Skip to content

ejbca-cert-manager-issuer 2.2.0 - CA ConfigMap Bundle + End Date Usage#130

Merged
indrora merged 36 commits intorelease-2.2from
feat/AB#77467/ca-bundle-configmap
Apr 1, 2026
Merged

ejbca-cert-manager-issuer 2.2.0 - CA ConfigMap Bundle + End Date Usage#130
indrora merged 36 commits intorelease-2.2from
feat/AB#77467/ca-bundle-configmap

Conversation

@irby
Copy link
Copy Markdown
Contributor

@irby irby commented Mar 25, 2026 •
edited
Loading

v2.2.0

Features:

  • Add support to specify a ConfigMap for CA trust bundles in Issuer / ClusterIssuer resources via the caBundleConfigMapName specification.
  • Add support for specifying a key on a Secret / ConfigMap resource for the CA trust bundle via the caBundleKey specification on an Issuer / ClusterIssuer resource.
  • On EJBCA 9.3.3 and above, if the certificate profile has "Allow Validity Override" enabled, the certificate's "Not After" will be set according to the duration property of the Certificate resource, otherwise it will be set according to the default validity configured in EJBCA for the relevant CA.

Chores:

  • Update README links with updated EJBCA links
  • Update dependencies

spbsoluble and others added 30 commits September 25, 2025 10:08
@spbsoluble
Merge pull request #102 from Keyfactor/release-2.1
95cc375 
Merge 2.1.1 to main
@spbsoluble
Merge pull request #104 from Keyfactor/release-2.1
66479df 
Merge 2.1.2 to main
@HoogWater
cabundle configmap option impelmented, and update to go 1.25
cc1b823
@HoogWater
Update the docs to reflect configmap option
8fb5583
@HoogWater
Update README to include configmap option
d6241a8
@HoogWater
cabundle configmap option impelmented, and update to go 1.25
3260740
@HoogWater
Update the docs to reflect configmap option
1e38f36
@HoogWater
Update README to include configmap option
fde4819
@HoogWater
Merge branch 'cabundle_in_configmap' of https://github.com/HoogWater/…
12f17a2 
…ejbca-cert-manager-issuer into cabundle_in_configmap
@HoogWater
fix duplicate go line in go.mod
ae56ab8
@JohnAuth
feat: pass spec.duration to EJBCA as end_time (fixes #128)
4d1a907
@irby
chore: update e2e test documentation, support dynamic variable resolu…
7e5cd20 
…tion

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
Merge pull request #129 from John-D-B/feat/issue-128-duration-passthr…
9bf964a 
…ough

feat: pass spec.duration to EJBCA as end_time (fixes #128)
@irby
chore(test): add unit test for end_time logic
a63f7f8 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@dependabot @irby
chore(deps): bump k8s.io/apimachinery from 0.34.1 to 0.35.1
ab3272a 
Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.34.1 to 0.35.1.
- [Commits](kubernetes/apimachinery@v0.34.1...v0.35.1)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@irby
chore: bump Docker golang version to 1.25
7890b76 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@dependabot @irby
chore(deps): bump github.com/onsi/gomega from 1.36.1 to 1.39.1
ce7b3aa 
Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.36.1 to 1.39.1.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.36.1...v1.39.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @irby
chore(deps): bump k8s.io/api from 0.34.1 to 0.35.1
649712c 
Bumps [k8s.io/api](https://github.com/kubernetes/api) from 0.34.1 to 0.35.1.
- [Commits](kubernetes/api@v0.34.1...v0.35.1)

---
updated-dependencies:
- dependency-name: k8s.io/api
  dependency-version: 0.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@irby
chore: address linting issues
f864757 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
fix: use v7 go-lint-action
3872a57 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
Merge remote-tracking branch 'hoogwater/cabundle_in_configmap' into f…
d4301ef 
…eat/AB#77467/ca-bundle-configmap
@irby
chore: fix lint issue
89fd252 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
chore: address PR comments
c2c9ed0 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
chore: fix lint issues. Update Makefile commands
256802b 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
chore: check for CRD drift
0e0caef 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
feat: add caBundleKey to issuer specification
1a0ff85 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
chore: break the ca bundle and auth options retrieval into testable m…
548959f 
…ethods

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
feat: add logic to fetch caConfig from specified key
2f9098c 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
chore: update overview.md with updated links and information about ne…
d5dc9ee 
…w changes

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
fix: update CONTROLLER_TOOLS_VERSION
4caf78f 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby irby changed the title Feat/ab#77467/ca bundle configmap ejbca-cert-manager-issuer 2.2.0 - CA ConfigMap Bundle + End Date Usage Mar 25, 2026
@HoogWater
Copy link
Copy Markdown
Contributor

HoogWater commented Mar 26, 2026

The certificaterequest_controller is incomplete when using the ConfigMap option for the CA Bundle.
the check now implemented in the fetchCACertBytes function in issuer_controller now caters for both secret and configmap. but this function is not used in the certificaterequest_controller so if only a configmap is configured in the issuer and a certificate is created(which results in the certificaterequest) the controller just skips the ca bundle check all together as there is not secret mentioned in the issuer.

the fetchCACertBytes function should also be implemented in the certificaterequest_controller
currently the issuer creation works, but the certificaterequests end up with failed to authorize tls errors.

