1.3.0

What's changed

ncm-issuer 1.3.0 moves the project to the nokia-steward GitHub organization, fixes Go standard library and golang.org/x/net vulnerabilities reachable from the controller and adds support for Kubernetes 1.37.

Security fixes

• Upgraded Go to 1.26.10 for the binary and Docker image. This clears vulnerabilities reachable from the controller in net/http, crypto/tls and mime/multipart (GO-2026-6603, GO-2026-6605, GO-2026-6607, GO-2026-6608, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6613, GO-2026-6617) and picks up the crypto/x509 fixes in 1.26.10. The controller image is now built on Alpine 3.24.3

• Updated golang.org/x/net to v0.61.0, which carries the module side of the HTTP/2 fixes for GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617. golang.org/x/text was updated to v0.43.0 in the same pass for CVE-2026-56851, which image scanners report but the controller does not call

⚠️ Breaking changes

ncm-issuer moved from the nokia to the nokia-steward GitHub organization. The Kubernetes API group certmanager.ncm.nokia.com is unchanged, so existing Issuer and ClusterIssuer resources keep working. What moved:

• Helm chart repository is now https://nokia-steward.github.io/ncm-issuer/charts. The old https://nokia.github.io/ncm-issuer/charts URL no longer serves the chart, so helm repo update fails for a repository added before the move. Repoint it with helm repo add nokia https://nokia-steward.github.io/ncm-issuer/charts --force-update. The documentation is now at https://nokia-steward.github.io/ncm-issuer/
• Container images from 1.3.0 onwards are published to ghcr.io/nokia-steward/ncm-issuer and ghcr.io/nokia-steward/ncm-issuer-utils. The chart defaults to them. Images up to 1.2.3 stay at ghcr.io/nokia, which gets no new tags. Update any image.repository or sidecar.repository override and any registry mirror that copies from ghcr.io/nokia
• Repository and Go module. The repository is now https://github.com/nokia-steward/ncm-issuer and links to github.com/nokia/ncm-issuer redirect there. The Go module path is now github.com/nokia-steward/ncm-issuer, so Go code that imports api/v1 has to update its import paths

Bug fixes and improvements

• Added support for Kubernetes 1.37 (supported versions: 1.26 - 1.37). The chart's kubeVersion constraint now admits 1.37 clusters. cert-manager itself does not list 1.37 as supported yet. cert-manager 1.21 covers Kubernetes 1.33 - 1.36
• Updated go.mod dependencies: Kubernetes API to 0.37, controller-runtime to 0.25.2, cert-manager to 1.21.2

Other changes

• Releases now carry signed build provenance, a CycloneDX SBOM, source archives and SHA-256 checksums. Both container images have a provenance attestation in GHCR that gh attestation verify oci://ghcr.io/nokia-steward/ncm-issuer:1.3.0 --repo nokia-steward/ncm-issuer checks. ncm-issuer-1.3.0.intoto.jsonl covers every file attached to the release. Verifying images and release assets lists the assets and how to verify them
• End to end tests now run against cert-manager 1.21 and 1.20, with 1.19 kept as the most recently retired line and 1.18 dropped. A Kubernetes 1.37 test is in place and starts running once microk8s publishes a 1.37 release. These are pipeline changes and do not alter the released controller

1.2.3

What's changed

ncm-issuer 1.2.3 fixes an authorization flaw in certificate renewal, clears a dependency vulnerability reachable from the NCM API client and stops duplicate CSRs reaching NCM after a controller restart.

