⭐ If you are using this project, please consider supporting it by starring the repository. It helps me a lot to keep maintaining and improving this project. Thank you!
❤️ In loving memory of my mom. She was my biggest supporter. This release is dedicated to her memory. I miss you mom, and I love you. April 27th, 1948 ~ February 19th, 2026.
- 🐛 explicitly declare
ovhAuthenticationRefas optional in issuer schema - 🐛 add
nilguards for authentication objects in Helm template helpers (fixes #79) - 🌱 add new unit tests to cover nil guards in Helm template helpers
⭐ If you are using this project, please consider supporting it by starring the repository. It helps me a lot to keep maintaining and improving this project. Thank you!
🚀 Overall, this release gets us closer to a more robust, polished and user-friendly Helm chart. The time and quality invested in this release aim to bring it close to what you'd expect from a commercial product.
🚀 The values.yaml is now fully documented and it now supports JSON schema validation. A lot of time has gone into rewriting unit tests to catch potential issues and ensure the stability of this Helm chart. The new validator template and the JSON schema validation helps catch configuration errors early and provides much better feedback to users.
values.yaml file has been reorganized and some configuration keys have been moved. Please refer to the updated values.yaml and the new README.md for details on the new structure and configuration options.
tolerations due to a problem with the Helm Chart template rendering.
❤️ In loving memory of my mom. She was my biggest supporter. This release is dedicated to her memory. I miss you mom, and I love you. April 27th, 1948 ~ February 19th, 2026.
- 🚀 add JSON schema for Helm chart
values.yamlvalidation when deploying the Chart - 🚀 rewrite the Chart unit tests to validate the Chart rendering and error handling
- 🎉 add JSON schema annotations to all options in
values.yaml - 🎉 refactor/reorganize the Helm chart
values.yamlstructure (⚠️ see breaking changes above) - 🎉 add dedicated
validator.yamltemplate for issuer authentication - 📄 add inline documentation to
values.yaml, including JSON schema for schema generation - 📄 add Helm chart
README.mdwith values documentation
- 🌿 add unit tests for
groupName,certManager,rbac,image,serviceandpodoptions - 🌿 refactor authentication helper functions in _helpers.tpl
- 🌿 update helm unit tests for refactored authentication helpers
- 🌿 update test values for refactored authentication validation
- 🌿 add
annotationssupport forservice - 🌿 add validation to enforce single authentication method per issuer
- 🌿 add unit tests for validator template with dual authentication rejection
- 🌿 add issuer authentication method field validation
- 🌿 add unit tests for issuer authentication method validation
- 🌱 add YAML language server schema annotation to
values.yaml - 🌱 remove redundant fail check and add inline comments in issuer.yaml
- 🌱 remove redundant fail check in secret.yaml
- 🌱 add default value schema annotations for ovhAuthenticationRef key fields
- 📄 improve
profileoption comments invalues.yaml - 📄 update release workflow with
helm-docsandhelm-schemasteps inREADME.md - 📄 update feature list in
README.md - 📄 clarify image.tag accepts version numbers or digests
- ⚙️ add
-trimpathflag to go build inDockerfileto support reproducible builds - ⚙️ add
helm-docs,helm-schema, andhelm-unittesttargets inMakefile - 🔥 temporarily remove deployment
tolerationsdue to a problem with the Helm template rendering. - 🔥 remove legacy test files and test value fixtures
- 📝 update README feature list with unit tests entry and wording fixes
- ⏩ upgrade github.com/cert-manager/cert-manager to v1.19.3
- 🌿 add issuer authentication method field validation
- 🌿 add unit tests for issuer authentication method validation
- 🌿 expand issuer test suite with oauth2 and application ref test cases
- 📝 update README feature list with unit tests entry and wording fixes
- 🌿 add validation to enforce single authentication method per issuer
- 🌿 add unit tests for validator template with dual authentication rejection
- ⚙️ add
-trimpathflag to go build inDockerfileto support reproducible builds
- 🎉 add dedicated validator template for issuer authentication
- 🌿 refactor authentication helper functions in _helpers.tpl
- 🌿 update helm unit tests for refactored authentication helpers
- 🌿 update test values for refactored authentication validation
- 🌱 remove redundant fail check and add inline comments in issuer.yaml
- 🌱 remove redundant fail check in secret.yaml
- 🌱 add default value schema annotations for ovhAuthenticationRef key fields
⭐ If you are using this project, please consider supporting it by starring the repository. It helps us a lot to keep maintaining and improving this project. Thank you!
