing configmap |
|
8
|
4y | 1y | 1y | |
priority/important-longterm
lifecycle/frozen
|
assigned assignee-updated commented member-last pr-closed pr-merged pr-unreviewed send
|
| 129 | |
Increase e2e test timeouts | 2y | 2y |
priority/important-longterm
|
|||||
| 83 |  |
As cmctl user, I want to use different kubectl context on command line ( --context='kubectl-context-abc' ) |
6
|
2y | 2y | 2y |
priority/important-longterm
|
recv
|
||
| 98 | |
Document new release process for all repos |
| 2y | 2y |
priority/important-longterm
|
assigned
|
|||
| 38 |  |
Set repository to be a GitHub template repository |
|
4y | 2y | 4y |
priority/important-longterm
|
recv
|
||
| 3 | |
Make unit testing easier/make examples work
|
7y | 2y | 4y |    |
priority/important-longterm
|
commented member-last pr-closed send
|
many reactions, low priority (5)
Resolution: Upgrade to priority-soon, priority-longterm, or longterm-support
Average age: 282.8d, Avg wait: 42.2d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags |
| 9066 |  |
Improving Roue53 DNS Challenge Presentation to avoid repeated creation of same ChangeRecord |
3
|
2mo | 1mo | 1mo |  |
commented member-last pr-approved pr-reviewed-with-comment send
|
||
| 8493 |  |
cloudflare DNS01 - Client.Timeout exceeded while awaiting headers | 
| 4
11
|
8mo | 4wk | 7mo |     |
good first issue
help wanted
kind/bug
|
assigned assignee-updated commented pr-unreviewed recv-q send
|
| 8929 |  |
Post-Quantum Cryptography: Plan ML-DSA certificate support for Go 1.27 |
6
9
|
3mo | 1d | 1d |      |
commented member-last pr-merged pr-new-commits pr-unreviewed send
|
||
| 7473 |  |
Create certificate based on HTTPRoute configuration
|
|
65
7
102
|
2y | 13d | 6mo |            |
kind/feature
lifecycle/stale
|
assigned assignee-updated commented contributor-last pr-closed pr-merged send
|
| 8373 |  |
DNS-PERSIST-01 challenge support (planned for late Q1 2026) |
9
4
3
226
|
9mo | 5mo | 9mo |    |
kind/feature
|
recv recv-q similar
|
many commenters, low priority (13)
Resolution: Upgrade to priority-soon, priority-longterm, or longterm-support
Average age: 42.8d, Avg wait: 7.4d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags |
| 9347 | |
The filtered Secret lister silently turns a LIST into one API GET per Secret in the namespace |
2
|
4wk | 9d | 9d |   |
kind/bug
|
commented member-last pr-closed pr-new-commits pr-unreviewed send
|
|
| 9266 |  |
Enable the race detector in CI: go test -race currently fails in 7 packages | 6wk | 9d |    |
kind/cleanup
area/testing
|
pr-merged pr-unreviewed
|
|||
| 9171 |  |
Allow configuring concatenation key order for CombinedPEM output format (#7766) |
|
1mo | 16d | 16d | |
size/L
release-note
area/api
kind/feature
dco-signoff: yes
ok-to-test
area/deploy
|
commented member-last new-commits send
|
|
| 9306 |  |
ingress-shim: de-duplicate SANs after annotations are merged |
| 5wk | 17d | 17d | |
size/L
release-note
approved
kind/bug
dco-signoff: yes
tide/merge-method-squash
ok-to-test
|
assigned commented contributor-last new-commits recv-q send
|
|
| 9254 | |
Deflake certificate-shim controller register tests | 6wk | 3wk | 3wk | |
release-note-none
size/M
dco-signoff: yes
kind/flake
|
commented contributor-last recv-q send unreviewed
|
||
| 9305 |  |
fix(webhook): validate that renewal windows are reachable within the certificate lifetime | 5wk | 9d | 5wk | |
size/L
release-note
kind/bug
needs-ok-to-test
dco-signoff: yes
|
commented recv recv-q unreviewed
|
||
| 9245 | |
Run dynamic authority tests in a synctest bubble | 6wk | 6wk | 6wk | |
release-note-none
size/S
dco-signoff: yes
kind/flake
|
commented member-last reviewed-with-comment
|
||
| 9241 | |
Recover DynamicAuthority when the CA Secret create race is lost | 6wk | 6wk | 6wk |  |
release-note
kind/bug
size/M
dco-signoff: yes
kind/flake
|
commented member-last reviewed-with-comment
|
||
| 9302 |  |
certificate-shim: compare ipAddresses in certNeedsUpdate |
|
5wk | 17d | 5wk | |
size/L
release-note
do-not-merge/hold
kind/bug
needs-ok-to-test
dco-signoff: yes
|
commented contributor-last new-commits recv similar
|
|
| 9322 |  |
fix: reject duplicate dnsNames and ipAddresses in Certificate webhook | 5wk | 17d | 17d | |
size/L
release-note
area/api
do-not-merge/hold
kind/bug
dco-signoff: yes
ok-to-test
area/deploy
|
commented member-last reviewed-with-comment send
|
||
| 2258 |  |
docs: add certforge-issuer to external issuers list | 6wk | 4d | 6wk |  |
size/XS
dco-signoff: yes
|
commented recv similar unreviewed
|
||
| 2257 |  |
docs: document the Vault issuer caBundleSecretRef field | 6wk | 6wk | 6wk | |
dco-signoff: yes
size/M
|
contributor-last recv recv-q reviewed-with-comment
|
||
| 746 | |
Make Renovate upgrade base images | 4wk | 4wk | 4wk | |
dco-signoff: yes
size/L
needs-rebase
|
commented contributor-last recv-q reviewed-with-comment send
|
Screaming into the void: No matching items
Needs information for over 2 weeks (6)
Resolution: Close or remove triage/needs-information label
Average age: 877.8d, Avg wait: 63.1d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags |
| 8121 |  |
Support for Creating CertificateRequest from Kubernetes Secret | 1y | 2mo | 1y | |
kind/feature
triage/needs-information
lifecycle/rotten
|
contributor-last recv recv-q similar
|
||
| 8102 |  |
cert-manager-startupapicheck erroring while installation |
4
|
1y | 5wk | 10mo |   |
kind/bug
triage/needs-information
lifecycle/rotten
|
commented contributor-last send
|
|
| 7846 |  |
ClusterIssuer.Status.Acme.URI disappeared | 
|
5
|
1y | 4mo | 1y |    |
good first issue
kind/bug
priority/awaiting-more-evidence
area/acme
triage/needs-information
|
assigned assignee-updated commented send
|
| 7845 |  |
ClusterIssuer.cert-manager.io "letsencrypt" is invalid: spec.acme.privateKeySecretRef: Required value... |
6
|
1y | 6wk | 6wk | |
kind/bug
priority/awaiting-more-evidence
area/acme
triage/needs-information
lifecycle/rotten
|
commented member-last send
|
|
| 5101 |  |
No backoff/delay when failing to create challenge solver pods |
9
|
4y | 6wk | 10mo |  |
kind/bug
priority/important-longterm
triage/needs-information
lifecycle/rotten
|
commented contributor-last pr-unreviewed send
|
|
| 15 | |
Allow data-root to be an absolute path | 5y | 3y | |
kind/bug
triage/needs-information
|
contributor-last pr-reviewed-with-comment
|
Support request over 30 days old (2)
Resolution: Close, or add to triage/long-term-support
Average age: 1947.0d, Avg wait: 0.0d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags |
| 53 |  |
Support crlDistributionPoints & ocspServers | 5y | 5y | 5y |  |
triage/support
|
commented send similar
|
||