Security fixes

• The NCM cert-id used at renewal is now bound to the certificate being renewed (GHSA-472p-2cfj-h7h7, CWE-862, CWE-441). The id is stored in the <certificate-name>-details Secret, so anyone able to write Secrets in that namespace could point a renewal at another NCM certificate and have it returned into their own namespace. Renewal keeps the existing private key, so ncm-issuer now requires the referenced certificate to carry the same public key as the CSR, along with the requested subject and SANs, before it changes anything in NCM. A rejected id no longer fails issuance: ncm-issuer logs it, raises a CertIDRejected event and re-enrolls instead. A Certificate whose subject or SANs changed is now also re-enrolled rather than renewed; thanks to Vibusha for reporting it through coordinated disclosure

• Updated golang.org/x/text to clear a vulnerability reachable from the NCM API client (GO-2026-5970). Versions before v0.39.0 can enter an infinite loop on invalid input and could hang a controller request. golang.org/x/net (GO-2026-5942) and go.opentelemetry.io/otel (GO-2026-5158) were updated in the same pass for code the controller does not call. All three shipped in 1.2.2

• Upgraded Go to 1.26.8 for the binary and Docker image, picking up upstream fixes in crypto/tls, encoding/asn1, html/template, net/http and the go command

Bug fixes and improvements

• Fixed duplicate CSRs being created in NCM after a controller restart or leader change. A CSR still awaiting approval in NCM is now tracked across restarts, so ncm-issuer resumes waiting on it instead of submitting a new one, and the 24 hour manual approval window is no longer reset. The <certificate-name>-details Secret holds this bookkeeping and is cleared once the certificate is issued or the request is rejected
• Tightened RBAC to what the controller actually uses, in both the Helm chart and the kustomize manifests. Unused Issuer/ClusterIssuer, ConfigMap and Event verbs and a dead cert-manager.io secrets rule are no longer granted. Leader election and certificate-details Secret persistence are unaffected
• Container base images are now pinned by digest, so a given release always builds on a known base. The controller image previously used alpine:latest. Available Alpine package upgrades are applied during the build, because Alpine patches packages faster than it rebuilds images

Other changes

• Added a security policy (SECURITY.md) explaining how to report a vulnerability privately, plus contributor and support guides (CONTRIBUTING.md, SUPPORT.md), issue forms, a pull request template and CODEOWNERS. Security reports are directed to the private advisory form rather than a public issue
• Added a third-party notices document (THIRD_PARTY_NOTICES.md) listing each direct dependency with its pinned version and licence, and the base images the published containers are built on
• Each release now carries an SPDX SBOM of the published container image, attached to the GitHub release as a .spdx.json asset next to the existing tarballs
• Widened and hardened CI. Lint, tests and the build now run on pull requests including those from forks. CodeQL, govulncheck, a Trivy image scan and OpenSSF Scorecard run on pull requests and weekly, with findings in the repository Security tab. Every third-party action is pinned to a commit SHA with minimal token permissions, and Dependabot now also proposes weekly Go dependency updates. These are pipeline changes and do not alter the released controller

Acknowledgements

Thanks to Vibusha for reporting the cert-id renewal issue through coordinated disclosure, with a detailed write-up and proof of concept.

1.2.2

What's changed

ncm-issuer 1.2.2 is a security hardening release addressing vulnerabilities reported by Claude Mythos Preview scan (Nokia is part of Project Glasswing as it builds and maintains critical software infrastructure).