- 🎉 refactor/reorganize Helm chart
values.yamlstructure - 🎉 add JSON schema annotations to all options in
values.yaml - 🚀 add JSON schema for Helm chart
values.yamlvalidation - 📄 add Helm chart
README.mdwith values documentation - 🌿 rewrite unit tests to fully unit test the Helm Chart
values.yaml file has been reorganized and some configuration keys have been moved. Please refer to the updated values.yaml and the new README.md for details on the new structure and configuration options.
tolerations due to a problem with the Helm template rendering.
- 🌿 add unit tests for
groupName,certManager,rbac,image,serviceandpodoptions - 🌱 add YAML language server schema annotation to
values.yaml - 🌿 add
annotationssupport forservice - 📄 add inline documentation to
values.yaml, including JSON schema for schema generation - 📄 improve
profileoption comments invalues.yaml - 📄 update release workflow with
helm-docsandhelm-schemasteps inREADME.md - 📄 update feature list in
README.md - 📄 clarify image.tag accepts version numbers or digests
- ⚙️ add
helm-docs,helm-schema, andhelm-unittesttargets inMakefile - 🔥 remove deployment
tolerationsdue to a problem with the Helm template rendering. - 🔥 remove legacy test files and test value fixtures
- ⏩ upgrade github.com/cert-manager/cert-manager to v1.19.3
- 🐛 fix ACME challenge subdomain parsing for multi-level subdomains. #75 (by Karol Stoiński)
- 🌱 Add optional
priorityClassNameto deployment template. #71 (by Pierre Mahot) - 🌿 Add cluster issuer disableAccountKeyGeneration option. #68 (by Thomas Coudert)
- 📝 add helpful post-install notes to Helm chart
- 📄 improved documentation so readers have instructions on how to perform the setup with the OVH cli
- ⏩ upgrade alpine to 3.23
- ⏩ upgrade golang to 1.25.5
- ⏩ upgrade golang toolchain to 1.25.5
- ⏩ upgrade github.com/cert-manager/cert-manager to v1.19.2
- ⏩ upgrade k8s.io/api to v0.34.3
- ⏩ upgrade k8s.io/apiextensions-apiserver to v0.34.3
- ⏩ upgrade k8s.io/apimachinery to v0.34.3
- ⏩ upgrade k8s.io/client-go to v0.34.3
- ⏩ upgrade Helm to v3.19.5 in tests workflow
- ⏩ upgrade step-security/harden-runner to v2.14.1
- 🐛 trim
"around TXT records when checking value before deciding to delete (by flodakto) - 🌿 add warning log when skipping TXT record deletion due to values mismatch
- 🌿 improve error logging throughout the entire webhook
- 🌿 add charmbracelet/log v0.4.2 to perform structured logging functions
- ⏩ add charmbracelet/log v0.4.2
- ⏩ upgrade golang to 1.25.0
- ⏩ upgrade golang toolchain to 1.25.0
- ⏩ upgrade github.com/cert-manager/cert-manager to v1.19.1
- ⏩ upgrade k8s.io/api to v0.34.1
- ⏩ upgrade k8s.io/apimachinery to v0.34.1
- ⏩ upgrade k8s.io/client-go to v0.34.1
- 🎉 add support for OAuth2 authentication when communicating with OVH API (by Rémy Jacquin)
- 🎉 add support for ACME profiles paving the way to shortlived certificates (docs)
⚠️ renamed configuration keyconsumerKeytoapplicationConsumerKeyto prevent confusion with OAuth2 authentication. See documentation.⚠️ renamedConsumerKeyReftoApplicationConsumerKeyRefto prevent confusion with OAuth2 authentication. See documentation.⚠️ due to the breaking changes described above, the new value forconfigVersionfield is0.0.2.