| 28 |  |
Certificate revocation from CAS Console | 5y | 5y | 5y | |
triage/support
|
commented member-last send similar
|
Issues nearing expiration (28)
Resolution: Close or label as frozen
Average age: 610.4d, Avg wait: 135.5d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags | |
| 8372 | |
HTTP-01 challenge: support stateless http-01 challenge | 9mo | 19d | 9mo |
kind/feature
lifecycle/rotten
|
contributor-last recv
|
||||
| 8364 |  |
Replace Hetzner DNS01 Webhook | 9mo | 2wk | 9mo | |
lifecycle/rotten
|
commented contributor-last send
|
|||
| 8340 | |
Top-level: CA Issuer rotation problem | 10mo | 5wk |
lifecycle/rotten
cybr
|
contributor-last
|
|||||
| 8319 | |
Improve cert-manager's event handler to allow us to selectively skip some reconciliations | 10mo | 4wk |
lifecycle/rotten
cybr
|
contributor-last
|
|||||
| 8296 |  |
HTTP-01 challenge stuck in pending with status code 400 | 10mo | 6d | 9mo |  |
triage/support
lifecycle/rotten
|
commented contributor-last send
|
|||
| 8279 | |
Unblocking SSA: Fix unit tests | 10mo | 7wk |
lifecycle/rotten
cybr
|
contributor-last
|
|||||
| 8194 |  |
Update e2e Documentation - for the make e2e-setup command | 1y | 2mo | 1y | |
kind/feature
lifecycle/rotten
|
commented contributor-last send
|
|||
| 8086 |  |
ACME ClusterIssuer not recovering after Vault restart | 1y | 2mo | 2mo | |
kind/bug
lifecycle/rotten
|
commented member-last send
|
|||
| 7868 |  |
Metrics for webhook certificate |
3
|
1y | 2mo | 1y | |
kind/feature
lifecycle/rotten
|
contributor-last pr-new-commits recv similar
|
||
| 7828 |  |
Cert-manager created multiple CertificateRequests (over 30k) for a valid certificate |
|
1y | 2mo | 1y |   |
kind/bug
lifecycle/rotten
|
commented contributor-last send
|
||
| 7768 |  |
Stuck in a loop with `multiple challenge solver pods found for challenge` | 1y | 5wk | 1y | |
kind/bug
lifecycle/rotten
|
contributor-last pr-new-commits recv
|
|||
| 7585 |  |
Continuous access token requests when using Venafi TPP password/username authentication |
|
2y | 6wk | 6wk |  |
kind/bug
lifecycle/rotten
|
commented member-last pr-closed pr-unreviewed send
|
||
| 7520 |  |
ClusterIssuer read caBundle from Secret
|
8
|
2y | 6wk | 2y |  |
kind/feature
lifecycle/rotten
|
commented contributor-last pr-closed send
|
||
| 7388 |  |
Kid missing in the new order request |
2
|
2y | 2mo | 2y |     |
kind/bug
lifecycle/rotten
|
contributor-last pr-unreviewed recv recv-q
|
||
| 7234 |  |
AWS Route53: Stale/Stuck Challenges should be deleted after a given timeout | 
|
7
|
2y | 5wk | 2y |    |
kind/bug
priority/important-soon
lifecycle/rotten
|
assigned assignee-updated commented contributor-last pr-closed pr-merged pr-reviewed-with-comment recv recv-q
|
|
| 4749 |  |
rfc2136 seems to not work with deep subdomains
|
|
4y | 2mo | 4y |    |
kind/bug
lifecycle/rotten
area/acme/dns01
|
pr-closed recv recv-q
|
||
| 6021 | |
Make it possible to specify logging options for the ACME solver | 3y | 12d | 12d |  |
kind/feature
lifecycle/rotten
|
commented member-last pr-merged pr-reviewed-with-comment send
|
|||
| 8367 |  |
feat(helm) add startupProbe and readinessProbe to cert-manager-controller | 9mo | 7d | 9mo | |
release-note-none
kind/feature
needs-ok-to-test
size/M
lifecycle/rotten
dco-signoff: yes
area/deploy
|
commented contributor-last recv recv-q unreviewed
|
|||
| 8262 | |
Bugfix #7388 kid missing issue with Infisical ACME server or any other ACME that requires EAB |
|
11mo | 4wk | 10mo |  |
size/L
release-note
needs-ok-to-test
area/acme
lifecycle/rotten
dco-signoff: yes
needs-kind
|
commented contributor-last recv unreviewed
|
||
| 8187 |  |
fix: add case for parsing key with ec parameters | 1y | 6wk | 1y | |
size/XS
release-note-none
kind/bug
needs-ok-to-test
lifecycle/rotten
dco-signoff: yes
|
changes-requested contributor-last recv recv-q
|
|||
| 778 |  |
Add option to use a specific issuer in the helm chart | 1y | 2mo | 1y |
lifecycle/rotten
|
contributor-last recv
|
||||
| 591 | |
Feature: ClusterTrustBundle as Target
|
13
|
2y | 7wk | 11mo |   |
lifecycle/rotten
|
commented pr-merged send similar
|
||
| 654 | |
Add design for trust source plugins |
|
1y | 1d | 1y | |
dco-signoff: yes
size/M
do-not-merge/work-in-progress
lifecycle/rotten
|
commented draft reviewed-with-comment send
|
||
| 5 previously listed items omitted: #8121 #8102 #7845 #3706 #5101 | |||||||||||
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags |
| 9306 | |
ingress-shim: de-duplicate SANs after annotations are merged |
| 5wk | 17d | 17d | |
size/L
release-note
approved
kind/bug
dco-signoff: yes
tide/merge-method-squash
ok-to-test
|
assigned commented contributor-last new-commits recv-q send
|
|
| 8529 |  |
fix: schedule readiness re-evaluation at certificate expiry time |
|
8mo | 5wk | 5wk |  |
size/L
release-note
approved
kind/bug
dco-signoff: yes
area/testing
ok-to-test
|
commented member-last reviewed-with-comment send
|
|
| 7689 |  |
Add Vertical Pod Autoscaler |
|
2
|
2y | 7mo | 7mo |   |
size/L
release-note
approved
kind/feature
dco-signoff: yes
ok-to-test
area/deploy
|
assigned assignee-updated changes-requested collaborator-last commented send
|
| 625 | |
Add cache validation | 4mo | 1mo | 1mo | |
dco-signoff: yes
approved
size/L
|
commented member-last reviewed-with-comment send
|
Pull Requests: Stale (222)
Resolution: Add comment and/or close PR
Average age: 342.2d, Avg wait: 90.1d
| ID | Au | Desc | As | Rea | Cr | Up | Re | Cmntrs | Labels | Tags | |
| 8712 |  |
feat(metrics): add Vault Sign() request duration instrumentation | 6mo | 5d | 6mo | |
size/L
release-note
kind/feature
needs-ok-to-test
dco-signoff: yes
area/monitoring
|
contributor-last recv recv-q similar unreviewed
|
|||
| 9387 |  |
Decode metav1.Status in DNS webhook errors | 3wk | 10d | 3wk | |
size/L
release-note
kind/feature
needs-ok-to-test
area/acme
dco-signoff: yes
area/acme/dns01
|
contributor-last recv recv-q unreviewed
|
|||
| 8457 |  |
feat(acme): add support for ECDSA account key algorithm in ACME issuers |
3
|
8mo | 8d | 2mo |   |
release-note
size/XL
area/api
kind/feature
area/acme
dco-signoff: yes
area/testing
ok-to-test
area/deploy
|
commented recv recv-q reviewed-with-comment
|
||
| 9013 |  |
fix(cainjector): add liveness and readiness probes to cainjector deployment | 3mo | 14d | 3mo |  |
release-note
area/api
kind/bug
needs-ok-to-test
size/M
dco-signoff: yes
area/deploy
|
recv recv-q unreviewed
|
|||
| 8253 |  |
refactor(issuer): add shared factory and per-instance registries | 11mo | 15d | 3mo | |
size/L
release-note-none
kind/cleanup
dco-signoff: yes
ok-to-test
|
commented contributor-last new-commits recv recv-q
|