Security fixes

• Fixed cross-namespace Secret exfiltration via a namespace-scoped Issuer (CWE-639, HIGH). A namespaced Issuer could set provisioner.authRef.namespace or provisioner.tlsRef.namespace to a Secret in another namespace, and because the controller holds cluster-wide secrets read permissions it would read and use those credentials. Namespace-scoped Issuer resources now always resolve their auth and TLS Secret references within their own namespace and ignore any user-supplied namespace. ClusterIssuer behavior is unchanged
• HTTPS server certificate verification is now enabled by default (CWE-295, MEDIUM / LOW). See the breaking change note below. Verification is only disabled when the new provisioner.insecureSkipVerify field is explicitly set to true, and the mTLS client certificate is always presented independently of the verification decision
• Fixed the TLS trust configuration being bypassed for the backup NCM API (CWE-295, LOW). When provisioner.mainAPI used plain http:// while provisioner.backupAPI used https://, the CA pinning and mTLS client certificate were not applied to the backup connection. The trust configuration now applies whenever either endpoint uses https://
• Stopped the end-to-end test failure artifact from bundling the mTLS private key and other secret material (CWE-532, MEDIUM). The internal e2e-collect-logs CI action archived the whole data/ directory, which included the PEM client key and cert, the CA bundle plus the NCM host injected from CI secrets. It now collects only data/logs. This is a CI/pipeline fix and does not change the released controller
• Hardened the GitHub release workflow against shell injection (CWE-78, LOW). The pages and package jobs interpolated the release name, body and tag_name directly into shell scripts, so a crafted release could execute arbitrary commands on the runner with a write-capable token. Those fields are now passed through environment variables and treated as data. The pages job also runs with an explicit minimal contents: write permission. This is a CI/pipeline fix and does not change the released controller
• Bounded the CA-chain traversal and NCM API response reads to prevent denial of service (CWE-835, LOW). When building the certificate chain the controller followed issuer references in an unbounded loop, so a malicious or misconfigured NCM API could keep it walking forever, and every API response body was read into memory without a size limit. The traversal now stops at a maximum depth and rejects cycles, and response bodies are capped at 8 MiB

⚠️ Breaking changes

HTTPS connections to the NCM REST API now verify the server certificate by default.

Before 1.2.2, an Issuer / ClusterIssuer whose provisioner.mainAPI (or provisioner.backupAPI) used
https:// silently skipped NCM server certificate verification in two situations: when no provisioner.tlsRef
was configured and when the referenced Secret omitted the cacert entry. From 1.2.2 these connections are verified
by default (against the cacert when it is provided, otherwise against the system trust store), and the mTLS client
certificate is always presented regardless of the verification mode.

Who is affected: any deployment that talks to the NCM REST API over https:// using a certificate signed by a
private CA whose bundle was not supplied as cacert. After upgrading, the controller will now fail its health probe
for such an issuer and report Ready=False with reason Error instead of connecting insecurely.

What to do before upgrading (pick one):

• Recommended: add the CA bundle as the cacert entry of the Secret referenced by provisioner.tlsRef (see TLS without client authentication). Verification then pins to that bundle.
• If the NCM certificate is issued by a CA already in the container's system trust store, no change is needed. Verification succeeds automatically.
• Not recommended (testing only): set provisioner.insecureSkipVerify: true to explicitly restore the previous no-verification behavior.

This change also closes a related gap where the TLS trust configuration was not applied to a https:// backup API when
the main API used plain http://. The trust configuration (and any insecureSkipVerify opt-in) now applies to every
https:// NCM endpoint, main or backup.

Other changes

• The ncm-issuer-utils troubleshooting sidecar image is now attached to each GitHub release as a downloadable docker load-able tarball (ncm-issuer-utils-<version>.tgz). Previously the sidecar image was only pushed to ghcr.io/nokia/ncm-issuer-utils, so users in air-gapped or registry-restricted environments could not obtain it alongside the main ncm-issuer release tarball. Load it with docker load -i ncm-issuer-utils-<version>.tgz. Like the main image tarball it is built for linux/amd64; multi-arch images remain available from ghcr.io

1.2.1

What's changed

ncm-issuer 1.2.1 is a security and reliability focused release that hardens the controller to the Pod Security Standards "restricted" profile (non-root, read-only rootfs, all capabilities dropped), makes issuer health checks trustworthy and moves images to ghcr.io/nokia with multi-arch (amd64/arm64) support. It also adds Kubernetes 1.36 support with Go 1.26.4.

Improvements and fixes

• Fixed NCM REST API health check to actually probe the /v1/cas endpoint with authentication and to treat only 2xx responses as healthy. Previously the probe targeted the base URL and considered any non-5xx response (including authentication failures and other 4xx) as healthy, which masked misconfigured endpoints and credentials
• Gated Issuer / ClusterIssuer Ready condition on a synchronous health probe during reconciliation. An unreachable or misconfigured NCM REST API is now surfaced immediately as Ready=False with reason Error and a descriptive message instead of being marked Ready=True until the first periodic check (which by default could take up to one minute)
• Hardened the controller container to Pod Security Standards "restricted" by default. The CSR PEM is now streamed directly into the NCM multipart upload instead of being round-tripped through a temporary file under /tmp, which removes a data-leakage surface and lets the chart ship with readOnlyRootFilesystem: true, capabilities.drop: [ALL], allowPrivilegeEscalation: false and seccompProfile: RuntimeDefault on the controller container, plus seccompProfile: RuntimeDefault at the pod level
• Split chart securityContext into pod-level and container-level blocks. Pod-level fields now live under .Values.podSecurityContext, container-level fields for the controller stay under .Values.securityContext. The troubleshooting sidecar gets its own .Values.sidecar.securityContext that drops all capabilities and re-adds only NET_RAW, NET_ADMIN and SYS_PTRACE so tcpdump and strace keep working under a non-root user. Breaking: chart overrides that previously set .Values.securityContext to control both pod-level and container-level fields will need to be split accordingly
• Updated ncm-issuer-utils troubleshooting image to apply matching file capabilities (cap_net_raw,cap_net_admin+ep on tcpdump, cap_sys_ptrace+ep on strace) so the non-root sidecar user can actually use them without granting the whole container privileged caps
• Published multi-architecture container images for linux/amd64 and linux/arm64. The release workflow now builds and pushes a multi-arch manifest, and the Dockerfile cross-compiles the manager binary for the target platform (TARGETOS/TARGETARCH) instead of hardcoding amd64. This enables running ncm-issuer on ARM64 nodes such as AWS Graviton, ARM bare metal and Apple Silicon dev clusters
• Moved the default container registry from a Docker Hub namespace to the Nokia-owned GitHub Container Registry (ghcr.io/nokia). The Helm chart now defaults image.repository to ghcr.io/nokia/ncm-issuer and the troubleshooting sidecar to ghcr.io/nokia/ncm-issuer-utils. The release workflow publishes both images to ghcr.io/nokia using the built-in GITHUB_TOKEN instead of Docker Hub credentials. The troubleshooting sidecar is now rebuilt on every release so it ships with up-to-date OS packages. Migration: pull images from ghcr.io/nokia/ncm-issuer. Deployments that already override image.repository are unaffected
• Added support for Kubernetes 1.36 (supported versions: 1.26 - 1.36)
• Updated go.mod dependencies: Kubernetes API to 0.36, controller-runtime to 0.24.1, cert-manager to 1.20.3
• Upgraded Go version used for building the binary and Docker image from 1.25.6 to 1.26.4

1.2.0

What's changed

ncm-issuer 1.2.0 adds outbound proxy support for NCM API calls and makes Helm upgrades resilient to cert-manager approver RBAC naming differences. It also aligns default cert-manager RBAC role naming in the chart for consistency.

Improvements and fixes

• Enhanced HTTP(S) client transport configuration to honor standard proxy env vars (HTTP_PROXY / HTTPS_PROXY / NO_PROXY) when calling NCM REST API
• Added Helm chart values to configure outbound proxy settings for the controller pod
• Made helm upgrade resilient to cert-manager approver RBAC name variations by preserving the already-installed ClusterRoleBinding.roleRef (which is immutable in Kubernetes). This prevents upgrade failures when the existing RBAC was created with different naming than chart defaults. Also aligned default certManagerRbac.role with certManagerRbac.binding for consistency in fresh installs

1.1.9

What's changed

ncm-issuer 1.1.9 is a compatibility and robustness release that corrects URL handling for NCM backup API requests. It also adds support for Kubernetes 1.35 and updates core dependencies and build tooling.

Improvements and fixes

• Corrected URL handling for backup API requests (fixes #60)
• Added support for Kubernetes 1.35 (supported versions: 1.25 - 1.35)
• Updated go.mod dependencies: Kubernetes API to 0.35, controller-runtime to 0.22.4, cert-manager to 1.19.2
• Upgraded Go version used for building the binary and Docker image from 1.25.4 to 1.25.6

1.1.8

What's changed

ncm-issuer 1.1.8 is a compatibility and robustness release that aligns private key rotation semantics with cert-manager v1.18+, enhances certificate operation logging and improves NCM API error handling. It also adds support for Kubernetes 1.34 and updates core dependencies and build tooling.

