build(deps): bump github.com/cert-manager/cert-manager from 1.10.1 to 1.11.0

[dependabot]

Bumps github.com/cert-manager/cert-manager from 1.10.1 to 1.11.0.

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.11.0-beta.1

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

⚠️ cert-manager v1.11.0-beta.1 is a pre-release beta version intended for testing. It might not be suitable for production uses.

Thanks also to @​wallrj, @​lucacome and @​inteon for their help/contributions to this release!

Changes since v1.11.0-beta.0

Bug or Regression

• Ensure extraArgs in Helm takes precedence over the new acmesolver image options (#5702, @​SgtCoDFish)
• Fix cainjector's --namespace flag. Users who want to prevent cainjector from reading all Secrets and Certificates in all namespaces (i.e to prevent excessive memory consumption) can now scope it to a single namespace using the --namespace flag. A cainjector that is only used as part of cert-manager installation only needs access to the cert-manager installation namespace. (#5694, @​irbekrm)
• Fixes a bug where cert-manager controller was caching all Secrets twice (#5691, @​irbekrm)

Other

• certificate.spec.secretName Secrets will now be labelled with controller.cert-manager.io/fao label (#5703, @​irbekrm)

v1.11.0-beta.0

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

⚠️ cert-manager v1.11.0-beta.0 is a pre-release beta version intended for testing. It might not be suitable for production uses.

Changes since v1.11.0-alpha.2

Feature

• Helm: allow configuring the image used by ACME HTTP-01 solver (#5554, @​yann-soubeyrand)

Bug or Regression

• Don't log errors relating to selfsigned issuer checks for external issuers (#5681, @​SgtCoDFish)
• Fixed a bug in AzureDNS resolver that led to early reconciliations in misconfigured Workload Identity-enabled setups (when Federated Identity Credential is not linked with a controller's k8s service account) (#5663, @​weisdd)
• Use manually specified tmpdir template when verifying CRDs (#5680, @​SgtCoDFish)
• VCert was upgraded to v4.23.0, fixing two bugs in cert-manager. The first bug was preventing the Venafi issuer from renewing certificates when using TPP has been fixed. You should no longer see your certificates getting stuck with "WebSDK CertRequest Module Requested Certificate" or "This certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.". The second bug that was fixed prevented the use of algorithm: Ed25519 in Certificate resources with VaaS. (#5674, @​maelvls)

v1.11.0-alpha.2

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

⚠️ cert-manager v1.11.0-alpha.2 is a pre-release alpha version intended for testing. It might not be suitable for production uses.

Changes since v1.11.0-alpha.1

Feature

• Add the --max-concurrent-challenges controller flag to the helm chart (#5638, @​lvyanru8200)
• Adds the ability to specify a custom CA bundle in Issuers when connecting to an ACME server (#5644, @​SgtCoDFish)
• Enable testing against Kubernetes 1.26 and test with Kubernetes 1.26 by default (#5646, @​SgtCoDFish)
• Experimental make targets for pushing images to an OCI registry using ko and redeploying cert-manager to the cluster referenced by your current KUBECONFIG context. (#5655, @​wallrj)

... (truncated)

Commits

• 2a0ef53 Merge pull request #5714 from jetstack-bot/cherry-pick-5712-to-release-1.11
• 5660024 Bump go to 1.19.5
• 5cb22cc Merge pull request #5707 from SgtCoDFish/release-1.11-bumpcontainerd
• 40858c2 Bump containerd to fix reported vuln
• 0a3b52f bump base images to latest
• 6a848de Merge pull request #5703 from jetstack-bot/cherry-pick-5660-to-release-1.11
• d3fbe40 Policy check ensures that cert.sepc.secretName secret gets labelled
• 568b646 Keymanager controller ensures that temporary private key Secrets are labelled
• bbca506 Issuing controller ensures that cert.spec.secretName secrets are labelled
• 5a66ed8 Adds a new label to cert-manager API
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[k8s-ci-robot]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[k8s-ci-robot]

@dependabot[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-security-profiles-operator-test-unit	7b7bcc6	link	true	/test pull-security-profiles-operator-test-unit
pull-security-profiles-operator-test-e2e	7b7bcc6	link	true	/test pull-security-profiles-operator-test-e2e
pull-security-profiles-operator-build	7b7bcc6	link	true	/test pull-security-profiles-operator-build
pull-security-profiles-operator-verify	7b7bcc6	link	true	/test pull-security-profiles-operator-verify
pull-security-profiles-operator-build-image	7b7bcc6	link	true	/test pull-security-profiles-operator-build-image

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[saschagrunert]

Part of #1414

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.