fix(keymanager): preserve expected secret when cleaning up duplicates by putongyong · Pull Request #8577 · cert-manager/cert-manager

putongyong · 2026-03-05T16:09:50Z

When multiple next private key secrets exist, preserve the secret that matches the certificate's status.nextPrivateKeySecretName field instead of deleting all secrets. This prevents unnecessary recreation of the expected secret and improves robustness when handling duplicate secrets.

Changes:

Update logic to identify and preserve the secret matching nextPrivateKeySecretName
Delete only duplicate secrets that don't match the expected name
Add comprehensive test cases covering various duplicate secret scenarios
Remove TODO comment as the behavior is now implemented

Fixes issue where the controller would delete the expected next private key secret along with duplicates, causing unnecessary regeneration.

Fixes #8514

Pull Request Motivation

Fixes issue where the controller would delete the expected next private key secret along with duplicates, causing unnecessary regeneration.

Fixes #8514

Kind

/kind

Release Note

Update logic to identify and preserve the secret matching nextPrivateKeySecretName

When multiple next private key secrets exist, preserve the secret that matches the certificate's status.nextPrivateKeySecretName field instead of deleting all secrets. This prevents unnecessary recreation of the expected secret and improves robustness when handling duplicate secrets. Changes: - Update logic to identify and preserve the secret matching nextPrivateKeySecretName - Delete only duplicate secrets that don't match the expected name - Add comprehensive test cases covering various duplicate secret scenarios - Remove TODO comment as the behavior is now implemented Fixes issue where the controller would delete the expected next private key secret along with duplicates, causing unnecessary regeneration. Fixes cert-manager#8514 Signed-off-by: putongyong <xieyong0226@gmail.com>

cert-manager-prow · 2026-03-05T16:09:54Z

@putongyong: The label(s) kind/release, kind/note cannot be applied, because the repository doesn't have them.

Details

In response to this:

When multiple next private key secrets exist, preserve the secret that matches the certificate's status.nextPrivateKeySecretName field instead of deleting all secrets. This prevents unnecessary recreation of the expected secret and improves robustness when handling duplicate secrets.

Changes:

Update logic to identify and preserve the secret matching nextPrivateKeySecretName

Delete only duplicate secrets that don't match the expected name

Add comprehensive test cases covering various duplicate secret scenarios

Remove TODO comment as the behavior is now implemented

Fixes issue where the controller would delete the expected next private key secret along with duplicates, causing unnecessary regeneration.

Fixes #8514

Pull Request Motivation

Fixes issue where the controller would delete the expected next private key secret along with duplicates, causing unnecessary regeneration.

Fixes #8514

Kind

/kind

Release Note
Update logic to identify and preserve the secret matching nextPrivateKeySecretName

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

cert-manager-prow · 2026-03-05T16:10:02Z

Hi @putongyong. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

putongyong · 2026-03-05T16:11:50Z

Closes #8539, replaces #8539 for issue #8514

putongyong · 2026-03-05T16:11:58Z

@ThatsMrTalbot

ThatsMrTalbot · 2026-03-05T19:06:30Z

-		// TODO: if nextPrivateKeySecretName is set, we should skip deleting that one Secret resource
-		log.V(logf.DebugLevel).Info("Cleaning up Secret resources as multiple nextPrivateKeySecretName candidates found")
-		return c.deleteSecretResources(ctx, secrets)
+		// if nextPrivateKeySecretName is set, we should skip deleting that one Secret resource


I think we can simplify this. If we change the deleteSecretResources signature from

deleteSecretResources(ctx context.Context, secrets []*corev1.Secret) error

to

deleteSecretResources(ctx context.Context, secrets []*corev1.Secret, skip... string) error

then have the implementation wrap the delete with a

if !slices.Contains(skip, s.Name)

We could pass ptr.Deref(crt.Status.NextPrivateKeySecretName, "") right in

Signed-off-by: putongyong <xieyong0226@gmail.com>

putongyong · 2026-03-06T09:51:35Z

@ThatsMrTalbot Thanks for the feedback! I've pushed a new commit for the changes.

I also noticed a potential simplification in keymanager. After this check, if ProcessItem doesn't return early, we're guaranteed to be working with a single secret (the preserved one).

Given that, we could let the following code operate directly on the object rather than iterating over a secrets list (there will actually be only one object inside the list).

Here is the code that can be simplified:

	secret := secrets[0] // ONLY ONE OBJECT WILL BE PRESERVED AFTER DELETION OF DUPLICATES
	log = logf.WithRelatedResource(log, secret)
	ctx = logf.NewContext(ctx, log)

	if crt.Status.NextPrivateKeySecretName == nil {
		log.V(logf.DebugLevel).Info("Adopting existing private key Secret")
		return c.setNextPrivateKeySecretName(ctx, crt, &secret.Name)
	}
	if *crt.Status.NextPrivateKeySecretName != secrets[0].Name {
		log.V(logf.DebugLevel).Info("Deleting existing private key secret as name does not match status.nextPrivateKeySecretName")
		return c.deleteSecretResources(ctx, secrets) // WE CAN NOW TARGET THE ONE AND ONLY SECRET
	}

	if secret.Data == nil || len(secret.Data[corev1.TLSPrivateKeyKey]) == 0 {
		log.V(logf.DebugLevel).Info("Deleting Secret resource as it contains no data")
		return c.deleteSecretResources(ctx, secrets) // WE CAN NOW TARGET THE ONE AND ONLY SECRET
	}
	pkData := secret.Data[corev1.TLSPrivateKeyKey]
	pk, err := pki.DecodePrivateKeyBytes(pkData)
	if err != nil {
		log.Error(err, "Deleting existing private key secret due to error decoding data")
		return c.deleteSecretResources(ctx, secrets) // WE CAN NOW TARGET THE ONE AND ONLY SECRET
	}

	violations := pki.PrivateKeyMatchesSpec(pk, crt.Spec)
	if len(violations) > 0 {
		log.V(logf.DebugLevel).Info("Regenerating private key due to change in fields", "violations", violations)
		c.recorder.Eventf(crt, corev1.EventTypeNormal, reasonDeleted, "Regenerating private key due to change in fields: %v", violations)
		return c.deleteSecretResources(ctx, secrets) // WE CAN NOW TARGET THE ONE AND ONLY SECRET
	}

Signed-off-by: putongyong <xieyong0226@gmail.com>

putongyong · 2026-03-06T11:25:17Z

Additionally, there is one logical issue that needs to be addressed:

if crt.Status.NextPrivateKeySecretName is not set and duplicate secrets exist, the key manager currently deletes all of them.