|||
| 9056 | |
fix: don't count terminating HTTP01 solver pods when deciding to create/clean up |
| 2mo | 16d | 7wk | |
release-note
kind/bug
size/M
area/acme
dco-signoff: yes
ok-to-test
area/acme/http01
|
assigned assignee-updated commented contributor-last new-commits recv recv-q
|
||
| 9330 |  |
fix(logging): scope the related-resource logger to one loop iteration | 5wk | 17d | 5wk | |
size/XS
release-note
kind/bug
needs-ok-to-test
dco-signoff: yes
|
contributor-last recv recv-q unreviewed
|
|||
| 8637 |  |
fix(helm): roll deployments on config changes (checksum) |
|
7mo | 18d | 6mo | |
do-not-merge/release-note-label-needed
kind/feature
needs-ok-to-test
size/M
lifecycle/stale
dco-signoff: yes
area/deploy
|
commented recv reviewed-with-comment
|
||
| 9369 | |
test: resolve data races in certificate-shim mockWorkqueue | 4wk | 3wk | 4wk | |
release-note-none
size/S
needs-ok-to-test
dco-signoff: yes
kind/flake
|
recv recv-q unreviewed
|
|||
| 8624 |  |
feat: add autoAnnotations support for Gateway-API | 7mo | 3wk | 7mo | |
size/XS
release-note
do-not-merge/work-in-progress
kind/feature
needs-ok-to-test
lifecycle/stale
dco-signoff: yes
|
commented draft recv unreviewed
|
|||
| 9370 | |
Harden CA bundle admission validation to reject invalid PEMs | 4wk | 10d | 4wk |  |
size/L
release-note
area/api
kind/bug
needs-ok-to-test
dco-signoff: yes
area/testing
area/deploy
|
contributor-last pushed-after-approval recv recv-q
|
|||
| 9183 | |
Route53: resume waiting for a pending record change instead of submitting a duplicate | 1mo | 4wk | 1mo | |
size/L
release-note
needs-rebase
kind/bug
area/acme
dco-signoff: yes
area/acme/dns01
|
approved commented contributor-last recv-q
|
|||
| 5743 | |
Add MaxPathLen and add EncodeBasicConstraintsInRequest option to Certificate and CertificateRequest resources | 3y | 4wk | 7mo | |
size/L
release-note
area/api
kind/cleanup
lifecycle/stale
dco-signoff: yes
area/testing
ok-to-test
area/deploy
|
commented contributor-last reviewed-with-comment
|
|||
| 9150 | |
Accept bundles containing cross-signed certificates in ParseSingleCertificateChain | 2mo | 4wk | 2mo | |
size/L
release-note
needs-rebase
kind/bug
dco-signoff: yes
|
commented contributor-last recv-q reviewed-with-comment
|
|||
| 8722 |  |
fix(dns): propagate caBundle to acmeDNS solver, add per-solver override |
|
6mo | 4wk | 6mo |    |
release-note
area/api
kind/bug
kind/feature
needs-ok-to-test
size/XXL
area/acme
dco-signoff: yes
area/acme/dns01
area/deploy
|
recv recv-q unreviewed
|
||
| 9353 | |
fix(acme): fail over between HTTP-01 self check nameservers | 4wk | 4wk | 4wk | |
size/L
release-note
kind/bug
needs-ok-to-test
area/acme
dco-signoff: yes
area/acme/http01
|
contributor-last recv recv-q unreviewed
|
|||
| 9349 | |
test: exercise the filtered Secret lister in integration tests | 4wk | 4wk | 4wk | |
size/L
release-note-none
needs-ok-to-test
dco-signoff: yes
area/testing
needs-kind
|
contributor-last recv recv-q unreviewed
|
|||
| 9337 |  |
ingress-shim: compare IssuerRef.Group in certNeedsUpdate | 5wk | 4wk | 5wk | |
release-note
do-not-merge/hold
kind/bug
needs-ok-to-test
size/M
dco-signoff: yes
|
recv recv-q reviewed-with-comment similar
|
|||
| 8395 |  |
Clarify code around DNS01 Self Check | 9mo | 4wk | 7mo |  |
release-note-none
kind/cleanup
size/M
area/acme
dco-signoff: yes
ok-to-test
area/acme/dns01
|
commented new-commits recv recv-q
|
|||
| 9334 | |
Add octo-sts trust policy for the release pipeline | 5wk | 5wk | |
do-not-merge/release-note-label-needed
size/S
do-not-merge/work-in-progress
kind/cleanup
dco-signoff: yes
|
contributor-last draft recv-q unreviewed
|
||||
| 8608 | |
fix: reduce happy-eyeballs fallback delay in Cloudflare DNS provider | 7mo | 5wk | 7mo | |
size/L
release-note
needs-rebase
kind/bug
needs-ok-to-test
lifecycle/stale
area/acme
dco-signoff: yes
area/testing
area/acme/dns01
|
contributor-last recv recv-q unreviewed
|
|||
| 9244 | |
[release-1.21] fix(digitalocean): paginate TXT record lookups in findTxtRecord |
| 6wk | 5wk | 5wk | |
size/L
release-note
do-not-merge/hold
kind/bug
area/acme
dco-signoff: yes
area/acme/dns01
|
assigned assignee-updated commented member-last unreviewed
|
||
| 8935 |  |
feat(metrics): instrument Vault issuer Sign() requests | 3mo | 5wk | 3mo | |
release-note
kind/feature
needs-ok-to-test
size/M
area/vault
dco-signoff: yes
area/monitoring
|
recv recv-q similar unreviewed
|
|||
| 8734 |  |
Fix: include annotations derived from ingress in certificate reconciliation loop | 6mo | 5wk | 4mo | |
size/L
do-not-merge/release-note-label-needed
kind/bug
needs-ok-to-test
dco-signoff: yes
|
commented contributor-last recv reviewed-with-comment
|
|||
| 9285 | |
Add design: publish the ACME webhook API as its own Go module | 6wk | 5wk | |
size/L
release-note-none
kind/design
dco-signoff: yes
|
contributor-last recv-q unreviewed
|
||||
| 9283 | |
Add design: disable the ACME HTTP-01 solver and drop its RBAC | 6wk | 6wk | |
size/L
release-note-none
do-not-merge/work-in-progress
kind/design
dco-signoff: yes
|
contributor-last draft recv-q unreviewed
|
||||
| 9284 | |
Add design: reuse Venafi access tokens across reconciles | 6wk | 6wk | |
size/L
release-note-none
do-not-merge/work-in-progress
kind/design
dco-signoff: yes
|
contributor-last draft recv-q unreviewed
|
||||
| 5447 |  |
Allow extra DNS-01 propagation time to be configured |
|
4y | 6wk | 1y |   |
release-note
needs-rebase
size/S
lifecycle/frozen
kind/feature
area/acme
dco-signoff: yes
ok-to-test
area/acme/dns01
|
commented contributor-last recv-q send unreviewed
|
||
| 7236 | |
Route53: Allow STS token to be refreshed by the AWS client if necessary | 2y | 6wk | 2mo | |
release-note
size/XL
needs-rebase
area/api
kind/bug
kind/feature
area/acme
dco-signoff: yes
area/acme/dns01
area/deploy
|
commented contributor-last recv-q reviewed-with-comment
|
|||
| 7382 | |
Implement a single package for controlling cert-manager RNG |
3
|
2y | 6wk | 2y | |
size/L
release-note
needs-rebase
do-not-merge/hold
kind/feature
area/acme
dco-signoff: yes
area/testing
|
commented contributor-last recv-q send unreviewed
|
||
| 7437 |  |
fix: annotate account private key secrets | 2y | 6wk | 2y | |
release-note
needs-rebase
size/S
area/api
kind/feature
area/acme
dco-signoff: yes
ok-to-test
|
commented contributor-last recv recv-q unreviewed
|
|||
| 7449 | |
WIP: reconcile issuers using issuer-lib | 2y | 6wk | 1y | |
release-note-none
needs-rebase
area/api
do-not-merge/work-in-progress
kind/cleanup
size/XXL
area/acme
area/ca
area/vault
dco-signoff: yes
area/testing
area/deploy
|
commented contributor-last recv-q unreviewed
|
|||
| 7614 |  |