Improvements and fixes

• Fixed private key rotation policy handling (certificate renewal loop) to align with cert-manager >=1.18.0 changes. From this release onwards, omitting .spec.privateKey.rotationPolicy means re-enrollment (private key rotation) instead of renewal. This aligns ncm-issuer behaviour with cert-manager v1.18.0+, where the default rotation policy changed from Never to Always. If you require a true renew-with-same-key flow, set .spec.privateKey.rotationPolicy to Never explicitly
• Enhanced logging for certificate operations with improved certificate extraction utilities. Logs now include detailed certificate information such as subject DN, serial number, validity period (notBefore/notAfter), SAN entries (DNS names and IP addresses), key type and size, signature algorithm, issuer details, operation type, issue duration etc.
• Added support for Kubernetes 1.34 (supported versions: 1.24 - 1.34)
• Improved resource management by ensuring proper cleanup of temporary files and HTTP response bodies to prevent resource leaks
• Added nil checks and improved error handling in NCM API operations
• Refactored code for improved clarity, including leader election configuration and type improvements
• Updated ncm-issuer-utils troubleshooting container to 1.1.8
• Updated go.mod dependencies: Kubernetes API to 0.34, controller-runtime to 0.22, cert-manager to 1.19.1

1.1.7

What's changed

ncm-issuer 1.1.7 is a maintenance release that resolves Harbor OCI tag collisions that could overwrite Helm charts and container images sharing the same tag.

Improvements and fixes

• Separated chart version from image tag to avoid Harbor OCI overwrite
• Fixed Makefile to save both remote and local tags in Docker archive, improving compatibility with various Kubernetes orchestrators
• Fully qualify golang base image as docker.io/golang to avoid short-name resolution error in some dev envs

Other

• Updated go.mod dependencies to bump cert-manager to 1.18.1

• CI workflows updated with cert-manager 1.18.1

1.1.6

What's changed

ncm-issuer 1.1.6 is a maintenance release that resolves potential issue in NCS, decreases the image size, brings the shell to main container and updates the troubleshooting sidecar container.

Improvements and fixes

• Switched from Scratch to Alpine image to play more nicely with different Kubernetes orchestrators (and to finally have a shell!)
• Decreased the size of the main ncm-issuer tarball from ~27,5 MB to ~17 MB (so it is even more sleek and sexy)
• Switched to Docker Buildx for reliable cross-platform image builds
• Added explicit command to start ncm-issuer binary in Helm's deployment.yaml to ensure consistent container startup across Kubernetes environments
• Updated ncm-issuer-utils troubleshooting container to 1.1.6 - it is still hanging around even though the regular one has a shell now, mainly due to better security posture and clear separation
• Added new troubleshooting tools to ncm-issuer-utils: procps-ng, lsof, vim-minimal, less, strace

Other

• Stripped symbol and DWARF debug info to reduce Docker image binary size
• Upgraded Go version used for building the binary and Docker image from 1.24.3 to 1.24.4

1.1.5

What's changed

ncm-issuer 1.1.5 is a maintenance release that resolves potential issue in NCP/OCP (RBAC workaround) and adds support for Kubernetes 1.33.

Improvements and fixes

• Implemented optional RBAC workaround which might be needed when cert-manager is installed via the OLM/operator (see certManagerRbac.operatorWorkaround.enable in values.yaml)
• Added support for Kubernetes 1.33 (supported versions: 1.24 - 1.33)

Other

• Upgraded Go version used for building the binary and Docker image from 1.24.2 to 1.24.3
• Updated go.mod dependencies (Kubernetes API to 0.33, controller-runtime to 0.21, cert-manager to 1.17.2)
• CI workflows updated with newer components