google-cas-issuer enables issuing X.509 certificates using Google CA Service
Important
The Google CAS Issuer project is currently in maintenance mode. We will continue to provide support for bug fixes and security updates, but no new major features are planned. We are looking for maintainers/ partners (eg. the Google CAS team) to continue the development of this project and take some of the maintainership responsibilities. If you are interested, please reach out to us on the cert-manager-dev Slack via @cert-manager-maintainers.
This release removes trust in the compromised eMudhra CAs. It also adds optional fallback CA pools. Please upgrade from v0.13.0, which trusts the compromised CAs.
eMudhra CA compromise
- google-cas-issuer is built with Go 1.27.3. It distrusts the compromised intermediates (CVE-2026-111943). v0.13.0 was built with Go 1.27.1.
- The image uses the latest base image. Its CA bundle no longer contains the compromised roots, emSign ECC Root CA - G3 and AAA Certificate Services.
Fallback CA pools
GoogleCASIssuer and GoogleCASClusterIssuer have a new optional field, spec.fallbacks. It takes an ordered list of CA pools. If the primary pool fails to issue a certificate, the issuer tries each fallback pool in turn. If you do not set spec.fallbacks, nothing changes. The CRDs in the chart include the new field, so upgrade the CRDs along with the controller. See the README for details.
Dependencies
This release ships cert-manager v1.21.3, issuer-lib v0.12.1, Kubernetes v0.37.2, controller-runtime v0.25.2 and google.golang.org/api v0.310.0.
Trivy reports one finding against the binary: GO-2026-5932, golang.org/x/crypto/openpgp is unmaintained. google-cas-issuer does not import that package, and govulncheck reports no reachable vulnerabilities. There is no tagged golang.org/x/crypto release with a fix yet.
Thanks to @sshcherbakov and @selvjith for the fallback CA pool feature.
What's Changed
- chore(deps): update makefile modules to 2215aaf by @renovate[bot] in #620
- fix(deps): update github.com/onsi deps by @renovate[bot] in #621
- chore(deps): update makefile modules to 4277ca6 by @renovate[bot] in #622
- fix(deps): update module google.golang.org/api to v0.299.0 by @renovate[bot] in #623
- chore(deps): update makefile modules to aee0ddc by @renovate[bot] in #624
- fix(deps): update kubernetes go patches to v0.37.1 by @renovate[bot] in #625
- chore(deps): update makefile modules to edc0ae9 by @renovate[bot] in #626
- fix(deps): update module github.com/onsi/gomega to v1.44.0 by @renovate[bot] in #628
- chore(deps): update makefile modules to 9096105 by @renovate[bot] in #629
- fix(deps): update module cloud.google.com/go/security to v1.28.0 by @renovate[bot] in #627
- chore(deps): update makefile modules to a4c0442 by @renovate[bot] in #631
- chore(deps): update makefile modules to c153741 by @renovate[bot] in #632
- chore(deps): update makefile modules to f2fb9c3 by @renovate[bot] in #633
- fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.2 by @renovate[bot] in #634
- fix(deps): update module google.golang.org/api to v0.300.0 by @renovate[bot] in #635
- chore(deps): update makefile modules to 2a76aa9 by @renovate[bot] in #636
- chore(deps): update makefile modules to 82d2ae9 by @renovate[bot] in #639
- chore(deps): update makefile modules to 95c9211 by @renovate[bot] in #640
- chore(deps): update module golang.org/x/net to v0.60.0 [security] by @renovate[bot] in #642
- chore(deps): update makefile modules to 652e787 by @renovate[bot] in #643
- chore(deps): update actions/upload-artifact action to v7.0.2 by @renovate[bot] in #644
- fix(deps): update module google.golang.org/api to v0.301.0 by @renovate[bot] in #645
- chore(deps): update makefile modules to 6a3c937 by @renovate[bot] in #646
- chore(deps): update makefile modules to 9af7929 by @renovate[bot] in #647
- fix(deps): update module github.com/onsi/ginkgo/v2 to v2.33.1 by @renovate[bot] in #648
- chore(deps): update makefile modules to 9c357fd by @renovate[bot] in #650
- fix(deps): update module google.golang.org/api to v0.305.0 by @renovate[bot] in #649
- fix(deps): update module github.com/cert-manager/cert-manager to v1.21.3 by @renovate[bot] in #652
- fix(deps): update module google.golang.org/api to v0.307.0 by @renovate[bot] in #651
- fix(deps): update module google.golang.org/api to v0.308.0 by @renovate[bot] in #653
- fix(deps): update module cloud.google.com/go/security to v1.29.0 by @renovate[bot] in #654
- chore(deps): update docker/login-action action to v4.7.0 by @renovate[bot] in #655
- chore(deps): update makefile modules to 2bbe78f by @renovate[bot] in #656
- chore(deps): update module golang.org/x/net to v0.62.0 [security] by @renovate[bot] in #657
- feat: add fallback CA pool failover support for high availability by @sshcherbakov in #641
- fix(deps): update kubernetes go patches to v0.37.2 by @renovate[bot] in #660
- fix(deps): update module k8s.io/cli-runtime to v0.37.2 by @renovate[bot] in #661
- fix(deps): update module google.golang.org/api to v0.310.0 by @renovate[bot] in #658
- fix(deps): update misc go deps by @renovate[bot] in #659
- chore(deps): update makefile modules to a120e6b by @renovate[bot] in #662
New Contributors
- @sshcherbakov made their first contribution in #641
Full Changelog: v0.13.0...v0.14.0