Certificates

📋 Recommended Actions ⚠️ Action Required Immediate patching required to address critical security updates and enhance Istiod stability. 📝 Summary Istio 1.30.7 delivers essential security enhancements and crucial bug fixes for improved reliability. A critical update addresses the emSign ECC Root CA - G3 distrust by refreshing distroless base images, bolstering the trust chain for Istio components. This release also resolves a significant Istiod startup issue where expired self-signed CA certificates now automatically renew, preventing service interruptions after prolonged scale-to-zero periods. For authorization, :method header matching in policies is now case-insensitive, aligning with expected behavior. Ambient mesh users can opt-in to a new feature (PILOT_NODE_UNTAINT_CHECK_ZTUNNEL=true) that ensures ztunnel readiness before scheduling pods to untainted nodes, preventing workloads from landing on unready proxies. Furthermore, istioctl bug-report --duration now filters logs correctly, even without an --end-time specified, streamlining diagnostics. Multiple dependency updates round out this release, reinforcing the mesh’s security posture and overall operational stability. Upgrade promptly to benefit from these vital improvements. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action is required. However, reviewing these updates is recommended to benefit from improved stability, enhanced security, and to better support your users by understanding the strengthened supply chain integrity. 📝 Summary cert-manager v1.20.4 delivers crucial updates focused on strengthening security, improving controller stability, and hardening the release process. This patch release includes a critical fix for the certificate shim, preventing unintended mutation of cached Kubernetes objects—a vital step for controller reliability. You’ll also find a suite of dependency upgrades addressing various underlying security advisories, fortifying cert-manager’s overall supply chain posture. Significant enhancements to the release pipeline now incorporate Cosign signing for metadata, boosting integrity and trust. Furthermore, e2e tests are now more robust with retry mechanisms for Kyverno policy application and dynamic resolution of initial upgrade versions, ensuring a smoother development experience. Review these changes to leverage a more secure and stable cert-manager environment. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action required. This release primarily provides stability and quality-of-life improvements. Review the updates to leverage enhanced certificate handling and improve your troubleshooting experience. 📝 Summary cert-manager(v1.18.3) boosts reliability and user experience. It now supports significantly larger certificates and chains, crucial for complex deployments with many SANs. A critical fix prevents unnecessary certificate re-issuance stemming from IssuerRef defaulting. Plus, clearer error messages for malformed PEM data greatly simplify troubleshooting. Upgrade for a more stable and robust certificate management experience. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade recommended to ensure certificate name constraints are correctly applied, enhancing the security and validity of issued certificates. cert-manager v1.17.4 is a targeted patch release addressing a critical bug in how URI name constraints are applied during certificate signing request (CSR) generation. Previously, Permitted.URIDomains were incorrectly treated as excluded, potentially leading to misconfigurations in certificate issuance policies. This fix ensures that your defined URI name constraints are honored as intended, bolstering the integrity and security of your issued certificates. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address several security vulnerabilities in core dependencies and ensure the continued stability of your cert-manager deployments. This cert-manager v1.17.2 release delivers vital security updates by patching multiple Go dependencies that address various CVEs. Beyond these critical fixes, we’ve also refreshed our Go toolchain and base images, ensuring a more robust and secure foundation for your certificate management needs. ...