Lower the minimum certificate duration from 1 hour to 5 minutes | 2y | 6wk | 2y | |
release-note
needs-rebase
size/S
area/api
kind/feature
dco-signoff: yes
ok-to-test
|
contributor-last recv recv-q unreviewed
|
|||
| 7718 | |
Switch to makefile modules completely (part 1) | 1y | 6wk | 11mo | |
release-note-none
needs-rebase
area/api
kind/cleanup
size/XXL
area/acme
dco-signoff: yes
area/testing
area/deploy
cybr
|
commented contributor-last new-commits recv-q send
|
|||
| 7805 | |
feat: refactor challenge controller to be entirely non blocking | 1y | 6wk | 11mo | |
release-note
needs-rebase
area/api
kind/bug
size/XXL
area/acme
dco-signoff: yes
area/testing
area/acme/dns01
area/acme/http01
area/deploy
cybr
|
commented contributor-last new-commits recv-q send
|
|||
| 7897 | |
wip: add retry mechanism for challenge solver whenever we detect unauthorized error |
|
1y | 6wk | 11mo | |
size/XL
release-note-none
needs-rebase
area/api
do-not-merge/work-in-progress
area/acme
dco-signoff: yes
area/testing
ok-to-test
area/acme/dns01
area/monitoring
area/deploy
needs-kind
|
commented contributor-last recv recv-q reviewed-with-comment
|
||
| 8220 | |
Add predicate filtering to queuing handler |
|
11mo | 6wk | 11mo | |
size/XL
release-note-none
needs-rebase
area/acme
dco-signoff: yes
area/acme/dns01
needs-kind
|
commented contributor-last recv-q send unreviewed
|
||
| 8339 | |
feat(pkcs12): Add flag to specify pkcs12 keystore alias | 10mo | 6wk | 10mo |  |
size/L
release-note
needs-rebase
area/api
kind/design
kind/feature
area/acme
dco-signoff: yes
area/testing
area/acme/dns01
area/acme/http01
area/deploy
|
contributor-last recv recv-q unreviewed
|
|||
| 8379 |  |
acmechallenges: stabilize solver resource names | 9mo | 6wk | 9mo | |
size/XS
release-note
needs-rebase
kind/bug
area/acme
dco-signoff: yes
ok-to-test
|
commented contributor-last recv recv-q unreviewed
|
|||
| 8536 | |
Re-enable the ListenerSet e2e tests | 7mo | 6wk | 7mo | |
release-note-none
needs-rebase
do-not-merge/hold
kind/cleanup
size/XXL
dco-signoff: yes
area/testing
|
commented contributor-last new-commits recv-q send
|
|||
| 8263 |  |
fix: dont copy `kapp.k14s.io` annotations from Ingress to created resources |
|
11mo | 6wk | 10mo | |
size/XS
release-note
needs-rebase
kind/feature
dco-signoff: yes
ok-to-test
|
commented contributor-last recv-q send unreviewed
|
||
| 8823 | |
Add `--metric-static-labels` flag to attach custom labels to certificate Prometheus metrics. | 4mo | 6wk | 4mo | |
size/L
release-note
needs-rebase
area/api
kind/feature
dco-signoff: yes
area/testing
ok-to-test
area/monitoring
|
commented contributor-last recv recv-q reviewed-with-comment
|
|||
| 9049 |  |
Add opt-in Gateway wildcard hostname deduplication | 3mo | 6wk | 3mo |  |
size/L
release-note
needs-rebase
kind/feature
needs-ok-to-test
dco-signoff: yes
|
contributor-last recv recv-q reviewed-with-comment
|
|||
| 8504 | |
WIP: Enable KAL | 8mo | 6wk | |
release-note-none
do-not-merge/work-in-progress
size/M
lifecycle/stale
dco-signoff: yes
needs-kind
|
contributor-last recv-q unreviewed
|
||||
| 9243 | |
Deflake TestDynamicAuthority | 6wk | 6wk | |
release-note-none
size/S
kind/cleanup
dco-signoff: yes
|
contributor-last recv-q unreviewed
|
||||
| 8631 | |
fix(acme): detect server URL path changes for account re-registration | 7mo | 6wk | 7mo | |
size/L
do-not-merge/release-note-label-needed
needs-rebase
area/api
kind/bug
needs-ok-to-test
area/acme
dco-signoff: yes
area/testing
area/deploy
|
contributor-last recv recv-q unreviewed
|
|||
| 8837 |  |
reject negative arcs in ParseObjectIdentifier | 4mo | 7wk | 7wk | |
release-note
kind/bug
needs-ok-to-test
size/M
dco-signoff: yes
|
commented recv reviewed-with-comment
|
|||
| 8844 | |
reject non-context-specific GeneralName class in UnmarshalSANs | 4mo | 7wk | 4mo | |
release-note-none
needs-ok-to-test
size/M
dco-signoff: yes
needs-kind
|
new-commits recv recv-q
|
|||
| 9149 | |
Experiment: property-based tests with hegel-go
|
2mo | 7wk | |
do-not-merge/release-note-label-needed
needs-rebase
do-not-merge/work-in-progress
size/XXL
dco-signoff: yes
needs-kind
|
contributor-last draft recv-q similar unreviewed
|
||||
| 9046 | |
Add workqueue keys to controller logs | 3mo | 7wk | 7wk | |
size/XS
release-note
kind/cleanup
dco-signoff: yes
ok-to-test
|
commented contributor-last recv-q reviewed-with-comment send
|
|||
| 9187 | |
DO NOT MERGE: Test tools-cache verify-at-use (makefile-modules#710) | 1mo | 1mo | 1mo | |
size/L
do-not-merge/release-note-label-needed
needs-rebase
do-not-merge/work-in-progress
do-not-merge/hold
dco-signoff: yes
needs-kind
|
commented contributor-last draft recv-q unreviewed
|
|||
| 8833 | |
make: check the hash at runtime instead of after downloading | 4mo | 1mo | 1mo | |
size/L
do-not-merge/release-note-label-needed
needs-rebase
do-not-merge/work-in-progress
dco-signoff: yes
area/testing
area/monitoring
needs-kind
|
commented draft member-last new-commits send
|
|||
| 8534 | |
feat: add --dns01-timeout flag to make DNS01 provider API timeout configurable | 7mo | 1mo | 1mo | |
release-note
area/api
size/M
area/acme
dco-signoff: yes
ok-to-test
area/acme/dns01
needs-kind
|
commented member-last send unreviewed
|
|||
| 9159 |  |
Honor configured Kubernetes API rate limits | 2mo | 2mo | 2mo | |
size/L
release-note
do-not-merge/hold
kind/bug
needs-ok-to-test
dco-signoff: yes
|
changes-requested contributor-last recv recv-q
|
|||
| 9162 | |
Add design: client-side rate limiting and API Priority and Fairness | 2mo | 2mo | |
size/L
do-not-merge/release-note-label-needed
kind/design
dco-signoff: yes
|
contributor-last recv-q unreviewed
|
||||
| 7886 | |
Improve array field characteristics in API | 1y | 2mo | 8mo | |
size/L
release-note
area/api
do-not-merge/hold
kind/bug
kind/cleanup
lifecycle/stale
dco-signoff: yes
area/deploy
|
commented contributor-last new-commits
|
|||
| 4835 | |
Making sure per fixture only 1 setup is active at the same time |
|
|
4y | 2mo | 2mo |  |
release-note-none
size/S
lifecycle/frozen
kind/bug
dco-signoff: yes
area/testing
|
assigned assignee-updated commented member-last reviewed-with-comment send
|
|
| 9110 | |
Route53: assume the role lazily so the AWS SDK can refresh STS credentials | 2mo | 2mo | 2mo | |
size/L
release-note
kind/bug
area/acme
dco-signoff: yes
area/acme/dns01
|
commented member-last reviewed-with-comment
|
|||
| 8957 | |
Simplify renewal watcher loop in DynamicSource.Start | 3mo | 2mo | 2mo | |
release-note-none
kind/cleanup
size/M
dco-signoff: yes
|
commented member-last send unreviewed
|
|||
| 9104 |  |
fix(pki): reject zoned IPv6 in CSR generation and nil IP in certificate matching | 2mo | 2mo | 2mo | |
