trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.
What's Changed
This release removes the compromised eMudhra roots from the default CA bundle. It also contains a chart fix and dependency bumps.
⚠️ The default CA bundle installed by the v0.25.0 chart trusts the compromised eMudhra CAs. If you use useDefaultCAs: true, upgrade to v0.26.0. See eMudhra compromise.
Thanks to all contributors! ❤️ 🚀
eMudhra CA compromise
- The default CA bundle no longer includes the compromised roots, emSign ECC Root CA - G3 and AAA Certificate Services. The v0.25.0 chart installs
trust-pkg-debian-trixie:20250419.2, which still contains both roots. If you cannot upgrade yet, setdefaultPackageImage.tagto20250419-deb13u1.0or later. - The trust package images are rebuilt, as
trust-pkg-debian-trixie:20250419-deb13u1.1andtrust-pkg-debian-bookworm:20250419-deb12u2.1, on the latest base image and Go 1.27.3. The older images were never exposed through their own trust store: they only copy the bundle to trust-manager and never make TLS connections. We rebuilt them so that vulnerability scanners report them clean. - trust-manager is built with Go 1.27.3, which distrusts the compromised intermediates (CVE-2026-111943). It also fixes the other Go standard library vulnerabilities that scanners report against v0.25.0.
- [CI] Merge trust-package-upgrade-debian-bookworm-main into main by @github-actions[bot] in #1134
- [CI] Merge trust-package-upgrade-debian-trixie-main into main by @github-actions[bot] in #1135
- Rebuild trust package images without the compromised eMudhra roots by @wallrj-cyberark in #1144
Fixes
- fix: merge commonLabels as a map to avoid duplicate label keys by @pgmpofu in #1111
- chart: document that authorizedSecrets cannot grant Secret creation by @kta1kri in #1110
Other
- fix(deps): update module github.com/onsi/ginkgo/v2 to v2.32.2 by @renovate[bot] in #1104
- chore(deps): update makefile modules to 56bbaca by @renovate[bot] in #1103
- chore(deps): update makefile modules to d983bab by @renovate[bot] in #1105
- chore(deps): update makefile modules to 91ea1cc by @renovate[bot] in #1106
- fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.1 by @renovate[bot] in #1107
- chore(deps): update makefile modules to 2215aaf by @renovate[bot] in #1108
- fix(deps): update github.com/onsi deps by @renovate[bot] in #1112
- chore(deps): update makefile modules to 4277ca6 by @renovate[bot] in #1113
- chore(deps): update makefile modules to aee0ddc by @renovate[bot] in #1114
- fix(deps): update kubernetes go patches to v0.37.1 by @renovate[bot] in #1116
- chore(deps): update makefile modules to edc0ae9 by @renovate[bot] in #1117
- fix(deps): update module github.com/onsi/gomega to v1.44.0 by @renovate[bot] in #1118
- chore(deps): update makefile modules to c153741 by @renovate[bot] in #1122
- chore(deps): update makefile modules to f2fb9c3 by @renovate[bot] in #1123
- fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.2 by @renovate[bot] in #1124
- chore(deps): update makefile modules to 2a76aa9 by @renovate[bot] in #1125
- chore(deps): update makefile modules to 82d2ae9 by @renovate[bot] in #1126
- chore(deps): update module golang.org/x/net to v0.60.0 [security] by @renovate[bot] in #1128
- chore(deps): update makefile modules to 652e787 by @renovate[bot] in #1127
- chore(deps): update makefile modules to 9af7929 by @renovate[bot] in #1129
- fix(deps): update module github.com/onsi/ginkgo/v2 to v2.33.1 by @renovate[bot] in #1130
- chore(deps): update makefile modules to c346b99 by @renovate[bot] in #1137
- chore(deps): update makefile modules to 7d4704c by @renovate[bot] in #1139
- fix(deps): update module software.sslmate.com/src/go-pkcs12 to v0.7.4 by @renovate[bot] in #1131
- chore(deps): update makefile modules to 9c357fd by @renovate[bot] in #1140
- chore(deps): update docker/login-action action to v4.7.0 by @renovate[bot] in #1141
- chore(deps): update makefile modules to 2bbe78f by @renovate[bot] in #1142
New Contributors
Full Changelog: v0.25.0...v0.26.0