helm: release v0.13.0

terinjokes · terinjokes · commit 0ef6c07ca61d · 2025-10-25T13:00:09.000+02:00
diff --git a/deploy/charts/origin-ca-issuer/Chart.yaml b/deploy/charts/origin-ca-issuer/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 type: application
 name: origin-ca-issuer
-version: 0.5.12
-appVersion: 0.12.1
+version: 0.6.0
+appVersion: 0.13.0
 description: A Helm chart for origin-ca-issuer
 home: https://github.com/cloudflare/origin-ca-issuer
 maintainers:
diff --git a/deploy/charts/origin-ca-issuer/README.md b/deploy/charts/origin-ca-issuer/README.md
@@ -12,7 +12,7 @@ origin-ca-issuer is a Kubernetes addon to automate issuance and renewals of Clou
 Before installing the chart, you must first install [cert-manager](https://cert-manager.io/docs/installation/), and the origin-ca-issuer CustomResourceDefinition resources.
 
 ```shell
-VERSION="v0.12.1"
+VERSION="v0.13.0"
 kubectl apply -f https://raw.githubusercontent.com/cloudflare/origin-ca-issuer/${VERSION}/deploy/crds/cert-manager.k8s.cloudflare.com_originissuers.yaml
 ```
 
diff --git a/deploy/charts/origin-ca-issuer/templates/issuer-clusterrole.yaml b/deploy/charts/origin-ca-issuer/templates/issuer-clusterrole.yaml
@@ -19,16 +19,26 @@ rules:
     verbs: ["get", "list", "watch"]
   - apiGroups: ["cert-manager.io"]
     resources: ["certificaterequests"]
-    verbs: ["get", "list", "update", "watch"]
+    verbs: ["get", "list", "watch"]
   - apiGroups: ["cert-manager.io"]
     resources: ["certificaterequests/status"]
-    verbs: ["get", "patch", "update"]
+    verbs: ["patch"]
   - apiGroups: ["cert-manager.k8s.cloudflare.com"]
     resources: ["originissuers", "clusteroriginissuers"]
-    verbs: ["create", "get", "list", "watch"]
+    verbs: ["get", "list", "watch"]
   - apiGroups: ["cert-manager.k8s.cloudflare.com"]
     resources: ["originissuers/status", "clusteroriginissuers/status"]
-    verbs: ["get", "patch", "update"]
+    verbs: ["patch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["certificatesigningrequests/status"]
+    verbs: ["patch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["clusteroriginissuers.cert-manager.k8s.cloudflare.com/*", "originissuers.cert-manager.k8s.cloudflare.com/*"]
+    verbs: ["sign"]
 ---
 # permissions to approve all cert-manager.k8s.cloudflare.com requests
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/deploy/charts/origin-ca-issuer/values.yaml b/deploy/charts/origin-ca-issuer/values.yaml
@@ -18,7 +18,7 @@ global:
 controller:
   image:
     repository: cloudflare/origin-ca-issuer
-    tag: v0.12.1
+    tag: v0.13.0
     pullPolicy: Always
 
   replicaCount: 1