Should we instead preserve one of the secrets, skip its deletion, and assign its name to crt.Status.NextPrivateKeySecretName?

ThatsMrTalbot · 2026-03-06T23:06:31Z

+		skipSecretName := ""
 		if crt.Status.NextPrivateKeySecretName != nil {
-			var secretsToDelete []*corev1.Secret
-			var keepSecret *corev1.Secret
+			skipSecretName = *crt.Status.NextPrivateKeySecretName
+			log.V(logf.DebugLevel).Info("Preserving nextPrivateKeySecretName", "preserving", skipSecretName)
+		}


Sorry, I meant this utility function could be used

https://pkg.go.dev/k8s.io/utils/ptr#Deref

Suggested change

skipSecretName := ""

if crt.Status.NextPrivateKeySecretName != nil {

var secretsToDelete []*corev1.Secret

var keepSecret *corev1.Secret

skipSecretName = *crt.Status.NextPrivateKeySecretName

log.V(logf.DebugLevel).Info("Preserving nextPrivateKeySecretName", "preserving", skipSecretName)

}

skipSecretName := ptr.Deref(crt.Status.NextPrivateKeySecretName, "")

hi, thanks for that. Actually I have already implemented this with another commit. Check this one please : 3eb3311

ThatsMrTalbot · 2026-03-06T23:10:28Z

+			log.V(logf.DebugLevel).Info("Preserving nextPrivateKeySecretName", "preserving", skipSecretName)
+		}
+
+		if err := c.deleteSecretResources(ctx, secrets, skipSecretName); err != nil {


As opposed to changing all the logic below this, we can just return the result of deleteSecretResources. The delete of the secret should trigger a re-reconcile.

ok no problem. I will update this one.

@ThatsMrTalbot Oh but how should we handle this case: nextPrivateKeySecretName is set inside the certificate, but there are duplicate secrets sharing the same name? Since we're only checking whether the secret name contains nextPrivateKeySecretName, more than one secret could be retained. This would trigger an infinite loop — the key manager sees multiple secrets, but even after removing duplicates, more than one still remains.

I don't understand the question, in Kubernetes the name field is unique. You cant have multiple secrets in the same namespace with the same name.

Oh, never mind, I was wrong. I thought nextPrivateKeySecretName was the base name stripped of the index. For example, if nextPrivateKeySecretName was someSecretName, I thought the corresponding secrets would be someSecretName-123 or someSecretName-456. Since you suggested using if !slices.Contains(skip, s.Name), I assumed it was checking whether the secret name contained nextPrivateKeySecretName, which is why I thought nextPrivateKeySecretName was the stripped version.

Ah, no I just suggested slices.Contains because when you use variadic arguents it gives those arguments as a slice, so slices.Contains just means "is the secret name I am looking at in this slice of names I should skip".

Signed-off-by: putongyong <xieyong0226@gmail.com>

putongyong · 2026-03-09T09:45:33Z

@ThatsMrTalbot Hi Adam, pr updated, please check.

putongyong · 2026-03-12T10:28:34Z

@ThatsMrTalbot Hi Adam, can you check my latest change please ? Thanks

ThatsMrTalbot

Thanks for updating the PR!

This is looking really good, I only have one very minor comment.

ThatsMrTalbot · 2026-03-14T11:08:05Z

-		log.V(logf.DebugLevel).Info("Cleaning up Secret resources as multiple nextPrivateKeySecretName candidates found")
-		return c.deleteSecretResources(ctx, secrets)
+		// Delete all secrets, optionally skipping the one specified in nextPrivateKeySecretName
+		log.V(logf.DebugLevel).Info("Cleaning up duplicate Secret resources", "total_secrets", len(secrets))


Why are we changing the log line?, I think adding the total_secrets is fine, just unsure why the message is changed

Hi thanks for the review! Yes it was a small mistake. I updated the pr by putting back the log message with the total secrets. Please check.

Signed-off-by: putongyong <xieyong0226@gmail.com>

ThatsMrTalbot · 2026-03-14T15:09:23Z

/ok-to-test

ThatsMrTalbot · 2026-03-14T15:27:37Z

Our linter is failing because the k8s.io/utils/ptr dependency was added in the group containing the stdlib dependencies.

It needs to be grouped with the other k8s.io dependencies

Signed-off-by: putongyong <xieyong0226@gmail.com>

putongyong · 2026-03-14T17:43:50Z

Our linter is failing because the k8s.io/utils/ptr dependency was added in the group containing the stdlib dependencies.

It needs to be grouped with the other k8s.io dependencies

ok updated

ThatsMrTalbot · 2026-03-14T17:58:29Z

/label tide/merge-method-squash

ThatsMrTalbot · 2026-03-14T18:01:10Z

Thanks @putongyong! This now looks great.

/lgtm
/approve

cert-manager-prow · 2026-03-14T18:01:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ThatsMrTalbot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ThatsMrTalbot]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

putongyong · 2026-03-14T18:03:09Z

Thanks @putongyong! This now looks great.

/lgtm /approve

Thanks a lot for your help !

ThatsMrTalbot · 2026-03-14T18:11:52Z

/kind bug

wallrj-cyberark · 2026-07-01T08:38:04Z

@putongyong This change has been included in v1.21.0-beta.0, which is now published.

If you are able to install the beta and verify the nextPrivateKeySecretName preservation fix in your environment, that would be much appreciated. Thank you for the contribution.

…1.20.3 ➔ v1.21.0) (#1476) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.20.3` → `v1.21.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](cert-manager/cert-manager@v1.21.0...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](cert-manager/cert-manager#8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](cert-manager/cert-manager#8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](cert-manager/cert-manager#8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](cert-manager/cert-manager#8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](cert-manager/cert-manager#8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](cert-manager/cert-manager#8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](cert-manager/cert-manager#8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](cert-manager/cert-manager#8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](cert-manager/cert-manager#8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](cert-manager/cert-manager#8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](cert-manager/cert-manager#8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](cert-manager/cert-manager#8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](cert-manager/cert-manager#8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](cert-manager/cert-manager#8808), [#8779](cert-manager/cert-manager#8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [#8976](cert-manager/cert-manager#8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](cert-manager/cert-manager#8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](cert-manager/cert-manager#8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](cert-manager/cert-manager#8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](cert-manager/cert-manager#8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](cert-manager/cert-manager#8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](cert-manager/cert-manager#8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](cert-manager/cert-manager#8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](cert-manager/cert-manager#8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](cert-manager/cert-manager#8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](cert-manager/cert-manager#8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](cert-manager/cert-manager#8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](cert-manager/cert-manager#8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](cert-manager/cert-manager#8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](cert-manager/cert-manager#8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](cert-manager/cert-manager#8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](cert-manager/cert-manager#8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](cert-manager/cert-manager#8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](cert-manager/cert-manager#8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](cert-manager/cert-manager#8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](cert-manager/cert-manager#8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](cert-manager/cert-manager#8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](cert-manager/cert-manager#8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](cert-manager/cert-manager#8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](cert-manager/cert-manager#8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](cert-manager/cert-manager#8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](cert-manager/cert-manager#7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](cert-manager/cert-manager#8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](cert-manager/cert-manager#8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](cert-manager/cert-manager#8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](cert-manager/cert-manager#8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](cert-manager/cert-manager#8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](cert-manager/cert-manager#8808). ([#8843](cert-manager/cert-manager#8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](cert-manager/cert-manager#8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](cert-manager/cert-manager#8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](cert-manager/cert-manager#8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](cert-manager/cert-manager#8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](cert-manager/cert-manager#8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](cert-manager/cert-manager#8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](cert-manager/cert-manager#8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](cert-manager/cert-manager#8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](cert-manager/cert-manager#8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](cert-manager/cert-manager#8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](cert-manager/cert-manager#8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](cert-manager/cert-manager#8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](cert-manager/cert-manager#8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](cert-manager/cert-manager#8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](cert-manager/cert-manager#8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](cert-manager/cert-manager#8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](cert-manager/cert-manager#8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](cert-manager/cert-manager@v1.20.3...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](cert-manager/cert-manager#8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](cert-manager/cert-manager#8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](cert-manager/cert-manager#8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](cert-manager/cert-manager#8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](cert-manager/cert-manager#8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](cert-manager/cert-manager#8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](cert-manager/cert-manager#8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](cert-manager/cert-manager#8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](cert-manager/cert-manager#8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](cert-manager/cert-manager#8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](cert-manager/cert-manager#8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](cert-manager/cert-manager#8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](cert-manager/cert-manager#8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](cert-manager/cert-manager#8808), [#8779](cert-manager/cert-manager#8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [#8976](cert-manager/cert-manager#8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](cert-manager/cert-manager#8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](cert-manager/cert-manager#8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](cert-manager/cert-manager#8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](cert-manager/cert-manager#8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](cert-manager/cert-manager#8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](cert-manager/cert-manager#8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](cert-manager/cert-manager#8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](cert-manager/cert-manager#8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](cert-manager/cert-manager#8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](cert-manager/cert-manager#8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](cert-manager/cert-manager#8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](cert-manager/cert-manager#8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](cert-manager/cert-manager#8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](cert-manager/cert-manager#8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](cert-manager/cert-manager#8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](cert-manager/cert-manager#8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](cert-manager/cert-manager#8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](cert-manager/cert-manager#8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](cert-manager/cert-manager#8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](cert-manager/cert-manager#8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](cert-manager/cert-manager#8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](cert-manager/cert-manager#8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](cert-manager/cert-manager#8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](cert-manager/cert-manager#8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](cert-manager/cert-manager#8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](cert-manager/cert-manager#7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](cert-manager/cert-manager#8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](cert-manager/cert-manager#8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](cert-manager/cert-manager#8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](cert-manager/cert-manager#8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](cert-manager/cert-manager#8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](cert-manager/cert-manager#8808). ([#8843](cert-manager/cert-manager#8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](cert-manager/cert-manager#8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](cert-manager/cert-manager#8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](cert-manager/cert-manager#8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](cert-manager/cert-manager#8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](cert-manager/cert-manager#8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](cert-manager/cert-manager#8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](cert-manager/cert-manager#8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](cert-manager/cert-manager#8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](cert-manager/cert-manager#8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](cert-manager/cert-manager#8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](cert-manager/cert-manager#8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](cert-manager/cert-manager#8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](cert-manager/cert-manager#8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](cert-manager/cert-manager#8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](cert-manager/cert-manager#8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](cert-manager/cert-manager#8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](cert-manager/cert-manager#8849), [@ltwongaa](https://github.com/ltwongaa)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1476

…1.20.3 ➔ v1.21.0) (#273) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.20.3` → `v1.21.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](cert-manager/cert-manager@v1.21.0...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](cert-manager/cert-manager#8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](cert-manager/cert-manager#8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](cert-manager/cert-manager#8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](cert-manager/cert-manager#8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](cert-manager/cert-manager#8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](cert-manager/cert-manager#8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](cert-manager/cert-manager#8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](cert-manager/cert-manager#8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](cert-manager/cert-manager#8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](cert-manager/cert-manager#8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](cert-manager/cert-manager#8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](cert-manager/cert-manager#8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](cert-manager/cert-manager#8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](cert-manager/cert-manager#8808), [#8779](cert-manager/cert-manager#8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [#8976](cert-manager/cert-manager#8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](cert-manager/cert-manager#8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](cert-manager/cert-manager#8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](cert-manager/cert-manager#8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](cert-manager/cert-manager#8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](cert-manager/cert-manager#8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](cert-manager/cert-manager#8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](cert-manager/cert-manager#8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](cert-manager/cert-manager#8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](cert-manager/cert-manager#8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](cert-manager/cert-manager#8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](cert-manager/cert-manager#8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](cert-manager/cert-manager#8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](cert-manager/cert-manager#8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](cert-manager/cert-manager#8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](cert-manager/cert-manager#8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](cert-manager/cert-manager#8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](cert-manager/cert-manager#8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](cert-manager/cert-manager#8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](cert-manager/cert-manager#8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](cert-manager/cert-manager#8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](cert-manager/cert-manager#8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](cert-manager/cert-manager#8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](cert-manager/cert-manager#8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](cert-manager/cert-manager#8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](cert-manager/cert-manager#8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](cert-manager/cert-manager#7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](cert-manager/cert-manager#8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](cert-manager/cert-manager#8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](cert-manager/cert-manager#8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](cert-manager/cert-manager#8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](cert-manager/cert-manager#8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](cert-manager/cert-manager#8808). ([#8843](cert-manager/cert-manager#8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](cert-manager/cert-manager#8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](cert-manager/cert-manager#8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](cert-manager/cert-manager#8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](cert-manager/cert-manager#8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](cert-manager/cert-manager#8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](cert-manager/cert-manager#8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](cert-manager/cert-manager#8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](cert-manager/cert-manager#8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](cert-manager/cert-manager#8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](cert-manager/cert-manager#8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](cert-manager/cert-manager#8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](cert-manager/cert-manager#8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](cert-manager/cert-manager#8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](cert-manager/cert-manager#8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](cert-manager/cert-manager#8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](cert-manager/cert-manager#8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](cert-manager/cert-manager#8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](cert-manager/cert-manager@v1.20.3...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](cert-manager/cert-manager#8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](cert-manager/cert-manager#8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](cert-manager/cert-manager#8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](cert-manager/cert-manager#8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](cert-manager/cert-manager#8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](cert-manager/cert-manager#8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](cert-manager/cert-manager#8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](cert-manager/cert-manager#8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](cert-manager/cert-manager#8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](cert-manager/cert-manager#8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](cert-manager/cert-manager#8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](cert-manager/cert-manager#8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](cert-manager/cert-manager#8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](cert-manager/cert-manager#8808), [#8779](cert-manager/cert-manager#8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [#8976](cert-manager/cert-manager#8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](cert-manager/cert-manager#8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](cert-manager/cert-manager#8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](cert-manager/cert-manager#8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](cert-manager/cert-manager#8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](cert-manager/cert-manager#8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](cert-manager/cert-manager#8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](cert-manager/cert-manager#8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](cert-manager/cert-manager#8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](cert-manager/cert-manager#8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](cert-manager/cert-manager#8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](cert-manager/cert-manager#8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](cert-manager/cert-manager#8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](cert-manager/cert-manager#8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](cert-manager/cert-manager#8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](cert-manager/cert-manager#8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](cert-manager/cert-manager#8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](cert-manager/cert-manager#8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](cert-manager/cert-manager#8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](cert-manager/cert-manager#8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](cert-manager/cert-manager#8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](cert-manager/cert-manager#8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](cert-manager/cert-manager#8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](cert-manager/cert-manager#8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](cert-manager/cert-manager#8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](cert-manager/cert-manager#8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](cert-manager/cert-manager#7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](cert-manager/cert-manager#8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](cert-manager/cert-manager#8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](cert-manager/cert-manager#8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](cert-manager/cert-manager#8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](cert-manager/cert-manager#8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](cert-manager/cert-manager#8808). ([#8843](cert-manager/cert-manager#8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](cert-manager/cert-manager#8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](cert-manager/cert-manager#8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](cert-manager/cert-manager#8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](cert-manager/cert-manager#8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](cert-manager/cert-manager#8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](cert-manager/cert-manager#8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](cert-manager/cert-manager#8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](cert-manager/cert-manager#8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](cert-manager/cert-manager#8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](cert-manager/cert-manager#8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](cert-manager/cert-manager#8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](cert-manager/cert-manager#8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](cert-manager/cert-manager#8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](cert-manager/cert-manager#8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](cert-manager/cert-manager#8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](cert-manager/cert-manager#8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](cert-manager/cert-manager#8849), [@ltwongaa](https://github.com/ltwongaa)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.ajgon.casa/deedee/mark13/pulls/273

…1.20.3 ➔ v1.21.0) (#487) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.20.3` → `v1.21.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Known Issues - **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#8407](https://github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#8994](https://github.com/cert-manager/cert-manager/issues/8994) for details. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](https://github.com/cert-manager/cert-manager/issues/8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](https://github.com/cert-manager/cert-manager/issues/8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](https://github.com/cert-manager/cert-manager/issues/8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](https://github.com/cert-manager/cert-manager/issues/8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](https://github.com/cert-manager/cert-manager/issues/8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [#8779](https://github.com/cert-manager/cert-manager/issues/8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [#8976](https://github.com/cert-manager/cert-manager/issues/8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](https://github.com/cert-manager/cert-manager/issues/8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](https://github.com/cert-manager/cert-manager/issues/8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](https://github.com/cert-manager/cert-manager/issues/8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](https://github.com/cert-manager/cert-manager/issues/8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](https://github.com/cert-manager/cert-manager/issues/8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](https://github.com/cert-manager/cert-manager/issues/8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](https://github.com/cert-manager/cert-manager/issues/8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](https://github.com/cert-manager/cert-manager/issues/8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](https://github.com/cert-manager/cert-manager/issues/8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](https://github.com/cert-manager/cert-manager/issues/8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](https://github.com/cert-manager/cert-manager/issues/8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](https://github.com/cert-manager/cert-manager/issues/8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](https://github.com/cert-manager/cert-manager/issues/8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](https://github.com/cert-manager/cert-manager/issues/8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](https://github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](https://github.com/cert-manager/cert-manager/issues/8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](https://github.com/cert-manager/cert-manager/issues/8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](https://github.com/cert-manager/cert-manager/issues/8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](https://github.com/cert-manager/cert-manager/issues/8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](https://github.com/cert-manager/cert-manager/issues/8808). ([#8843](https://github.com/cert-manager/cert-manager/issues/8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](https://github.com/cert-manager/cert-manager/issues/8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](https://github.com/cert-manager/cert-manager/issues/8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](https://github.com/cert-manager/cert-manager/issues/8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](https://github.com/cert-manager/cert-manager/issues/8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](https://github.com/cert-manager/cert-manager/issues/8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](https://github.com/cert-manager/cert-manager/issues/8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](https://github.com/cert-manager/cert-manager/issues/8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](https://github.com/cert-manager/cert-manager/issues/8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](https://github.com/cert-manager/cert-manager/issues/8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](https://github.com/cert-manager/cert-manager/issues/8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](https://github.com/cert-manager/cert-manager/issues/8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](https://github.com/cert-manager/cert-manager/issues/8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](https://github.com/cert-manager/cert-manager/issues/8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](https://github.com/cert-manager/cert-manager/issues/8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.3...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Known Issues - **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#8407](https://github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#8994](https://github.com/cert-manager/cert-manager/issues/8994) for details. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](https://github.com/cert-manager/cert-manager/issues/8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](https://github.com/cert-manager/cert-manager/issues/8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](https://github.com/cert-manager/cert-manager/issues/8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](https://github.com/cert-manager/cert-manager/issues/8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](https://github.com/cert-manager/cert-manager/issues/8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [#8779](https://github.com/cert-manager/cert-manager/issues/8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [#8976](https://github.com/cert-manager/cert-manager/issues/8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](https://github.com/cert-manager/cert-manager/issues/8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](https://github.com/cert-manager/cert-manager/issues/8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](https://github.com/cert-manager/cert-manager/issues/8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](https://github.com/cert-manager/cert-manager/issues/8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](https://github.com/cert-manager/cert-manager/issues/8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](https://github.com/cert-manager/cert-manager/issues/8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](https://github.com/cert-manager/cert-manager/issues/8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](https://github.com/cert-manager/cert-manager/issues/8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](https://github.com/cert-manager/cert-manager/issues/8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](https://github.com/cert-manager/cert-manager/issues/8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](https://github.com/cert-manager/cert-manager/issues/8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](https://github.com/cert-manager/cert-manager/issues/8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](https://github.com/cert-manager/cert-manager/issues/8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](https://github.com/cert-manager/cert-manager/issues/8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](https://github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](https://github.com/cert-manager/cert-manager/issues/8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](https://github.com/cert-manager/cert-manager/issues/8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](https://github.com/cert-manager/cert-manager/issues/8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](https://github.com/cert-manager/cert-manager/issues/8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](https://github.com/cert-manager/cert-manager/issues/8808). ([#8843](https://github.com/cert-manager/cert-manager/issues/8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](https://github.com/cert-manager/cert-manager/issues/8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](https://github.com/cert-manager/cert-manager/issues/8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](https://github.com/cert-manager/cert-manager/issues/8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](https://github.com/cert-manager/cert-manager/issues/8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](https://github.com/cert-manager/cert-manager/issues/8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](https://github.com/cert-manager/cert-manager/issues/8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](https://github.com/cert-manager/cert-manager/issues/8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](https://github.com/cert-manager/cert-manager/issues/8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](https://github.com/cert-manager/cert-manager/issues/8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](https://github.com/cert-manager/cert-manager/issues/8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](https://github.com/cert-manager/cert-manager/issues/8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](https://github.com/cert-manager/cert-manager/issues/8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](https://github.com/cert-manager/cert-manager/issues/8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](https://github.com/cert-manager/cert-manager/issues/8849), [@ltwongaa](https://github.com/ltwongaa)) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/487