size/L
do-not-merge/release-note-label-needed
needs-ok-to-test
dco-signoff: no
needs-kind
|
commented member-last reviewed-with-comment send
|
|||
| 7583 |  |
Support for ACME servers that don't finalize within the ACME client finalizer retry window | 2y | 2mo | 7mo |     |
release-note
kind/bug
needs-ok-to-test
size/M
area/acme
dco-signoff: yes
|
approved commented recv-q send
|
|||
| 8438 | |
POC: single cert-manager binary | 8mo | 2mo | |
release-note-none
do-not-merge/work-in-progress
kind/feature
size/XXL
lifecycle/stale
dco-signoff: no
|
contributor-last draft recv-q unreviewed
|
||||
| 9053 |  |
Add design proposal for DANE/TLSA DNS record management | 2mo | 8d | 2mo |   |
do-not-merge/release-note-label-needed
size/XL
kind/design
needs-ok-to-test
dco-signoff: yes
|
recv recv-q reviewed-with-comment
|
|||
| 8698 |  |
fix(digitalocean): resolve DNS01 zones from managed domains | 6mo | 3mo | 6mo | |
size/L
release-note
needs-rebase
kind/bug
needs-ok-to-test
area/acme
dco-signoff: yes
area/acme/dns01
|
commented contributor-last recv-q send unreviewed
|
|||
| 9045 | |
Fix CertificateRequest approval event reason | 3mo | 3mo | 3mo | |
size/XS
release-note
kind/bug
needs-ok-to-test
dco-signoff: yes
|
contributor-last recv recv-q similar unreviewed
|
|||
| 9030 |  |
feat: validate owner reference | 3mo | 3mo | 3mo | |
size/L
release-note
kind/feature
needs-ok-to-test
dco-signoff: yes
|
contributor-last recv recv-q unreviewed
|
|||
| 8896 | |
Helm toggle features | 4mo | 4mo | 4mo | |
size/L
release-note
kind/feature
needs-ok-to-test
dco-signoff: yes
area/deploy
|
contributor-last recv recv-q unreviewed
|
|||
| 8968 |  |
fix(acmeorders): reschedule Order when concurrent finalize returns 403 with processing ACME order | 3mo | 3mo | 3mo |  |
release-note
kind/bug
needs-ok-to-test
size/M
area/acme
dco-signoff: yes
|
new-commits recv recv-q
|
|||
| 8892 |  |
add renderMode options for prometheus monitors | 4mo | 4mo | 4mo | |
release-note
kind/feature
needs-ok-to-test
size/M
dco-signoff: yes
area/deploy
|
commented recv unreviewed
|
|||
| 8846 |  |
fix(selector/dns): normalize dns name before comparing | 4mo | 4mo | 4mo | |
release-note-none
size/S
kind/bug
needs-ok-to-test
area/acme
dco-signoff: yes
|
contributor-last recv recv-q unreviewed
|
|||
| 8875 |  |
docs: add network policy examples for HTTP01 solver pods | 4mo | 4mo | 4mo | |
release-note
needs-ok-to-test
size/M
dco-signoff: yes
area/deploy
needs-kind
|
collaborator-last commented new-commits send similar
|
|||
| 8838 |  |
Add support for GN and SN in LiteralSubject | 4mo | 4mo | 4mo | |
release-note
size/S
kind/feature
needs-ok-to-test
dco-signoff: yes
|
contributor-last recv recv-q unreviewed
|
|||
| 8485 |  |
Adds Sign API call metric for the Vault issuer. | 8mo | 4mo | 8mo | |
size/L
release-note
needs-rebase
kind/feature
needs-ok-to-test
dco-signoff: yes
area/monitoring
|
contributor-last recv recv-q unreviewed
|
|||
| 8687 |  |
Normalize challenge reason in certmanager_certificate_challenge_status metric |
|
6mo | 5mo | 6mo | |
size/L
release-note-none
needs-ok-to-test
dco-signoff: yes
needs-kind
|
recv recv-q reviewed-with-comment
|
||
| 2290 |  |
docs: add scep-issuer to external issuers list | 4wk | 14d | 4wk | |
size/XS
dco-signoff: yes
|
recv recv-q similar unreviewed
|
|||
| 2284 |  |
docs: fix 'an the Certificate' typo in rotationPolicy note | 4wk | 3wk | 4wk | |
size/XS
dco-signoff: yes
|
recv recv-q unreviewed
|
|||
| 2277 |  |
chore(deps): update mcr.microsoft.com/devcontainers/javascript-node docker tag to v26 | 5wk | 3wk | 5wk | |
size/XS
dco-signoff: yes
ok-to-test
dependencies
|
recv recv-q unreviewed
|
|||
| 2289 |  |
docs: catalog cert-manager Prometheus metrics | 4wk | 4wk | 4wk | |
dco-signoff: yes
size/S
|
recv recv-q unreviewed
|
|||
| 2280 | |
Install cmrel from master and drop the checkout requirement | 5wk | 5wk | |
dco-signoff: yes
do-not-merge/hold
do-not-merge/work-in-progress
size/S
|
draft recv-q unreviewed
|
||||
| 2279 | |
Add a release step to tell contributors their change is available | 5wk | 5wk | |
dco-signoff: yes
do-not-merge/hold
do-not-merge/work-in-progress
size/S
|
draft recv-q unreviewed
|
||||
| 2239 |  |
Add cmp-issuer to external issuers list | 7wk | 6wk | 7wk | |
size/XS
dco-signoff: yes
|
recv recv-q similar unreviewed
|
|||
| 2256 | |
docs: correct the Gateway API version requirement | 6wk | 6wk | 6wk | |
dco-signoff: yes
size/M
|
recv recv-q unreviewed
|
|||
| 2212 |  |
docs: explain installing cert-manager into a different namespace | 2mo | 2mo | 2mo | |
dco-signoff: yes
size/S
|
recv recv-q similar unreviewed
|
|||
| 2211 | |
docs: clarify the webhook --enable-client-verification flag description | 2mo | 2mo | 2mo | |
size/XS
dco-signoff: yes
|
recv recv-q unreviewed
|
|||
| 1785 | |
Add release-notes generator script and Makefile target | 1y | 5wk | 5wk | |
dco-signoff: yes
size/XXL
needs-rebase
|
commented member-last new-commits send
|
|||
| 2128 | |
Add troubleshooting guide for certificate re-issuance loops | 4mo | 3mo | 4mo | |
dco-signoff: yes
size/L
needs-rebase
|
commented contributor-last new-commits recv-q
|
|||
| 2260 | |
Add an availability and denial of service section to the threat model | 6wk | 6wk | |
dco-signoff: yes
size/M
|
recv-q unreviewed
|
||||
| 2188 | |
docs: rename tutorial 'Securing NGINX-ingress' to 'Securing ingress-nginx' | 3mo | 3mo | 3mo | |
size/XS
dco-signoff: yes
|
recv recv-q unreviewed
|
|||
| 2166 | |
netlify: document deploy-preview security for forked pull requests | 4mo | 4mo | 4mo | |
dco-signoff: yes
size/S
|
commented member-last reviewed-with-comment
|
|||
| 2160 | |
docs: document the cert-manager.io/secret-template ingress annotation | 4mo | 4mo | 4mo | |
size/XS
dco-signoff: yes
|
recv recv-q unreviewed
|
|||
| 2092 |  |
docs: add infomaniak third party provider | 5mo | 4mo | 5mo | |
size/XS
dco-signoff: yes
|
recv recv-q reviewed-with-comment
|
|||
| 2159 | |
docs: use stringData in the DigitalOcean DNS01 Secret example | 4mo | 4mo | 4mo | |
dco-signoff: yes
size/S
|
recv recv-q unreviewed
|
|||
| 1909 |  |
docs: add ACK RRSA supported AliDNS webhook | 9mo | 4mo | 4mo | |
size/XS
dco-signoff: yes
|
changes-requested commented contributor-last recv-q send
|
|||
| 2023 |  |
Adds troubleshooting guide for host missmatch error | 6mo | 4mo | 6mo | |
size/XS
dco-signoff: yes
|
changes-requested contributor-last recv recv-q
|
|||
| 2151 | |
docs: add NetworkPolicy examples for HTTP01 challenges to best-practice page | 4mo | 4mo | 4mo | |
dco-signoff: yes
size/M
|
changes-requested commented member-last send similar
|
|||
| 1202 |  |
