Skip to content

What's changed

ncm-issuer 1.1.8 is a compatibility and robustness release that aligns private key rotation semantics with cert-manager v1.18+, enhances certificate operation logging and improves NCM API error handling. It also adds support for Kubernetes 1.34 and updates core dependencies and build tooling.

Improvements and fixes

  • Fixed private key rotation policy handling (certificate renewal loop) to align with cert-manager >=1.18.0 changes. From this release onwards, omitting .spec.privateKey.rotationPolicy means re-enrollment (private key rotation) instead of renewal. This aligns ncm-issuer behaviour with cert-manager v1.18.0+, where the default rotation policy changed from Never to Always. If you require a true renew-with-same-key flow, set .spec.privateKey.rotationPolicy to Never explicitly
  • Enhanced logging for certificate operations with improved certificate extraction utilities. Logs now include detailed certificate information such as subject DN, serial number, validity period (notBefore/notAfter), SAN entries (DNS names and IP addresses), key type and size, signature algorithm, issuer details, operation type, issue duration etc.
  • Added support for Kubernetes 1.34 (supported versions: 1.24 - 1.34)
  • Improved resource management by ensuring proper cleanup of temporary files and HTTP response bodies to prevent resource leaks
  • Added nil checks and improved error handling in NCM API operations
  • Refactored code for improved clarity, including leader election configuration and type improvements
  • Updated ncm-issuer-utils troubleshooting container to 1.1.8
  • Updated go.mod dependencies: Kubernetes API to 0.34, controller-runtime to 0.22, cert-manager to 1.19.1