istio-csr integrates cert-manager into Istio, allowing you to issue workload certificates using the power of cert-manager.
This release removes trust in the compromised eMudhra intermediate CAs. See https://emudhra.we-have-a-problem.com/ and https://cert-manager.io/docs/trust/trust-manager/#emudhra-compromise. We recommend that everyone upgrades.
- The image is built on a new base image whose system trust store no longer contains emSign ECC Root CA - G3. It rejects all 14 test chains published at https://emudhra.we-have-a-problem.com/. v0.18.0 accepts 7 of them.
- The binary is built with Go 1.27.3, which distrusts the compromised intermediates (CVE-2026-111943). v0.18.0 was built with Go 1.27.1.
There is no v0.19.0 release. We pushed the v0.19.0 tag, but the release workflow failed before publishing anything (#959). v0.19.1 is the same code.
A trivy scan of the release image reports no fixable vulnerabilities, apart from five false positives in istio.io/istio. trivy reports those because istio-csr depends on a pseudo-version of Istio (v0.0.0-20260528…), which it compares as older than the fixed 1.x versions. Tracking issue: #958.
It also fixes the Helm chart's handling of app.certmanager.additionalAnnotations, so annotation values that contain commas or JSON are now passed to istio-csr correctly (#637).
What's Changed
- chore(deps): update makefile modules to 2215aaf by @renovate[bot] in #929
- fix(deps): update github.com/onsi deps by @renovate[bot] in #930
- fix(deps): update misc go deps by @renovate[bot] in #931
- chore(deps): update makefile modules to 4277ca6 by @renovate[bot] in #932
- fix(deps): update kubernetes go patches to v0.37.1 by @renovate[bot] in #934
- chore(deps): update makefile modules to edc0ae9 by @renovate[bot] in #933
- fix(deps): update module github.com/onsi/gomega to v1.44.0 by @renovate[bot] in #935
- chore(deps): update makefile modules to 9096105 by @renovate[bot] in #936
- chore(deps): update makefile modules to c153741 by @renovate[bot] in #937
- Fix/chartadditional annotations for cli args by @jrhoward in #637
- fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.2 by @renovate[bot] in #939
- chore(deps): update makefile modules to f2fb9c3 by @renovate[bot] in #938
- chore(deps): update makefile modules to 2a76aa9 by @renovate[bot] in #940
- chore(deps): update makefile modules to 82d2ae9 by @renovate[bot] in #941
- chore(deps): update makefile modules to 652e787 by @renovate[bot] in #942
- fix(deps): update module github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus to v1.1.1 by @renovate[bot] in #944
- chore(deps): update module golang.org/x/net to v0.60.0 [security] by @renovate[bot] in #943
- fix(deps): update module github.com/prometheus/client_golang to v1.25.0 by @renovate[bot] in #945
- chore(deps): update makefile modules to 9af7929 by @renovate[bot] in #946
- fix(deps): update module github.com/onsi/ginkgo/v2 to v2.33.1 by @renovate[bot] in #947
- chore(deps): update makefile modules to c346b99 by @renovate[bot] in #950
- chore(deps): update makefile modules to 9c357fd by @renovate[bot] in #952
- fix(deps): update module istio.io/api to v1.31.2 by @renovate[bot] in #948
- fix(deps): update module github.com/cert-manager/cert-manager to v1.21.3 by @renovate[bot] in #954
- chore(deps): update docker/login-action action to v4.7.0 by @renovate[bot] in #956
- fix(deps): update module istio.io/api to v1.31.3 by @renovate[bot] in #955
- chore(deps): update makefile modules to 2bbe78f by @renovate[bot] in #957
- Keep release build temp files off the size-limited /tmp by @wallrj-cyberark in #959
New Contributors
- @wallrj-cyberark made their first contribution in #959
Full Changelog: v0.18.0...v0.19.1