Add section about client cert authentication for vault | 3y | 5mo | 3y | |
dco-signoff: yes
do-not-merge/work-in-progress
size/M
|
commented contributor-last draft new-commits send
|
|||
| 1607 |  |
Document Log Level settings. Document DNS01 delegation using multiple providers. | 2y | 7mo | 2y | |
dco-signoff: yes
needs-rebase
size/M
|
contributor-last recv recv-q unreviewed
|
|||
| 1213 | |
Draft of tutorial for Google's Public CA | 3y | 7mo | 3y | |
dco-signoff: yes
size/L
needs-rebase
ok-to-test
|
commented contributor-last reviewed-with-comment send
|
|||
| 1787 |  |
Update Slack links to include both invite and direct channel URLs | 1y | 7mo | 1y | |
size/XS
dco-signoff: yes
cybr
|
changes-requested commented member-last send
|
|||
| 859 | |
Move the meetings and slack information to a separate page |
|
4y | 7mo | 4y | |
approved
dco-signoff: yes
needs-rebase
size/M
|
changes-requested commented member-last send
|
||
| 1724 |  |
DRAFT: feat(tutorials): Add Gateway API |
|
1y | 7mo | 8mo | |
dco-signoff: yes
size/L
do-not-merge/work-in-progress
|
commented draft recv unreviewed
|
||
| 1672 | |
WIP: docs: Add an wrap-up announcement page |
|
2y | 7mo | 2y | |
dco-signoff: yes
do-not-merge/work-in-progress
size/M
|
commented draft member-last new-commits send
|
||
| 1640 |  |
Update issuer.md | 2y | 7mo | 1y | |
size/XS
dco-signoff: yes
|
commented member-last reviewed-with-comment send
|
|||
| 1602 |  |
acme troubleshooting: how to fix errored challenges | 2y | 7mo | 2y | |
size/XS
dco-signoff: yes
|
contributor-last recv recv-q reviewed-with-comment
|
|||
| 1611 |  |
Update webhook troubleshooting documentation to including necessary curl command. | 2y | 7mo | 2y | |
dco-signoff: yes
size/S
|
changes-requested contributor-last recv recv-q
|
|||
| 1569 | |
wip: update cert-manager logo svg | 2y | 7mo | 2y | |
dco-signoff: yes
size/L
do-not-merge/work-in-progress
|
commented member-last send unreviewed
|
|||
| 1587 |  |
Custom Certificate Support for cert-manager Webhook Endpoint | 2y | 7mo | 2y | |
dco-signoff: yes
size/S
|
recv recv-q unreviewed
|
|||
| 1447 | |
Explain how to install cert-manager using ArgoCD |
3
|
2y | 7mo | 2y |   |
dco-signoff: yes
size/L
|
commented contributor-last recv-q reviewed-with-comment send similar
|
||
| 1450 |  |
Docker testing and validation | 2y | 7mo | 2y | |
dco-signoff: yes
needs-rebase
size/M
|
contributor-last new-commits recv recv-q
|
|||
| 1419 |  |
fix: TLSConfig secretName description | 2y | 7mo | 2y | |
dco-signoff: yes
needs-rebase
size/S
|
changes-requested commented contributor-last recv-q send
|
|||
| 1364 | |
WIP: Patch release checklist | 2y | 7mo | |
dco-signoff: yes
needs-rebase
do-not-merge/work-in-progress
size/M
|
contributor-last recv-q unreviewed
|
||||
| 1075 | |
Move Issuer / ClusterIssuer and Certificate resource content to a sub-folder of configuration/ | 4y | 7mo | 2y |  |
approved
dco-signoff: yes
size/L
needs-rebase
|
changes-requested commented member-last send
|
|||
| 948 |  |
add note to ingress class definition |
| 4y | 7mo | 3y | |
dco-signoff: no
size/XS
needs-rebase
needs-ok-to-test
|
assigned commented contributor-last send unreviewed
|
||
| 790 |  |
Update route53.md | 4y | 7mo | 3y | |
dco-signoff: no
size/XS
needs-rebase
needs-ok-to-test
|
changes-requested commented member-last send
|
|||
| 528 |  |
Update "Setting Nameservers for DNS01 Self Check" example | 5y | 4y | 5y |
size/XS
dco-signoff: yes
needs-rebase
needs-ok-to-test
|
contributor-last recv unreviewed
|
||||
| 377 | |
Publish the Helm chart to the OCI registry from the publish pipeline | 5wk | 3wk | |
dco-signoff: yes
size/XXL
needs-rebase
do-not-merge/work-in-progress
|
contributor-last draft recv-q unreviewed
|
||||
| 373 | |
Mint GitHub tokens for publish through octo-sts instead of a stored PAT | 5wk | 5wk | |
dco-signoff: yes
size/L
needs-rebase
do-not-merge/work-in-progress
|
contributor-last draft recv-q unreviewed
|
||||
| 290 | |
Add OCI signing as part of existing publish pipeline | 6mo | 5wk | 5wk | |
dco-signoff: yes
size/XXL
needs-rebase
|
commented member-last new-commits send
|
|||
| 376 | |
Embed cloudbuild.yaml in cmrel so releases need no checkout | 5wk | 5wk | |
dco-signoff: yes
size/L
|
contributor-last recv-q unreviewed
|
||||
| 329 | |
Add script to ping PR authors and issue reporters after a release | 3mo | 5wk | |
dco-signoff: yes
size/L
|
contributor-last recv-q unreviewed
|
||||
| 43 | |
No more requirement "be in the release folder" to run cmrel, remove the flag --cloudbuild | 5y | 5y |
dco-signoff: yes
approved
size/M
needs-rebase
|
contributor-last unreviewed
|
|||||
| 36 | |
Add the "cmrel update-release-branch" command | 5y | 5y | 5y | |
dco-signoff: yes
approved
size/M
needs-rebase
do-not-merge/work-in-progress
|
commented contributor-last draft unreviewed
|
|||
| 728 |  |
Deprioritize resync operations | 8mo | 6wk | 7mo |  |
dco-signoff: yes
size/S
ok-to-test
needs-rebase
|
commented contributor-last recv recv-q reviewed-with-comment
|
|||
| 885 | |
Adopt shared security-scan workflow and document pre/post-release checks | 2mo | 6wk | 2mo | |
dco-signoff: yes
size/L
do-not-merge/hold
needs-rebase
|
commented contributor-last recv-q unreviewed
|
|||
| 891 | |
Trial: property-based tests with hegel-go
|
2mo | 7wk | |
dco-signoff: yes
size/XL
do-not-merge/work-in-progress
needs-rebase
|
contributor-last draft recv-q similar unreviewed
|
||||
| 896 | |
DO NOT MERGE: Test tools-cache verify-at-use (makefile-modules#710) | 1mo | 1mo | 1mo | |
dco-signoff: yes
size/L
do-not-merge/hold
do-not-merge/work-in-progress
needs-rebase
|
commented contributor-last draft recv-q unreviewed
|
|||
| 768 |  |
Add unit tests for pkg/tls Provider | 6mo | 1mo | 6mo | |
dco-signoff: yes
size/L
needs-ok-to-test
needs-rebase
|
contributor-last recv recv-q unreviewed
|
|||
| 890 | |
Expand RELEASE.md with the full v0.17.0 release process | 2mo | 2mo | |
dco-signoff: yes
size/L
|
contributor-last recv-q unreviewed
|
||||
| 860 | |
feat(chart): expose automountServiceAccountToken in the istio-csr chart | 3mo | 3mo | 3mo | |
dco-signoff: yes
size/S
needs-ok-to-test
|
contributor-last recv recv-q similar unreviewed
|
|||
| 852 | |
Replace Istio log package with structured logr in auth.go | 3mo | 3mo | 3mo | |
dco-signoff: yes
size/XS
needs-ok-to-test
|
contributor-last recv recv-q unreviewed
|
|||
| 903 |  |
fix(istiodcert): name the DNS name that failed validation | 7wk | 7wk | 7wk | |
dco-signoff: yes
size/L
needs-ok-to-test
|
contributor-last recv recv-q unreviewed
|
|||
| 1037 |  |
fix: merge commonLabels as a map to avoid duplicate label keys | 3wk | 16d | 16d | |
dco-signoff: yes
size/L
ok-to-test
|
commented member-last send unreviewed
|
|||
| 989 | |
Trial hegel-go property-based tests | 2mo | 7wk | |
dco-signoff: yes
do-not-merge/work-in-progress
needs-rebase
size/XXL
|
contributor-last draft recv-q similar unreviewed
|
||||
| 937 | |
Document additional pre- and post-release checks in RELEASE.md | 4mo | 2mo | 4mo | |
dco-signoff: yes
size/L
|
commented member-last new-commits send
|
|||
| 868 |  |
feat(annotations): Add annotation-based policy enforcement | 6mo | 3mo | 6mo | |
dco-signoff: yes
size/L
needs-rebase
|
contributor-last recv recv-q reviewed-with-comment
|
|||
| 976 | |
feat: add startupapicheck Job to verify webhook readiness | 2mo | 5wk | 2mo | |
dco-signoff: yes
needs-ok-to-test
size/XL
|
recv recv-q similar unreviewed
|
|||
| 628 | |
Grant cert-manager RBAC to use all policies by default | 1y | 11mo | 11mo | |
dco-signoff: yes
size/M
|
commented contributor-last recv-q send unreviewed
|
|||
| 958 |  |
feat: add startupapicheck job to ensure webhook readiness on install | 5mo | 10d | 5mo |  |
dco-signoff: yes
needs-ok-to-test
size/XL
|
recv recv-q similar unreviewed
|
|||
| 918 | |
add bundle metrics |
2
|
6mo | 6wk | 5mo | |
dco-signoff: yes
size/XL
ok-to-test
needs-rebase
|
commented contributor-last new-commits recv recv-q
|
||
| 900 |  |
chart: add startupapicheck to ensure trust-manager is ready after install | 7mo | 7wk | 7mo | |
dco-signoff: yes
needs-ok-to-test
size/XL
needs-rebase
|
contributor-last recv recv-q unreviewed
|
|||
| 702 | |
User-facing migration to ClusterBundle |
|
1y | 1mo | 2mo |  |
dco-signoff: yes
approved
lgtm
do-not-merge/hold
size/XXL
|
approved commented contributor-last recv-q
|
||
| 1064 | |
Trial hegel-go property-based tests | 2mo | 2mo | |
dco-signoff: yes
do-not-merge/work-in-progress
needs-rebase
size/XXL
|
contributor-last draft recv-q similar unreviewed
|
||||
| 395 | |
WIP: feat: inject bundle data into configmap | 2y | 2mo | 8mo | |
dco-signoff: yes
size/L
do-not-merge/work-in-progress
lifecycle/stale
|
commented contributor-last unreviewed
|
|||
| 948 | |
release: publish trust-manager.crds.yaml as a GitHub Release artifact | 5mo | 4mo | 5mo | |
dco-signoff: yes
size/M
needs-ok-to-test
needs-rebase
|
commented contributor-last recv-q send unreviewed
|
|||
| 508 | |
Fix certificaterequest denial status | 7wk | 7wk | 7wk | |
kind/bug
dco-signoff: yes
size/M
needs-ok-to-test
|
contributor-last recv recv-q similar unreviewed
|
|||
| 188 | |
Remove SetCertificateRequestConditionError |
3
|
2y | 7mo | 7mo | |
dco-signoff: yes
size/XXL
|
commented member-last new-commits
|
||
| 497 | |
Property-based-testing trial with hegel-go
|
2mo | 7wk | |
dco-signoff: yes
size/XXL
needs-rebase
do-not-merge/work-in-progress
|
contributor-last draft recv-q similar unreviewed
|
||||
| 324 | |
[VC-35742] Handle canceled context to prevent extra retries | 1y | 1y | 1y | |
dco-signoff: yes
size/S
do-not-merge/work-in-progress
needs-ok-to-test
|
commented draft member-last send unreviewed
|
|||
| 186 | |
Remove GetIssuerTypeIdentifier from Issuer API | 2y | 1y |  |
dco-signoff: yes
needs-rebase
size/L
|
contributor-last recv-q unreviewed
|
||||
| 24 | |
Add conformance tests |
| 3y | 3y | 3y | |
dco-signoff: yes
size/XXL
approved
needs-rebase
|
assigned commented contributor-last reviewed-with-comment
|
||
| 716 | |
[demo] oci-security-scan: trivy image scanning via makefile-modules | 2mo | 2mo | 2mo | |
dco-signoff: yes
size/L
do-not-merge/work-in-progress
needs-rebase
|
commented contributor-last draft recv-q unreviewed
|
|||
| 746 | |
Parse comma separated volume attributes as CSV | 6wk | 5wk | 5wk | |
dco-signoff: yes
size/L
needs-ok-to-test
|
commented member-last reviewed-with-comment send
|
|||
| 672 | |
feat(chart): make pod and sidecar securityContext configurable | 4mo | 4mo | 4mo | |
dco-signoff: yes
size/L
needs-ok-to-test
|
commented recv unreviewed
|
|||
| 700 | |
feat(chart): expose automountServiceAccountToken in the csi-driver chart | 3mo | 3mo | 3mo | |
dco-signoff: yes
size/S
needs-ok-to-test
|
contributor-last recv recv-q similar unreviewed
|
|||
| 650 |  |
NodePublishSecretRef | 5mo | 5mo | 5mo | |
size/L
dco-signoff: no
needs-rebase
needs-ok-to-test
|
contributor-last recv recv-q unreviewed
|
|||
| 642 |  |
fix: allow disabling PKCS12 without password | 5mo | 5mo | 5mo | |
dco-signoff: yes
size/M
ok-to-test
|
commented member-last reviewed-with-comment send
|
|||
| 502 | |
Enable csi-lib metrics | 11mo | 7mo | 7mo | |
dco-signoff: yes
size/S
needs-rebase
ok-to-test
|
commented member-last reviewed-with-comment send
|
|||
| 251 | |
PoC: Generate SPIFFE identities in csi-driver | 2y | 2y | 2y | |
dco-signoff: yes
size/S
do-not-merge/work-in-progress
needs-rebase
|
commented contributor-last draft recv-q unreviewed
|
|||
| 129 |  |
Add attribute support for certificate subject |
|
3y | 2y | 3y | |
dco-signoff: yes
size/L
needs-rebase
ok-to-test
|
commented contributor-last reviewed-with-comment send
|
||
| 135 |  |
Added options to all containers | 3y | 2y | 3y | |
dco-signoff: yes
size/L
needs-rebase
ok-to-test
|
commented contributor-last send unreviewed
|
|||
| 594 | |
fix(driver): return an error instead of panicking on a non-PEM issued chain | 7wk | 5wk | 7wk | |
dco-signoff: yes
size/L
needs-ok-to-test
|
contributor-last recv recv-q reviewed-with-comment similar
|
|||
| 586 | |
Trial hegel-go property-based tests on the SPIFFE approver and driver
|
2mo | 2mo | |
dco-signoff: yes
size/XL
do-not-merge/work-in-progress
needs-rebase
|
contributor-last draft recv-q similar unreviewed
|
||||
| 577 | |
[DO NOT MERGE] Demo: oci-security-scan for multi-image repos | 2mo | 2mo | 2mo | |
dco-signoff: yes
size/L
do-not-merge/work-in-progress
needs-rebase
|
commented draft member-last unreviewed
|
|||
| 564 | |
feat(chart): expose automountServiceAccountToken in the csi-driver-spiffe chart | 3mo | 3mo | 3mo | |
dco-signoff: yes
size/S
needs-ok-to-test
|
contributor-last recv recv-q similar unreviewed
|
|||
| 107 | |
Remove csi-driver-spiffe approver | 2y | 2y |
size/XXL
dco-signoff: no
do-not-merge/work-in-progress
needs-rebase
|
contributor-last draft unreviewed
|
|||||
| 538 | |
feat(chart): make pod and sidecar securityContext configurable | 4mo | 4mo | 4mo | |
dco-signoff: yes
size/L
ok-to-test
|
commented new-commits recv
|
|||
| 148 |  |
limit-namespaces for namespace-scope deployments |
|
2y | 6mo | 2y |  |
dco-signoff: no
size/S
needs-ok-to-test
|
contributor-last recv recv-q unreviewed
|
||
| 303 |  |
feat: add support for setting private key encoding | 10mo | 9mo | 10mo | |
dco-signoff: yes
size/L
needs-ok-to-test
|