@FelixPhipps

##### [\`v1.21.0\`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. #### Known Issues - **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#8407](cert-manager/cert-manager#8407)) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#8994](cert-manager/cert-manager#8994) for details. #### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](cert-manager/cert-manager#8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](cert-manager/cert-manager#8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](cert-manager/cert-manager#8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](cert-manager/cert-manager#8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](cert-manager/cert-manager#8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](cert-manager/cert-manager#8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](cert-manager/cert-manager#8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](cert-manager/cert-manager#8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](cert-manager/cert-manager#8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](cert-manager/cert-manager#8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](cert-manager/cert-manager#8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](cert-manager/cert-manager#8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](cert-manager/cert-manager#8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](cert-manager/cert-manager#8808), [#8779](cert-manager/cert-manager#8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [#8976](cert-manager/cert-manager#8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](cert-manager/cert-manager#8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](cert-manager/cert-manager#8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](cert-manager/cert-manager#8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](cert-manager/cert-manager#8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](cert-manager/cert-manager#8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](cert-manager/cert-manager#8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](cert-manager/cert-manager#8255)) #### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) #### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](cert-manager/cert-manager#8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](cert-manager/cert-manager#8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](cert-manager/cert-manager#8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](cert-manager/cert-manager#8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](cert-manager/cert-manager#8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](cert-manager/cert-manager#8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](cert-manager/cert-manager#8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](cert-manager/cert-manager#8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](cert-manager/cert-manager#8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](cert-manager/cert-manager#8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](cert-manager/cert-manager#8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](cert-manager/cert-manager#8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](cert-manager/cert-manager#8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](cert-manager/cert-manager#8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](cert-manager/cert-manager#8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](cert-manager/cert-manager#8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](cert-manager/cert-manager#8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](cert-manager/cert-manager#8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](cert-manager/cert-manager#7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](cert-manager/cert-manager#8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](cert-manager/cert-manager#8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](cert-manager/cert-manager#8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](cert-manager/cert-manager#8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](cert-manager/cert-manager#8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](cert-manager/cert-manager#8808). ([#8843](cert-manager/cert-manager#8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](cert-manager/cert-manager#8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](cert-manager/cert-manager#8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](cert-manager/cert-manager#8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](cert-manager/cert-manager#8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](cert-manager/cert-manager#8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](cert-manager/cert-manager#8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](cert-manager/cert-manager#8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](cert-manager/cert-manager#8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](cert-manager/cert-manager#8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](cert-manager/cert-manager#8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](cert-manager/cert-manager#8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](cert-manager/cert-manager#8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](cert-manager/cert-manager#8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](cert-manager/cert-manager#8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](cert-manager/cert-manager#8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](cert-manager/cert-manager#8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](cert-manager/cert-manager#8849), [@ltwongaa](https://github.com/ltwongaa))

…1.20.3 ➔ v1.21.0) (#273) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.20.3` → `v1.21.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](cert-manager/cert-manager@v1.21.0...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](cert-manager/cert-manager#8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](cert-manager/cert-manager#8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](cert-manager/cert-manager#8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](cert-manager/cert-manager#8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](cert-manager/cert-manager#8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](cert-manager/cert-manager#8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](cert-manager/cert-manager#8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](cert-manager/cert-manager#8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](cert-manager/cert-manager#8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](cert-manager/cert-manager#8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](cert-manager/cert-manager#8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](cert-manager/cert-manager#8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](cert-manager/cert-manager#8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](cert-manager/cert-manager#8808), [#8779](cert-manager/cert-manager#8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [#8976](cert-manager/cert-manager#8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](cert-manager/cert-manager#8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](cert-manager/cert-manager#8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](cert-manager/cert-manager#8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](cert-manager/cert-manager#8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](cert-manager/cert-manager#8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](cert-manager/cert-manager#8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](cert-manager/cert-manager#8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](cert-manager/cert-manager#8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](cert-manager/cert-manager#8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](cert-manager/cert-manager#8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](cert-manager/cert-manager#8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](cert-manager/cert-manager#8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](cert-manager/cert-manager#8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](cert-manager/cert-manager#8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](cert-manager/cert-manager#8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](cert-manager/cert-manager#8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](cert-manager/cert-manager#8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](cert-manager/cert-manager#8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](cert-manager/cert-manager#8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](cert-manager/cert-manager#8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](cert-manager/cert-manager#8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](cert-manager/cert-manager#8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](cert-manager/cert-manager#8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](cert-manager/cert-manager#8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](cert-manager/cert-manager#8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](cert-manager/cert-manager#7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](cert-manager/cert-manager#8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](cert-manager/cert-manager#8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](cert-manager/cert-manager#8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](cert-manager/cert-manager#8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](cert-manager/cert-manager#8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](cert-manager/cert-manager#8808). ([#8843](cert-manager/cert-manager#8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](cert-manager/cert-manager#8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](cert-manager/cert-manager#8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](cert-manager/cert-manager#8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](cert-manager/cert-manager#8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](cert-manager/cert-manager#8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](cert-manager/cert-manager#8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](cert-manager/cert-manager#8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](cert-manager/cert-manager#8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](cert-manager/cert-manager#8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](cert-manager/cert-manager#8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](cert-manager/cert-manager#8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](cert-manager/cert-manager#8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](cert-manager/cert-manager#8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](cert-manager/cert-manager#8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](cert-manager/cert-manager#8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](cert-manager/cert-manager#8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](cert-manager/cert-manager#8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](cert-manager/cert-manager@v1.20.3...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](cert-manager/cert-manager#8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](cert-manager/cert-manager#8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](cert-manager/cert-manager#8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](cert-manager/cert-manager#8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](cert-manager/cert-manager#8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](cert-manager/cert-manager#8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](cert-manager/cert-manager#8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](cert-manager/cert-manager#8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](cert-manager/cert-manager#8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](cert-manager/cert-manager#8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](cert-manager/cert-manager#8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](cert-manager/cert-manager#8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](cert-manager/cert-manager#8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](cert-manager/cert-manager#8808), [#8779](cert-manager/cert-manager#8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [#8976](cert-manager/cert-manager#8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](cert-manager/cert-manager#8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](cert-manager/cert-manager#8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](cert-manager/cert-manager#8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](cert-manager/cert-manager#8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](cert-manager/cert-manager#8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](cert-manager/cert-manager#8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](cert-manager/cert-manager#8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](cert-manager/cert-manager#8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](cert-manager/cert-manager#8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](cert-manager/cert-manager#8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](cert-manager/cert-manager#8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](cert-manager/cert-manager#8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](cert-manager/cert-manager#8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](cert-manager/cert-manager#8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](cert-manager/cert-manager#8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](cert-manager/cert-manager#8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](cert-manager/cert-manager#8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](cert-manager/cert-manager#8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](cert-manager/cert-manager#8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](cert-manager/cert-manager#8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](cert-manager/cert-manager#8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](cert-manager/cert-manager#8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](cert-manager/cert-manager#8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](cert-manager/cert-manager#8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](cert-manager/cert-manager#8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](cert-manager/cert-manager#8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](cert-manager/cert-manager#8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](cert-manager/cert-manager#7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](cert-manager/cert-manager#8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](cert-manager/cert-manager#8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](cert-manager/cert-manager#8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](cert-manager/cert-manager#8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](cert-manager/cert-manager#8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](cert-manager/cert-manager#8808). ([#8843](cert-manager/cert-manager#8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](cert-manager/cert-manager#8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](cert-manager/cert-manager#8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](cert-manager/cert-manager#8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](cert-manager/cert-manager#8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](cert-manager/cert-manager#8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](cert-manager/cert-manager#8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](cert-manager/cert-manager#8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](cert-manager/cert-manager#8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](cert-manager/cert-manager#8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](cert-manager/cert-manager#8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](cert-manager/cert-manager#8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](cert-manager/cert-manager#8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](cert-manager/cert-manager#8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](cert-manager/cert-manager#8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](cert-manager/cert-manager#8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](cert-manager/cert-manager#8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](cert-manager/cert-manager#8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](cert-manager/cert-manager#8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](cert-manager/cert-manager#8849), [@ltwongaa](https://github.com/ltwongaa)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.ajgon.casa/deedee/mark13/pulls/273