- 🎉 add unit tests to validate the Chart (by Rémy Jacquin)
- 🎉 add unit tests to validate the webhook (by Rémy Jacquin)
- 🌿 add 4 end-to-end tests to fully test the webhook (combination of app/oauth2 and direct/secret references)
- 🌿 improve some error messages when
configVersionis invalid or missing - 📄 document how to configure and use the new OAuth2 authentication (by Rémy Jacquin, with modification from Aurélien Requiem)
- 📄 expand documentation on how to create IAM policy
- 🐛 add missing permissions for the IAM policy
- ⏩ upgrade golang to 1.24.7
- ⏩ upgrade golang toolchain to 1.24.7
- 🎉 add support for OAuth2 authentication when communicating with OVH API (by Rémy Jacquin)
⚠️ renamed configuration keyconsumerKeytoapplicationConsumerKeyto prevent confusion with OAuth2 authentication. See documentation.⚠️ renamedConsumerKeyReftoApplicationConsumerKeyRefto prevent confusion with OAuth2 authentication. See documentation.⚠️ due to the breaking changes described above, the new value forconfigVersionfield is0.0.2.
- 🎉 add unit tests to validate the Chart (by Rémy Jacquin)
- 🎉 add unit tests to validate the webhook (by Rémy Jacquin)
- 🌿 improve some error messages when
configVersionis invalid or missing - 📄 document how to configure and use the new OAuth2 authentication (by Rémy Jacquin, with modification from Aurélien Requiem)
- ⏩ upgrade golang to 1.24.7
- ⏩ upgrade golang toolchain to 1.24.7
- 🎉 both the build image and base image are using Alpine Linux 3.22
- 🎉 allow creation of extra manifests via
values.yaml(by Rémy Jacquin) - 🐛 fix
app.kubernetes.io/versionlabel when using SHA in image tag (by Rémy Jacquin)
- ⏩ upgrade golang build image to 1.24-alpine3.22
- ⏩ upgrade alpine base image to 3.22
- ⏩ upgrade github.com/cert-manager/cert-manager to v1.18.2
- ⏩ upgrade github.com/ovh/go-ovh to v1.9.0
- 🎉 add support for External Account Binding (by Sebastien MALOT)
- ⏩ upgrade github.com/cert-manager/cert-manager to v1.17.3
- ⏩ upgrade github.com/ovh/go-ovh to v1.8.0
- ⏩ upgrade k8s.io/api to v0.33.2
- ⏩ upgrade k8s.io/apimachinery to v0.33.2
- ⏩ upgrade k8s.io/client-go to v0.33.2
- 🧹 maintenance release, updated dependenies only.
- 🐛 fix minor casing issue in
Dockerfile - 🙈 ignore .aider* files
- ⏩ upgrade github.com/cert-manager/cert-manager to v1.17.2
- ⏩ upgrade github.com/ovh/go-ovh to v1.7.0
- ⏩ upgrade k8s.io/api to v0.32.5
- ⏩ upgrade k8s.io/apiextensions-apiserver to v0.32.5
- ⏩ upgrade k8s.io/apimachinery to v0.32.5
- ⏩ upgrade k8s.io/client-go to v0.32.5
- ⏩ upgrade golang to 1.24
- ⏩ upgrade alpine to 3.21
- 🧹 maintenance release, only updated dependenies.
- ⏩ update golang.org/x/net v0.33.0 to address CVE-2024-45338
- 🧹 maintenance release, only updated dependenies.
- ⏩ update golang.org/x/crypto v0.31.0
- 🧹 maintenance release, only updated dependenies.