@irby
Copy link
Copy Markdown
Contributor Author

irby commented Mar 26, 2026

Hey @HoogWater thanks for catching that. I'll do a review of this tomorrow and see if I can reproduce your findings and write up a solution for it!

@irby
Copy link
Copy Markdown
Contributor Author

irby commented Mar 27, 2026

Hey @HoogWater just want to update that I have been able to reproduce the issue on my end. I've found an additional layer of fix that needs to be made, this may take an extra day or two to resolve but I should have a release candidate available early next week.

irby and others added 2 commits March 30, 2026 13:37
@irby
fix: use CA trust bundle when connecting to OAuth
126457d 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
Update generated docs
540bfbb
@irby
Copy link
Copy Markdown
Contributor Author

irby commented Mar 30, 2026

@HoogWater pushed out a new RC, 2.2.0-rc.4, that should have the updated fix in place.

Please give this one a review and let me know if this one works!

HoogWater
HoogWater reviewed Mar 30, 2026
View reviewed changes
Comment thread Dockerfile
HoogWater
HoogWater approved these changes Mar 30, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@HoogWater HoogWater left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have tested the 2.2.0-rc.4 in my enviroment and it is now working perfectly.

so lgtm

I had 1 minor comment on the docker file specifically the GOIMAGE version being to specific that is nothing breaking anything

irby added 2 commits March 31, 2026 08:45
@irby
chore: use ejbca-go-client-sdk v1.1.0
11bce86 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@irby
chore: update go.sum
c698b67 
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
@indrora indrora merged commit 995344a into release-2.2 Apr 1, 2026
40 of 42 checks passed
indrora added a commit that referenced this pull request Apr 2, 2026
@indrora @irby
@spbsoluble @dependabot @HoogWater @JohnAuth
Merge 2.2.0 to main (#131)
0b74f91 
* release: 2.1.3: Dependency Updates (#116)

* chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1

Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.10.0 to 1.11.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.10.0...v1.11.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): bump actions/checkout from 4 to 5

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.1 to 0.22.3

Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.22.1 to 0.22.3.
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.22.1...v0.22.3)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.22.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.27.1

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.22.0 to 2.27.1.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.22.0...v2.27.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Change builder image to major.minor(1.24) instead of major.minor.patch(1.24.6)

When rebuilding the image now old critical vulnerabilities will not be in the resulting image anymore.

* chore(tests): add documentation for configuring security roles and update test names

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore(docs): update contributing guideline link in PR template

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore(docs): update changelog

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mark de Jong <HoogWater@users.noreply.github.com>

* ejbca-cert-manager-issuer 2.2.0 - CA ConfigMap Bundle + End Date Usage (#130)

* cabundle configmap option impelmented, and update to go 1.25

* Update the docs to reflect configmap option

* Update README to include configmap option

* cabundle configmap option impelmented, and update to go 1.25

* Update the docs to reflect configmap option

* Update README to include configmap option

* fix duplicate go line in go.mod

* feat: pass spec.duration to EJBCA as end_time (fixes #128)

* chore: update e2e test documentation, support dynamic variable resolution

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore(test): add unit test for end_time logic

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore(deps): bump k8s.io/apimachinery from 0.34.1 to 0.35.1

Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.34.1 to 0.35.1.
- [Commits](kubernetes/apimachinery@v0.34.1...v0.35.1)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: bump Docker golang version to 1.25

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore(deps): bump github.com/onsi/gomega from 1.36.1 to 1.39.1

Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.36.1 to 1.39.1.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.36.1...v1.39.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): bump k8s.io/api from 0.34.1 to 0.35.1

Bumps [k8s.io/api](https://github.com/kubernetes/api) from 0.34.1 to 0.35.1.
- [Commits](kubernetes/api@v0.34.1...v0.35.1)

---
updated-dependencies:
- dependency-name: k8s.io/api
  dependency-version: 0.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: address linting issues

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* fix: use v7 go-lint-action

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore: fix lint issue

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore: address PR comments

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore: fix lint issues. Update Makefile commands

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore: check for CRD drift

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* feat: add caBundleKey to issuer specification

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore: break the ca bundle and auth options retrieval into testable methods

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* feat: add logic to fetch caConfig from specified key

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore: update overview.md with updated links and information about new changes

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* fix: update CONTROLLER_TOOLS_VERSION

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore: update CHANGELOG and docs

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* fix: use CA trust bundle when connecting to OAuth

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* Update generated docs

* chore: use ejbca-go-client-sdk v1.1.0

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

* chore: update go.sum

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

---------

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com>
Co-authored-by: Mark de Jong <HoogWater@users.noreply.github.com>
Co-authored-by: JohnAuth <jdb@zuri.ch>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
Co-authored-by: Matthew H. Irby <irby@users.noreply.github.com>
Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mark de Jong <HoogWater@users.noreply.github.com>
Co-authored-by: JohnAuth <jdb@zuri.ch>
Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@HoogWater HoogWater HoogWater approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@irby @HoogWater @indrora @spbsoluble @JohnAuth