Fix flaws in ClusterBundle API by erikgb · Pull Request #927 · cert-manager/trust-manager

erikgb · 2026-04-05T13:43:15Z

This PR fixes some minor flaws in the new ClusterBundle API noted by Copilot in #702.

Signed-off-by: Erik Godding Boye <egboye@gmail.com>

Copilot

Pull request overview

This PR corrects minor API/CRD flaws in the ClusterBundle v1alpha2 surface area introduced during the Bundle → ClusterBundle migration, aligning generated docs and kubectl output with the current schema (notably the defaultCAs/multi-key target model).

Changes:

Remove kubebuilder:printcolumn / CRD printer columns that referenced non-existent .spec.target.{configMap,secret}.key fields (targets now use data[]).
Update status.defaultCAVersion field documentation to reference spec.defaultCAs (replacing the outdated spec.includeDefaultCAs wording).
Regenerate/align corresponding applyconfiguration and CRD schema descriptions.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/applyconfigurations/trustmanager/v1alpha2/bundlestatus.go	Updates `defaultCAVersion` docstring to match the `spec.defaultCAs` API.
pkg/apis/trustmanager/v1alpha2/types_cluster_bundle.go	Removes invalid printer columns and fixes `defaultCAVersion` documentation reference.
deploy/crds/trust-manager.io_clusterbundles.yaml	Removes invalid additionalPrinterColumns and updates the OpenAPI description for `defaultCAVersion`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

erikgb · 2026-04-05T13:54:59Z

/cc @SgtCoDFish

SgtCoDFish

/lgtm
/approve

👍

cert-manager-prow · 2026-04-07T08:52:32Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: SgtCoDFish