- ⏩ update go 1.23.3
- ⏩ update github.com/cert-manager/cert-manager v1.16.2
- ⏩ update k8s.io/api v0.31.3
- ⏩ update k8s.io/apiextensions-apiserver v0.31.3
- ⏩ update k8s.io/apimachinery v0.31.3
- ⏩ update k8s.io/client-go v0.31.3
- ✨ Add new
configVersionto assist with breaking change - 🌿 Prefix Helm Chart error messages with 'Error:'
- 🐛 Address minor typography issues in documentation.
- 🌿 support adding customer labels to pod
- 📄 slightly improve documentation in values.yaml
- ⏩ Use Alpine to 3.20 and Golang 1.23 as build image
- ⏩ Use Alpine to 3.20 as base image
- ⏩ Use Go 1.23.0 to build webhook
- ⏩ Bump github.com/cert-manager/cert-manager 1.14.1 to 1.15.3
- ⏩ Bump github.com/ovh/go-ovh from 1.4.3 to 1.6.0
- ⏩ Bump k8s.io/api from 0.29.1 to 0.30.1
- ⏩ Bump k8s.io/apiextensions-apiserver from 0.29.1 to 0.30.1
- ⏩ Bump golang.org/x/net from 0.20.0 to 0.23.0
- 🌿 rename schemaVersion to configVersion
- 🐛 fix error when handling commented configVersion
- 🌿 improve version check
- 🌿 support adding customer labels to pod
- 📄 slightly improve documentation in values.yaml
- ✨ Add new
schemaVersionto assist with breaking change - 🌿 Prefix error messages with 'Error:'
- 🐛 Address minor typography issues in documentation.
- ⏩ Use Alpine to 3.20 and Golang 1.23 as build image
- ⏩ Use Alpine to 3.20 as base image
- ⏩ Use Go 1.23.0 to build webhook
- ⏩ Bump github.com/cert-manager/cert-manager 1.14.1 to 1.15.3
- ⏩ Bump github.com/ovh/go-ovh from 1.4.3 to 1.6.0
- ⏩ Bump k8s.io/api from 0.29.1 to 0.30.1
- ⏩ Bump k8s.io/apiextensions-apiserver from 0.29.1 to 0.30.1
- ⏩ Bump golang.org/x/net from 0.20.0 to 0.23.0
⚠️ SeparatesecurityContextfor bothcontainerandpod. Seevalues.yamlfor more details. See #32. Authored by Mathieu Sensei.- ✨ Support
podAnnotations. See #32. Authored by Mathieu Sensei. - 🌿 Comment out
image.tagas it's not needed unless someone wants to override the container image version
- ⏩ Use Alpine to 3.19.1 as base image
- ⏩ Use Go 1.21.6 to build webhook
- ⏩ Bump github.com/cert-manager/cert-manager 1.13.0 to 1.14.1
- ⏩ Bump github.com/ovh/go-ovh from 1.4.2 to 1.4.3
- ⏩ Bump golang.org/x/crypto from 0.14.0 to 0.18.0
- ⏩ Bump golang.org/x/net from 0.17.0 to 0.20.0
- ⏩ Bump k8s.io/api from 0.29.0 to 0.29.1
- ⏩ Bump k8s.io/apiextensions-apiserver from 0.29.0 to 0.29.1
- ⏩ Bump google.golang.org/grpc from 1.58.2 to 1.58.3. See Dependabot
- ⏩ Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.35.0 to 0.46.0. See Dependabot
- ⏩ Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.19.0 to 1.20.0
- ⏩ Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.19.0 to 1.20.0
- ⏩ Bump go.opentelemetry.io/otel/sdk from 1.19.0 to 1.20.0
- ⏩ Bump golang.org/x/sys from 0.13.0 to 0.14.0
- 🔥 Alpine 3.18.4 is vulnerable to the following CVEs. Should be fixed in 3.18.5 release.
- ⏩ bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.45.0 to address CVE-2023-45142. See Dependabot.
- ⏩ bump golang.org/x/net from 0.15.0 to 0.17.0. See Dependabot PR.
- ✨ add support for
readOnlyRootFilesystemon the deployment (thanks @Benzhaomin) - ✨ add Deployment annotation support (thanks @Benzhaomin)
- ✨ add ref link about
nodeSelector,tolerations,affinityandannotations - ✨ choose rbac role type (default
Role) (thanks @Alissia01) - 📄 document 3 more configuration entries in
values.yaml - 🌿 make this chart compatible with helm 3 by settings
apiVersiontov2 - 🌿 drop
vinappVersionandversionfields, set"0.5.0" - 🌿 udpate
image.tagvalue to use SemVer 2.0 and set its values to"0.5.0" - 🐛 typo fix
- ⏩ update k8s.io/apiserver to v0.28.2 due to security (dependabot)
- ⏩ upgrade github.com/cert-manager/cert-manager to v1.13.0
- ⏩ build with go 1.20
- ⏩ upgrade k8s dependencies to 0.28.1
- ⏩ use alpine 3.18 as base image
- ⏩ update dependency for github.com/ovh/go-ovh to v1.4.2
- ⏩ Bump google.golang.org/grpc from 1.51.0 to 1.53.0
- ✨ add support for
readOnlyRootFilesystemon the deployment (thanks @Benzhaomin) - 🐛 typo fix
- ✨ add annotation support (thanks @Benzhaomin)
- ✨ add ref link about
nodeSelector,tolerations,affinityandannotations - ✨ choose rbac role type (default
Role) - ⏩ build with go 1.20
- ⏩ upgrade k8s dependencies to 0.28.1
- ⏩ upgrade github.com/cert-manager/cert-manager to v1.13.0
- ⏩ use alpine 3.18 as base image
- ⏩ Bump google.golang.org/grpc from 1.51.0 to 1.53.0
- 📄 document 3 more configuration entries in
values.yaml - 🌿 make this chart compatible with helm 3 by settings
apiVersiontov2 - 🌿 drop
vinappVersionandversionfields, set"0.5.0" - 🌿 udpate
image.tagvalue to use SemVer 2.0 and set its values to"0.5.0" - ⏩ update dependency for github.com/ovh/go-ovh to v1.4.2
- ✨ build images for amd64, arm64 and armv7 architectures
- 🐙 add issue templates for bugs and feature requests
- 🤖 configure dependabot to get alerts on vulnerabilities
- 📄 add disclaimer about support and code of conduct
- ✨ integration with artifacthub.io
- 📄 minor inconsistency fix in README.md
- 📄 add steps to make a release
- ⏩ update cert-manager dependency to v1.11.0
- ⏩ update k8s dependency to v0.26.0
- ⏩ build image using Go 1.19.7
- ⏩ upgrade alpine to 3.17
- ⏩ update Chart.yaml and
values.yamlto use latest container image
- 📄 minor consistency fix in README.md
- ✨ start work to integrade with artifacthub.io
- ⏩ update cert-manager dependency to v1.11.0
- ⏩ update k8s dependency to v0.26.0
- ✨ build image using Go 1.19.5
- ✨ initial work to build arm64 and armv7 images
- 🐛 include minutes and seconds in certificates duration fields. see argoproj/argo-cd#6008 for details. via @aegaeonit
- ✨ optimize Dockerfile for better builds
- ✨ explicitly use Alpine 3.16 throughout the Dockerfile
- ✨ run the webhook as
nobody/nogroup - ✨ reduce container image from 107MB down to 56.2MB
- ✨ add CNAME strategy to issuers in #8. Thanks (@Zcool85)
- ✨ build image using Go 1.19.4
⚠️ breaking changes ahead if comming from previous version- 📄 documentation and helm chart hosted at https://aureq.github.io/cert-manager-webhook-ovh/
- ✨ deploy multiple
Issuer(namespaced) andClusterIssuervia chart - ✨ either specify your OVH credentials, or use an existing secret
- ✨ OVH credential are all stored in a secret (ApplicationKey, ApplicaitonSecret, ConsumerKey)
