Skip to content

What's changed

ncm-issuer 1.3.0 moves the project to the nokia-steward GitHub organization, fixes Go standard library and golang.org/x/net vulnerabilities reachable from the controller and adds support for Kubernetes 1.37.

Security fixes

  • Upgraded Go to 1.26.10 for the binary and Docker image. This clears vulnerabilities reachable from the controller in net/http, crypto/tls and mime/multipart (GO-2026-6603, GO-2026-6605, GO-2026-6607, GO-2026-6608, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6613, GO-2026-6617) and picks up the crypto/x509 fixes in 1.26.10. The controller image is now built on Alpine 3.24.3

  • Updated golang.org/x/net to v0.61.0, which carries the module side of the HTTP/2 fixes for GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617. golang.org/x/text was updated to v0.43.0 in the same pass for CVE-2026-56851, which image scanners report but the controller does not call

⚠ Breaking changes

ncm-issuer moved from the nokia to the nokia-steward GitHub organization. The Kubernetes API group certmanager.ncm.nokia.com is unchanged, so existing Issuer and ClusterIssuer resources keep working. What moved:

  • Helm chart repository is now https://nokia-steward.github.io/ncm-issuer/charts. The old https://nokia.github.io/ncm-issuer/charts URL no longer serves the chart, so helm repo update fails for a repository added before the move. Repoint it with helm repo add nokia https://nokia-steward.github.io/ncm-issuer/charts --force-update. The documentation is now at https://nokia-steward.github.io/ncm-issuer/
  • Container images from 1.3.0 onwards are published to ghcr.io/nokia-steward/ncm-issuer and ghcr.io/nokia-steward/ncm-issuer-utils. The chart defaults to them. Images up to 1.2.3 stay at ghcr.io/nokia, which gets no new tags. Update any image.repository or sidecar.repository override and any registry mirror that copies from ghcr.io/nokia
  • Repository and Go module. The repository is now https://github.com/nokia-steward/ncm-issuer and links to github.com/nokia/ncm-issuer redirect there. The Go module path is now github.com/nokia-steward/ncm-issuer, so Go code that imports api/v1 has to update its import paths

Bug fixes and improvements

  • Added support for Kubernetes 1.37 (supported versions: 1.26 - 1.37). The chart's kubeVersion constraint now admits 1.37 clusters. cert-manager itself does not list 1.37 as supported yet. cert-manager 1.21 covers Kubernetes 1.33 - 1.36
  • Updated go.mod dependencies: Kubernetes API to 0.37, controller-runtime to 0.25.2, cert-manager to 1.21.2

Other changes

  • Releases now carry signed build provenance, a CycloneDX SBOM, source archives and SHA-256 checksums. Both container images have a provenance attestation in GHCR that gh attestation verify oci://ghcr.io/nokia-steward/ncm-issuer:1.3.0 --repo nokia-steward/ncm-issuer checks. ncm-issuer-1.3.0.intoto.jsonl covers every file attached to the release. Verifying images and release assets lists the assets and how to verify them
  • End to end tests now run against cert-manager 1.21 and 1.20, with 1.19 kept as the most recently retired line and 1.18 dropped. A Kubernetes 1.37 test is in place and starts running once microk8s publishes a 1.37 release. These are pipeline changes and do not alter the released controller