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [SgtCoDFish]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…0.22.0 → v0.22.1) (#204) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/trust-manager](https://cert-manager.io/docs/trust/trust-manager) ([source](https://github.com/cert-manager/trust-manager)) | patch | `v0.22.0` → `v0.22.1` | --- ### Release Notes <details> <summary>cert-manager/trust-manager (quay.io/jetstack/charts/trust-manager)</summary> ### [`v0.22.1`](https://github.com/cert-manager/trust-manager/releases/tag/v0.22.1) [Compare Source](cert-manager/trust-manager@v0.22.1...v0.22.1) trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters. This release is a patch release, bumping dependencies, Go version, and base images to address vulnerabilities reported by scanners. The release also contains various non-user-facing changes, preparing for the migration from `Bundle` to `ClusterBundle`. ##### What's Changed - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#909](cert-manager/trust-manager#909) - fix(deps): update kubernetes go patches to v0.35.3 by [@renovate](https://github.com/renovate)\[bot] in [#911](cert-manager/trust-manager#911) - fix gosec G122 by [@inteon](https://github.com/inteon) in [#914](cert-manager/trust-manager#914) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#910](cert-manager/trust-manager#910) - fix: remove trailing dash in certificate.yaml template conditional by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#916](cert-manager/trust-manager#916) - Run trust-bundle test in CI by [@inteon](https://github.com/inteon) in [#915](cert-manager/trust-manager#915) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#917](cert-manager/trust-manager#917) - chore(deps): update actions/setup-go action to v6.4.0 by [@renovate](https://github.com/renovate)\[bot] in [#919](cert-manager/trust-manager#919) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#922](cert-manager/trust-manager#922) - chore(deps): update docker/login-action action to v4.1.0 by [@renovate](https://github.com/renovate)\[bot] in [#925](cert-manager/trust-manager#925) - Introduce KAL optional fields checks by [@erikgb](https://github.com/erikgb) in [#871](cert-manager/trust-manager#871) - Finalize initial KAL config by [@erikgb](https://github.com/erikgb) in [#926](cert-manager/trust-manager#926) - Make Renovate suggest KAL upgrades by [@erikgb](https://github.com/erikgb) in [#924](cert-manager/trust-manager#924) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#929](cert-manager/trust-manager#929) - Make Renovate suggest KAL upgrades (take 2) by [@erikgb](https://github.com/erikgb) in [#928](cert-manager/trust-manager#928) - Fix flaws in ClusterBundle API by [@erikgb](https://github.com/erikgb) in [#927](cert-manager/trust-manager#927) - Remove misleading Helm chart annotation by [@erikgb](https://github.com/erikgb) in [#930](cert-manager/trust-manager#930) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#931](cert-manager/trust-manager#931) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#932](cert-manager/trust-manager#932) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#935](cert-manager/trust-manager#935) - fix(deps): update module software.sslmate.com/src/go-pkcs12 to v0.7.1 by [@renovate](https://github.com/renovate)\[bot] in [#933](cert-manager/trust-manager#933) - chore(deps): update actions/github-script action to v9 by [@renovate](https://github.com/renovate)\[bot] in [#934](cert-manager/trust-manager#934) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#936](cert-manager/trust-manager#936) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#938](cert-manager/trust-manager#938) - Bump trust packages to force rebuild with go 1.26.2 by [@erikgb](https://github.com/erikgb) in [#937](cert-manager/trust-manager#937) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#939](cert-manager/trust-manager#939) - fix(deps): update module sigs.k8s.io/structured-merge-diff/v6 to v6.4.0 by [@renovate](https://github.com/renovate)\[bot] in [#940](cert-manager/trust-manager#940) - fix(deps): update kubernetes go patches to v0.35.4 by [@renovate](https://github.com/renovate)\[bot] in [#941](cert-manager/trust-manager#941) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#942](cert-manager/trust-manager#942) ##### New Contributors - [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) made their first contribution in [#916](cert-manager/trust-manager#916) **Full Changelog**: <cert-manager/trust-manager@v0.22.0...v0.22.1> ### [`v0.22.1`](https://github.com/cert-manager/trust-manager/releases/tag/v0.22.1) [Compare Source](cert-manager/trust-manager@v0.22.0...v0.22.1) trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters. This release is a patch release, bumping dependencies, Go version, and base images to address vulnerabilities reported by scanners. The release also contains various non-user-facing changes, preparing for the migration from `Bundle` to `ClusterBundle`. ##### What's Changed - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#909](cert-manager/trust-manager#909) - fix(deps): update kubernetes go patches to v0.35.3 by [@renovate](https://github.com/renovate)\[bot] in [#911](cert-manager/trust-manager#911) - fix gosec G122 by [@inteon](https://github.com/inteon) in [#914](cert-manager/trust-manager#914) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#910](cert-manager/trust-manager#910) - fix: remove trailing dash in certificate.yaml template conditional by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#916](cert-manager/trust-manager#916) - Run trust-bundle test in CI by [@inteon](https://github.com/inteon) in [#915](cert-manager/trust-manager#915) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#917](cert-manager/trust-manager#917) - chore(deps): update actions/setup-go action to v6.4.0 by [@renovate](https://github.com/renovate)\[bot] in [#919](cert-manager/trust-manager#919) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#922](cert-manager/trust-manager#922) - chore(deps): update docker/login-action action to v4.1.0 by [@renovate](https://github.com/renovate)\[bot] in [#925](cert-manager/trust-manager#925) - Introduce KAL optional fields checks by [@erikgb](https://github.com/erikgb) in [#871](cert-manager/trust-manager#871) - Finalize initial KAL config by [@erikgb](https://github.com/erikgb) in [#926](cert-manager/trust-manager#926) - Make Renovate suggest KAL upgrades by [@erikgb](https://github.com/erikgb) in [#924](cert-manager/trust-manager#924) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#929](cert-manager/trust-manager#929) - Make Renovate suggest KAL upgrades (take 2) by [@erikgb](https://github.com/erikgb) in [#928](cert-manager/trust-manager#928) - Fix flaws in ClusterBundle API by [@erikgb](https://github.com/erikgb) in [#927](cert-manager/trust-manager#927) - Remove misleading Helm chart annotation by [@erikgb](https://github.com/erikgb) in [#930](cert-manager/trust-manager#930) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#931](cert-manager/trust-manager#931) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#932](cert-manager/trust-manager#932) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#935](cert-manager/trust-manager#935) - fix(deps): update module software.sslmate.com/src/go-pkcs12 to v0.7.1 by [@renovate](https://github.com/renovate)\[bot] in [#933](cert-manager/trust-manager#933) - chore(deps): update actions/github-script action to v9 by [@renovate](https://github.com/renovate)\[bot] in [#934](cert-manager/trust-manager#934) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#936](cert-manager/trust-manager#936) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#938](cert-manager/trust-manager#938) - Bump trust packages to force rebuild with go 1.26.2 by [@erikgb](https://github.com/erikgb) in [#937](cert-manager/trust-manager#937) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#939](cert-manager/trust-manager#939) - fix(deps): update module sigs.k8s.io/structured-merge-diff/v6 to v6.4.0 by [@renovate](https://github.com/renovate)\[bot] in [#940](cert-manager/trust-manager#940) - fix(deps): update kubernetes go patches to v0.35.4 by [@renovate](https://github.com/renovate)\[bot] in [#941](cert-manager/trust-manager#941) - \[CI] Merge self-upgrade-main into main by [@octo-sts](https://github.com/octo-sts)\[bot] in [#942](cert-manager/trust-manager#942) ##### New Contributors - [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) made their first contribution in [#916](cert-manager/trust-manager#916) **Full Changelog**: <cert-manager/trust-manager@v0.22.0...v0.22.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/204

Fix flaws in ClusterBundle API

5c6a79c

Signed-off-by: Erik Godding Boye <egboye@gmail.com>

erikgb requested a review from Copilot April 5, 2026 13:43

cert-manager-prow Bot added dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Apr 5, 2026

Copilot started reviewing on behalf of erikgb April 5, 2026 13:43 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

cert-manager-prow Bot requested a review from SgtCoDFish April 5, 2026 13:55

erikgb mentioned this pull request Apr 5, 2026

User-facing migration to ClusterBundle #702

Open

SgtCoDFish approved these changes Apr 7, 2026

View reviewed changes

cert-manager-prow Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 7, 2026

cert-manager-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 7, 2026

cert-manager-prow Bot merged commit 21824c2 into cert-manager:main Apr 7, 2026
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix flaws in ClusterBundle API#927

Fix flaws in ClusterBundle API#927
cert-manager-prow[bot] merged 1 commit into
cert-manager:mainfrom
erikgb:fix-clusterbundle-api-flaws

erikgb commented Apr 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

erikgb commented Apr 5, 2026

Uh oh!

SgtCoDFish left a comment

Uh oh!

cert-manager-prow Bot commented Apr 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

erikgb commented Apr 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

erikgb commented Apr 5, 2026

Uh oh!

SgtCoDFish left a comment

Choose a reason for hiding this comment

Uh oh!

cert-manager-prow Bot commented Apr 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants