cert-manager
Hard
Security
Since cert-manager v1.21.3, when will the issuing controller use the Secret named in a Certificate's status.nextPrivateKeySecretName?
Select your answer:
Show answer and explanation
Answer: Only when it has the next-private-key label and the Certificate owns it
Explanation
The requestmanager and issuing controllers now only consume that Secret if it carries the cert-manager.io/next-private-key label and is owned by the Certificate. This stops the controller from copying a private key out of a Secret the Certificate doesn't own. The keymanager always uses a generated name and records a NotOwned Warning event when the field names a Secret it doesn't own.
More hard cert-manager questions
- Which of the following is a valid way to revoke a certificate in cert-manager?
- Which of the following is a valid way to configure a Vault issuer?
- What is the purpose of the 'keystores' field in a Certificate resource?
- What is the purpose of the 'encodeUsagesInRequest' field in a Certificate resource?
- Which of the following is a valid way to debug a failing HTTP-01 challenge?
- Which of the following is a valid way to configure a DNS-01 challenge for a Route53 provider?