- ✨ deploy necessary permissions to access the OVH credentials
- ✨ role based access control to access secrets across namespaces
- 🚀 publish container image on GitHub Container Registry
- 🚀 publish Helm Chart on GitHub pages
- ⬆️ upgrade dependencies to reduce warnings
- ✨ drop root privileges
- ✨ add support for HTTP/HTTPS proxy
- 🚀 use kubernetes recommended labels
- ✨ move some helm logic in _helpers.tpl
- ✨ completely rework
values.yamlto support creating issuers and ovh credentials - ✨ create role and bind it so the webhook can access necessary secrets
- ⬆️ upgrade dependencies to reduce warnings
- cert-manager
v1.5.3tov1.9.1 - go-ovh
v1.1.0tov1.3.0 - client-go
v0.22.1tov0.24.2
- cert-manager
- build webhook using golang
1.18 - ✨ add image pull secrets to helm chart by Julian Stiller)
- 🐛 fix base64 encoded secrets by @julienkosinski
- 🔥 drop root privilges (missing attribution)
- 🐛 fix how security context is checked
- ✨ add RBAC (missing attribution)
- ⬆️ upgrade to Alpine Linux 3.16 container image
- 🐛 fix
Makefilereferences and enable HTTP proxy to local build environment - ✨ set
CAP_NET_BIND_SERVICEto binary to bind on privileged ports without root privileges (missing attribution) - 🐛 add
libpcapto container image - ✨ create logo based on cert-manager logo and icons8
- ✨ more fields populated in
Chart.yaml - 🌱 some ground work to automate the release process via GitHub Actions and GitHub packages
⚠️ breaking changes ahead- ✨ major helm chart improvements
- ✨ deploy multiple
Issuer(namespaced) andClusterIssuervia chart - ✨ either specify your OVH credentials, or use an existing secret
- ✨ OVH credential are all stored in a secret (ApplicationKey, ApplicaitonSecret, ConsumerKey)
- ✨ deploy necessary permissions to access the OVH credentials
- ✨ role based access control to access secrets across namespaces
- ✨ move some helm logic in _helpers.tpl
- ✨ completely rework
values.yamlto support creating issuers and ovh credentials - ✨ create role and bind it so the webhook can access necessary secrets
- 📄 documentation and helm chart hosted at https://aureq.github.io/cert-manager-webhook-ovh/
- 🚀 publish container image on GitHub Container Registry
- 🚀 publish Helm Chart on GitHub pages
- ⬆️ upgrade dependencies to reduce warnings
- ✨ drop root privileges
- 🌱 some ground work to automate the release process via GitHub Actions
- ✨ add support for HTTP proxy
- ⬆️ upgrade dependencies to reduce warnings
- cert-manager
v1.5.3tov1.9.1 - go-ovh
v1.1.0tov1.3.0 - client-go
v0.22.1tov0.24.2
- cert-manager
- build webhook using golang
1.18 - ✨ add image pull secrets to helm chart by Julian Stiller)
- 🐛 fix base64 encoded secrets by @julienkosinski
- 🔥 drop root privilges (missing attribution)
- 🐛 fix how security context is checked
- ✨ add RBAC (missing attribution)
- ⬆️ upgrade to Alpine Linux 3.16 container image
- 🐛 fix
Makefilereferences and enable HTTP proxy to local build environment - ✨ set
CAP_NET_BIND_SERVICEto binary to bind on privileged ports without root privileges (missing attribution) - 🐛 add
libpcapto container image - ✨ create logo based on cert-manager logo and icons8
- ✨ more fields populated in
Chart.yaml - 🌱 some ground work to automate the release process via GitHub Actions and GitHub packages
- Initial work by @baarde
- cert-manager-webhook-ovh
- Commit
ab4d192