recv recv-q reviewed-with-comment
|
|||
| 117 |  |
fill spec.tls.caCertificate in route with intermediate ca certificate… |
|
2y | 2y | 2y |   |
dco-signoff: yes
size/M
needs-rebase
ok-to-test
|
commented contributor-last new-commits recv-q send
|
||
| 279 | |
Trial: hegel-go property-based tests | 2mo | 7wk | |
dco-signoff: yes
size/XL
do-not-merge/work-in-progress
needs-rebase
|
contributor-last draft recv-q similar unreviewed
|
||||
| 288 | |
fix(manager): return an error instead of panicking on a non-PEM issued chain | 7wk | 5wk | 5wk | |
dco-signoff: yes
size/S
needs-ok-to-test
|
commented member-last reviewed-with-comment send similar
|
|||
| 223 | |
NodePublishSecretRef | 5mo | 5mo | 5mo | |
dco-signoff: no
size/L
needs-ok-to-test
|
contributor-last recv recv-q unreviewed
|
|||
| 211 |  |
Fix: concurrent NodePublishVolume calls could mount volume without certificates | 5mo | 5mo | 5mo | |
dco-signoff: yes
size/L
needs-ok-to-test
|
contributor-last recv recv-q unreviewed
|
|||
| 71 | |
Refactor filesystem.go and adapt tests to use a real file system | 2y | 1y | 1y | |
dco-signoff: yes
size/L
|
commented member-last reviewed-with-comment
|
|||
| 88 | |
chore(deps): update terraform google to v7.46.1 | 4mo | 5wk | 4mo | |
dco-signoff: yes
size/L
dependencies
ok-to-test
|
contributor-last recv recv-q similar unreviewed
|
|||
| 91 | |
Add a release-stager service account for the nightly release-stage ProwJob | 4wk | 4wk | |
do-not-merge/work-in-progress
dco-signoff: yes
size/M
|
contributor-last draft recv-q unreviewed
|
||||
| 1238 | |
Add presubmit job for community Prow Peribolos dry-run | 2wk | 2wk | |
dco-signoff: yes
size/S
|
contributor-last recv-q unreviewed
|
||||
| 1160 | |
config: exempt Copilot-authored PRs from DCO requirement in Tide | 7mo | 6mo | 6mo | |
dco-signoff: no
size/S
do-not-merge/work-in-progress
needs-ok-to-test
|
commented draft member-last send unreviewed
|
|||
| 688 | |
oci-build: add oci-security-scan target and scheduled workflow | 2mo | 7d | 4wk | |
dco-signoff: yes
size/L
|
commented member-last reviewed-with-comment
|
|||
| 492 | |
chore(deps): update module github.com/sigstore/cosign/v2 to v3 |
|
10mo | 4wk | 5wk | |
dco-signoff: yes
size/S
do-not-merge/hold
dependencies
ok-to-test
|
commented reviewed-with-comment send
|
||
| 723 | |
feat: add make target to upload SBOMs to GitHub releases | 6wk | 5wk | 6wk | |
dco-signoff: yes
size/S
|
recv recv-q reviewed-with-comment
|
|||
| 710 | |
Verify the tool cache against reviewed hashes at link time | 1mo | 6wk | 7wk | |
dco-signoff: yes
size/L
needs-rebase
|
commented contributor-last new-commits recv-q
|
|||
| 653 | |
Remove unused olm-bundle module | 3mo | 6wk | 3mo | |
dco-signoff: yes
needs-rebase
size/XL
|
commented contributor-last recv-q reviewed-with-comment
|
|||
| 651 | |
Add OSSF Scorecard workflow to gh-workflows module | 3mo | 2mo | 2mo | |
dco-signoff: yes
size/L
|
commented member-last reviewed-with-comment send
|
|||
| 655 | |
Fix 'make verify' command | 3mo | 3mo | 3mo | |
dco-signoff: yes
size/XS
|
commented member-last reviewed-with-comment
|
|||
| 549 | |
WIP: Split (helm) generate-crds target | 8mo | 3mo | 8mo | |
dco-signoff: yes
size/M
do-not-merge/work-in-progress
|
commented draft member-last reviewed-with-comment
|
|||
| 293 | |
Add Helm chart image baking | 1y | 1y | |
dco-signoff: yes
size/S
needs-rebase
|
contributor-last recv-q similar unreviewed
|
||||
| 55 | |
feat: add test module | 2y | 2y | 2y | |
dco-signoff: yes
size/M
|
commented contributor-last recv reviewed-with-comment
|
|||
| 346 | |
Nest commented-out properties at the end of the file under their parent | 5wk | 5wk | |
dco-signoff: yes
size/M
|
contributor-last recv-q reviewed-with-comment
|
||||
| 344 | |
Add help descriptions to the root, schema and lint commands | 5wk | 5wk | |
dco-signoff: yes
size/S
|
contributor-last recv-q reviewed-with-comment
|
||||
| 345 | |
Keep "WARNING:" labels on their own line and join lines that open with a bracket | 5wk | 5wk | |
dco-signoff: yes
size/M
|
contributor-last recv-q reviewed-with-comment
|
||||
| 343 | |
Honour +docs:section tags regardless of surrounding blank lines | 5wk | 5wk | |
dco-signoff: yes
size/M
|
contributor-last recv-q reviewed-with-comment
|
||||
| 312 | |
Add YAML merge key (<<) support to the values walk | 2mo | 2mo | 2mo | |
dco-signoff: yes
size/L
approved
do-not-merge/hold
|
commented member-last reviewed-with-comment send
|
|||
| 104 | |
Add Chart image baking | 1y | 1y | 1y | |
dco-signoff: yes
size/L
needs-rebase
|
commented member-last reviewed-with-comment send similar
|
|||
| 74 | |
WIP: Add initial Prow Peribolos GH org configuration | 2wk | 2wk | |
do-not-merge/work-in-progress
size/L
dco-signoff: yes
|
contributor-last draft recv-q unreviewed
|
||||
| 69 | |
Add auditing tool for confirming who has access to the cert-manager org | 7mo | 7mo | |
dco-signoff: yes
size/XL
|
contributor-last recv-q unreviewed
|
||||
| 11 | |
Governance: folks meaningfully contributing to the biweekly can become GitHub Members | 3y | 11mo | |
do-not-merge/work-in-progress
dco-signoff: yes
size/S
|
draft reviewed-with-comment
|
||||
| 64 |  |
Add imagePullSecrets to template | 2y | 2mo | 2y | |
size/XS
dco-signoff: yes
needs-ok-to-test
|
contributor-last new-commits recv recv-q
|
|||
| 1 | |
Manage the cert-manager GitHub organisation from this repo | 2y | 2y | 2y | |
dco-signoff: yes
size/XXL
|
commented member-last unreviewed
|
|||
| 8 |  |
Optionally output a unified diff |
|
10mo | 5mo | 8mo | |
dco-signoff: yes
needs-rebase
size/XL
needs-ok-to-test
|
commented contributor-last recv recv-q unreviewed
|
||
| 13 | |
Various QA fixes | 8mo | 8mo | 8mo | |
dco-signoff: yes
size/L
needs-ok-to-test
|
commented new-commits recv
|
|||
| 4 | |
Add support for custom license templates | 3y | 1y | |
dco-signoff: yes
size/S
|
contributor-last recv-q unreviewed
|
||||
| 553 | |
feat(chart): expose automountServiceAccountToken in the google-cas-issuer chart | 3mo | 12d | 12d | |
size/S
needs-rebase
dco-signoff: yes
|
commented member-last reviewed-with-comment send similar
|
|||
| 143 |  |
feat: allow creating or reusing an existing sa | 2y | 5mo | 2y | |
needs-rebase
ok-to-test
|
contributor-last recv recv-q unreviewed
|
|||
| 159 |  |
Split certificate chain | 2y | 6mo | 2y | |
needs-rebase
|
commented contributor-last recv-q reviewed-with-comment send
|
|||
| 141 |  |
re-adding required clusterrole permission | 2y | 2y | 2y | |
size/XS
|
recv unreviewed
|
|||
| 16 previously listed items omitted: #8367 #9171 #9306 #9322 #9302 #9254 #8262 #9305 #8529 #8187 #9245 #9241 #7689 #2257 #746 #625 | |||||||||||
