You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If you are familiar with the sister project cert-manager you might well expect to see a `ClusterBundle`, based on the existing usage of `Issuer` being namespaced and `ClusterIssuer` being clusterscoped.
27
+
If you are familiar with the sister project cert-manager you might well expect to see a `ClusterBundle`, based on the existing usage of `Issuer` being namespaced and `ClusterIssuer` being cluster-scoped.
28
28
29
29
```sh
30
30
NAME SHORTNAMES APIVERSION NAMESPACED KIND
@@ -39,17 +39,17 @@ This may be confusing to new trust-manager users or at least feels a little inco
39
39
40
40
Simply put, trust-manager is moving to using a `ClusterBundle` by default.
41
41
This more accurately reflects the scope of the current `Bundle` resource.
42
-
Similarly this more closely ties with the Kubernetes native `ClusterTrustBundle` resource, which also acts as a cluster-level resource.
42
+
This more closely ties with the Kubernetes native `ClusterTrustBundle` resource, which also acts as a cluster-level resource.
43
43
More details on this can be [found here](https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#cluster-trust-bundles).
44
44
45
-
For trust-manager users this means:
45
+
For trust-manager users, this means:
46
46
47
-
1) Deprecating and ultimately removing `Bundle` resource and the API group `trust.cert-manager.io/v1alpha1`.
47
+
1) Deprecating and ultimately removing the `Bundle` resource and the API group `trust.cert-manager.io/v1alpha1`.
48
48
1) Creating `ClusterBundle` in the API group `trust-manager.io/v1alpha2` as the new default.
49
49
50
50
Checkout [API Changes](#api-changes) for more details on what this means.
51
51
52
-
Eventually you will see something like this after installing trust-manager and listing `api-resource`:
52
+
Eventually, you will see something like this after installing trust-manager and listing `api-resource`:
In the API change there are two key elements to consider:
113
+
In the API change, there are two key elements to consider:
114
114
115
115
1) The API group is changing from `trust.cert-manager.io` to `trust-manager.io`.
116
116
1) The API version is going from `v1alpha1` to `v1alpha2`.
117
117
118
-
The changing of the group `trust.cert-manager.io` to `trust-manager.io` is a shortening of the overall URL but also reflects the general move towards trust-manager being a completely independent project to cert-manager.
118
+
The changing of the group `trust.cert-manager.io` to `trust-manager.io` is a shortening of the overall URL, but also reflects the general move towards trust-manager being a completely independent project to cert-manager.
119
119
While both projects are maintained by the same set of awesome maintainers, we fundamentally believe that one project should be able to exist without the other, reducing the overall tooling you might need in your cluster.
120
-
A key part of making the projects independent is removing the need for webhooks and therefore certificates to secure that webhook communication.
120
+
A key part of making the projects independent is removing the need for webhooks, and therefore removing the certificates needed to secure that webhook communication.
121
121
Kubernetes advances in [Server Side Apply](https://kubernetes.io/docs/reference/using-api/server-side-apply/) (SSA) and [Common Expression Language](https://kubernetes.io/docs/reference/using-api/cel/)e (CEL) make it much easier to perform resource validation with the Kubernetes components, without having to hand that off to a webhook service to do the resource validation.
122
-
That's a different goal and we are not at that state of independence right now but look out for a future post exploring that topic.
122
+
That's a different goal, and we are not at that state of independence right now.
123
+
Look out for a future post exploring that topic.
123
124
124
125
The API version change has meaning worth considering too. It is still an `alpha` level resource!
125
126
This means that the resource specification could still change in a backwards incompatible way if there was a need.
126
-
In practice we likely will be much safer and considerate of any specification change.
127
+
In practice, we will likely be much safer and considerate of any specification change.
127
128
Just look at the effort the maintainers have gone to with this change alone, for an alpha level resource.
128
-
We all understand the frustration of things changing especially when we work with so many CRDs from many different projects.
129
+
We all understand the frustration of things changing, especially when we work with so many CRDs from many different projects.
129
130
That plays a big part in our mindset to try and make changes in a way that impact users as minimally as possible.
130
131
131
-
## Impact To You
132
+
## Impact On You
132
133
133
134
The migration of resources from old to new will be assisted by a new conversion controller.
134
135
@@ -156,13 +157,13 @@ Take this with a pinch of salt, but the current vision for trust-manager after `
156
157
157
158
## Getting Involved
158
159
159
-
cert-manager maintained projects really are open to all as CNCF projects.
160
+
cert-manager maintained projects are open to everyone as CNCF projects.
160
161
We welcome all feedback and contributions on the proposed `ClusterBundle` API and to our projects more generally.
161
162
162
163
### Help Needed
163
164
164
165
If you have the time, there is still a lot of work to get us to the future state where `ClusterBundle` is the default.
165
-
Things needed include but are not limited to:
166
+
Things needed include, but are not limited to:
166
167
167
168
- Website documentation updates
168
169
- Migration guidance
@@ -176,7 +177,7 @@ See our [website docs](../docs/contributing/README.md), or come join us on [slac
176
177
177
178
### References
178
179
179
-
To find out more about this change and others, here's some starting points:
180
+
To find out more about this change and others, here are some starting points:
180
181
181
182
- [Design document for `ClusterBundle` name change](https://github.com/cert-manager/trust-manager/blob/main/design/20241124-rename-bunde-to-clusterbundle.md)
182
183
- [A more technical implementation plan](https://github.com/cert-manager/trust-manager/issues/242)
@@ -186,4 +187,4 @@ To find out more about this change and others, here's some starting points:
186
187
We would like to thank two maintainers in particular for their substantial contributions to `ClusterBundles`:
187
188
188
189
- Firstly [Erik](https://github.com/erikgb) for being the driving force and contributor behind this change.
189
-
- And [Ashley](https://github.com/sgtcodfish) for reviewing, supporting and being the main point of contact on all things trust-manager related.
190
+
- And [Ashley](https://github.com/sgtcodfish) for reviewing, supporting, and being the main point of contact on all things trust-manager related.
0 commit comments