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.19.x` → `1.21.x` | | [longhorn](https://github.com/longhorn/longhorn) ([source](https://github.com/longhorn/charts)) | minor | `v1.11.1` → `1.12.0` | | [nvidia-device-plugin](https://github.com/NVIDIA/k8s-device-plugin) | minor | `0.17.0` → `0.19.3` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. #### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.3...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. #### Known Issues - **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` — `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See [#9031](https://github.com/cert-manager/cert-manager/issues/9031) for details. - **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#8407](https://github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#8994](https://github.com/cert-manager/cert-manager/issues/8994) for details. - **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See [#9036](https://github.com/cert-manager/cert-manager/issues/9036) for details and a fix proposal. #### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](https://github.com/cert-manager/cert-manager/issues/8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](https://github.com/cert-manager/cert-manager/issues/8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](https://github.com/cert-manager/cert-manager/issues/8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](https://github.com/cert-manager/cert-manager/issues/8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](https://github.com/cert-manager/cert-manager/issues/8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [#8779](https://github.com/cert-manager/cert-manager/issues/8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [#8976](https://github.com/cert-manager/cert-manager/issues/8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](https://github.com/cert-manager/cert-manager/issues/8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](https://github.com/cert-manager/cert-manager/issues/8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](https://github.com/cert-manager/cert-manager/issues/8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) #### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) #### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](https://github.com/cert-manager/cert-manager/issues/8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](https://github.com/cert-manager/cert-manager/issues/8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](https://github.com/cert-manager/cert-manager/issues/8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](https://github.com/cert-manager/cert-manager/issues/8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](https://github.com/cert-manager/cert-manager/issues/8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](https://github.com/cert-manager/cert-manager/issues/8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](https://github.com/cert-manager/cert-manager/issues/8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](https://github.com/cert-manager/cert-manager/issues/8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](https://github.com/cert-manager/cert-manager/issues/8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](https://github.com/cert-manager/cert-manager/issues/8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](https://github.com/cert-manager/cert-manager/issues/8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](https://github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](https://github.com/cert-manager/cert-manager/issues/8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](https://github.com/cert-manager/cert-manager/issues/8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](https://github.com/cert-manager/cert-manager/issues/8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](https://github.com/cert-manager/cert-manager/issues/8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](https://github.com/cert-manager/cert-manager/issues/8808). ([#8843](https://github.com/cert-manager/cert-manager/issues/8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](https://github.com/cert-manager/cert-manager/issues/8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](https://github.com/cert-manager/cert-manager/issues/8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](https://github.com/cert-manager/cert-manager/issues/8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](https://github.com/cert-manager/cert-manager/issues/8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](https://github.com/cert-manager/cert-manager/issues/8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](https://github.com/cert-manager/cert-manager/issues/8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](https://github.com/cert-manager/cert-manager/issues/8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](https://github.com/cert-manager/cert-manager/issues/8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](https://github.com/cert-manager/cert-manager/issues/8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](https://github.com/cert-manager/cert-manager/issues/8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](https://github.com/cert-manager/cert-manager/issues/8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](https://github.com/cert-manager/cert-manager/issues/8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](https://github.com/cert-manager/cert-manager/issues/8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](https://github.com/cert-manager/cert-manager/issues/8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.20.3`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.2...v1.20.3) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint. This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs. All users should upgrade. > \[!WARNING] > **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly. #### Changes by Kind ##### Bug or Regression - Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#8940](https://github.com/cert-manager/cert-manager/issues/8940), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8759](https://github.com/cert-manager/cert-manager/issues/8759), [@cert-manager-bot](https://github.com/cert-manager-bot)) ##### Other (Cleanup or Flake) - Bump go to 1.26.3, other deps to fix several govulncheck issues ([#8789](https://github.com/cert-manager/cert-manager/issues/8789), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#8926](https://github.com/cert-manager/cert-manager/issues/8926), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ### [`v1.20.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.2) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.1...v1.20.2) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.2 fixes invalid YAML generated in the Helm chart when both `webhook.config` and `webhook.volumes` are defined, and bumps Go to 1.26.2 along with dependencies to address reported vulnerabilities. #### Changes by Kind ##### Bug or Regression - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8665](https://github.com/cert-manager/cert-manager/issues/8665), [@cert-manager-bot](https://github.com/cert-manager-bot)) ##### Other (Cleanup or Flake) - Bump go dependencies with reported vulnerabilities ([#8704](https://github.com/cert-manager/cert-manager/issues/8704), [@erikgb](https://github.com/erikgb)) - Bump go to 1.26.2 ([#8703](https://github.com/cert-manager/cert-manager/issues/8703), [@erikgb](https://github.com/erikgb)) ### [`v1.20.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.0...v1.20.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate `parentRef` bug when both issuer config and annotations are present (Gateway API). ##### Bug or Regression - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8658](https://github.com/cert-manager/cert-manager/issues/8658), [@hjoshi123](https://github.com/hjoshi123)) - Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. ([#8655](https://github.com/cert-manager/cert-manager/issues/8655), [@erikgb](https://github.com/erikgb)) - Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. ([#8657](https://github.com/cert-manager/cert-manager/issues/8657), [@erikgb](https://github.com/erikgb)) ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.19.6...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](https://github.com/cert-manager/cert-manager/issues/8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](https://github.com/cert-manager/cert-manager/issues/8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](https://github.com/cert-manager/cert-manager/issues/8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](https://github.com/cert-manager/cert-manager/issues/8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](https://github.com/cert-manager/cert-manager/issues/8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](https://github.com/cert-manager/cert-manager/issues/8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](https://github.com/cert-manager/cert-manager/issues/7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](https://github.com/cert-manager/cert-manager/issues/7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](https://github.com/cert-manager/cert-manager/issues/8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](https://github.com/cert-manager/cert-manager/issues/8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](https://github.com/cert-manager/cert-manager/issues/8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](https://github.com/cert-manager/cert-manager/issues/8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](https://github.com/cert-manager/cert-manager/issues/8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSets` feature gate ([#8394](https://github.com/cert-manager/cert-manager/issues/8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](https://github.com/cert-manager/cert-manager/issues/8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](https://github.com/cert-manager/cert-manager/issues/8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](https://github.com/cert-manager/cert-manager/issues/8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](https://github.com/cert-manager/cert-manager/issues/8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](https://github.com/cert-manager/cert-manager/issues/8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](https://github.com/cert-manager/cert-manager/issues/8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](https://github.com/cert-manager/cert-manager/issues/8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](https://github.com/cert-manager/cert-manager/issues/8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](https://github.com/cert-manager/cert-manager/issues/8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](https://github.com/cert-manager/cert-manager/issues/8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](https://github.com/cert-manager/cert-manager/issues/8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](https://github.com/cert-manager/cert-manager/issues/8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](https://github.com/cert-manager/cert-manager/issues/8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](https://github.com/cert-manager/cert-manager/issues/8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `XListenerSets` feature gate to `ListenerSets` ([#8501](https://github.com/cert-manager/cert-manager/issues/8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](https://github.com/cert-manager/cert-manager/issues/8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](https://github.com/cert-manager/cert-manager/issues/8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](https://github.com/cert-manager/cert-manager/issues/8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](https://github.com/cert-manager/cert-manager/issues/8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](https://github.com/cert-manager/cert-manager/issues/8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](https://github.com/cert-manager/cert-manager/issues/8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](https://github.com/cert-manager/cert-manager/issues/8426), [@hjoshi123](https://github.com/hjoshi123)) </details> <details> <summary>longhorn/charts (longhorn)</summary> ### [`v1.12.0`](https://github.com/longhorn/charts/releases/tag/longhorn-1.12.0) [Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.11.3...longhorn-1.12.0) Longhorn is a distributed block storage system for Kubernetes. ### [`v1.11.3`](https://github.com/longhorn/charts/releases/tag/longhorn-1.11.3) [Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.11.2...longhorn-1.11.3) Longhorn is a distributed block storage system for Kubernetes. ### [`v1.11.2`](https://github.com/longhorn/charts/releases/tag/longhorn-1.11.2) [Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.11.1...longhorn-1.11.2) Longhorn is a distributed block storage system for Kubernetes. </details> <details> <summary>NVIDIA/k8s-device-plugin (nvidia-device-plugin)</summary> ### [`v0.19.3`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0193) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.2...v0.19.3) - bump nvcr.io/nvidia/distroless/go to v4.0.8-dev ([#1852](https://github.com/NVIDIA/k8s-device-plugin/issues/1852)) - revert default enablement of features mofed, gdrcopy and mofed ([#1837](https://github.com/NVIDIA/k8s-device-plugin/issues/1837)) - bump golang version to 1.26.4 ([#1828](https://github.com/NVIDIA/k8s-device-plugin/issues/1828)) - bump golang.org/x/net to v0.56.0 ([#1867](https://github.com/NVIDIA/k8s-device-plugin/issues/1867)) ### [`v0.19.2`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0192) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.1...v0.19.2) - Bump golang version to 1.26.3 ([#1754](https://github.com/NVIDIA/k8s-device-plugin/issues/1754)) - Bump nvidia/distroless/go to v4.0.6-dev ([#1806](https://github.com/NVIDIA/k8s-device-plugin/issues/1806)) - Bump nvidia-container-toolkit to v1.19.1 ([#1798](https://github.com/NVIDIA/k8s-device-plugin/issues/1798)) - Always use a dedicated service account in the helm chart ([#1804](https://github.com/NVIDIA/k8s-device-plugin/issues/1804)) ### [`v0.19.1`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0191) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.0...v0.19.1) - wsl: report a single "all" device to kubelet ([#1699](https://github.com/NVIDIA/k8s-device-plugin/issues/1699)) - Fix CDI spec generation to respect driver root for Tegra CSV files ([#1701](https://github.com/NVIDIA/k8s-device-plugin/issues/1701)) - Bump golang from 1.26.1 to 1.26.2 ([#1704](https://github.com/NVIDIA/k8s-device-plugin/issues/1704)) * Bump nvidia/distroless/go from v4.0.3-dev to v4.0.4-dev ([#1702](https://github.com/NVIDIA/k8s-device-plugin/issues/1702)) * Bump google.golang.org/grpc from 1.79.1 to 1.79.3 ([#1711](https://github.com/NVIDIA/k8s-device-plugin/issues/1711)) * Bump the k8s.io dependencies to v1.35.4 ([#1710](https://github.com/NVIDIA/k8s-device-plugin/issues/1710)) ### [`v0.19.0`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0190) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.18.2...v0.19.0) - Add --sleep-interval=infinite support to GFD for running as a pod ([#1603](https://github.com/NVIDIA/k8s-device-plugin/issues/1603)) - Fix image tag in static deployment ([#1604](https://github.com/NVIDIA/k8s-device-plugin/issues/1604)) - Add ownerReference to NodeFeature CRs for garbage collection ([#1597](https://github.com/NVIDIA/k8s-device-plugin/issues/1597)) - Change default value for gds, gdrcopy and mofed flags ([#1550](https://github.com/NVIDIA/k8s-device-plugin/issues/1550)) - Fix healthchecking on old devices ([#1562](https://github.com/NVIDIA/k8s-device-plugin/issues/1562)) - Enable NodeFeature API by default in GFD ([#1504](https://github.com/NVIDIA/k8s-device-plugin/issues/1504)) - Build multiarch images on native GitHub runners ([#1468](https://github.com/NVIDIA/k8s-device-plugin/issues/1468)) ### [`v0.18.2`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0182) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.18.1...v0.18.2) - Ensure that cdi.FeatureFlags are passed to CDI library - Fix race condition in config-manager when label is unset - Fix nested container use cases by ensuring that IPC sockets are not mounted readonly - Bump NVIDIA Container Toolkit to v1.18.2 - Bump distroless base image to v3.2.2-dev ### [`v0.18.1`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0181) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.18.0...v0.18.1) - Allow CDI feature flags to be set - Pass driver root to nvinfo.New in device plugin main - Bump NVIDIA Container Toolkit to v1.18.1 - Bump distroless base image to v3.2.1-dev - Bump github.com/opencontainers/selinux from 1.12.0 to 1.13.1 ([#1506](https://github.com/NVIDIA/k8s-device-plugin/issues/1506)) ### [`v0.18.0`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0180) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.4...v0.18.0) - Rename getHealthCheckXids and clarify documentation - Add support for explicitly enabling XIDs in health checks - Deduplicate requested device IDs - Check for nil before reading boolean config values - Make gated modes (GDS, MOFED, GDRCOPY) optional in CDI - Add support for setting gdrcopyEnabled - Ignore errors getting device memory using NVML - Ensure that directory volumes have Directory type - Switch to plain golang image for builds - Remove unneeded intermediate container - Update CI definitions - Switch to distroless golang image - Update README.md with RuntimeClass - Pass a single context throughout the device-plugin method call stack ([#1284](https://github.com/NVIDIA/k8s-device-plugin/issues/1284)) - Remove internal logger in favour of klog ([#1277](https://github.com/NVIDIA/k8s-device-plugin/issues/1277)) - Remove FAIL\_ON\_INIT\_ERROR from static examples - Detect blackwell architecture - Updated .release:staging to stage device-plugin images in nvstaging - Use MiB instead of MB for gpu-memory - Ignore XID error 109 - Update README.md adjust set docker runtime default - Remove nvidia.com/gpu.imex-domain label - Fix containerd runc config error when creating a kind cluster - Use stable nividia-container-toolkit repo when creating a kind cluster - Switch to context package in go stdlib - Raise a warning instead of an error if GPU mode labeler fails - Add ada-lovelace architecture label for compute capability 8.9 - Ensure FAIL\_ON\_INIT\_ERROR boolean env is quoted - Honor fail-on-init-error when no resources are found - Enable hostPID in the mps-control-daemon pod ([#1045](https://github.com/NVIDIA/k8s-device-plugin/issues/1045)) ### [`v0.17.4`](https://github.com/NVIDIA/k8s-device-plugin/releases/tag/v0.17.4) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.3...v0.17.4) #### What's Changed - Bump slackapi/slack-github-action from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#1317](https://github.com/NVIDIA/k8s-device-plugin/pull/1317) - Bump github.com/NVIDIA/go-nvlib from 0.7.2 to 0.7.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#1346](https://github.com/NVIDIA/k8s-device-plugin/pull/1346) - Bump golang from 1.23.11 to 1.23.12 in /deployments/devel by [@dependabot](https://github.com/dependabot)\[bot] in [#1355](https://github.com/NVIDIA/k8s-device-plugin/pull/1355) - Ensure that directory volumes have Directory type by [@elezar](https://github.com/elezar) in [#1368](https://github.com/NVIDIA/k8s-device-plugin/pull/1368) - Bump nvidia/cuda from 12.9.1-base-ubi9 to 13.0.0-base-ubi9 in /deployments/container by [@dependabot](https://github.com/dependabot)\[bot] in [#1369](https://github.com/NVIDIA/k8s-device-plugin/pull/1369) - Ignore errors getting device memory using NVML by [@elezar](https://github.com/elezar) in [#1374](https://github.com/NVIDIA/k8s-device-plugin/pull/1374) - Bump project version to v0.17.4 by [@cdesiniotis](https://github.com/cdesiniotis) in [#1402](https://github.com/NVIDIA/k8s-device-plugin/pull/1402) - \[no-relnote] update ngc publishing logic for release pipelines by [@cdesiniotis](https://github.com/cdesiniotis) in [#1406](https://github.com/NVIDIA/k8s-device-plugin/pull/1406) **Full Changelog**: <https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.3...v0.17.4> ### [`v0.17.3`](https://github.com/NVIDIA/k8s-device-plugin/releases/tag/v0.17.3) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.2...v0.17.3) #### What's Changed - Bump github.com/NVIDIA/nvidia-container-toolkit from 1.17.6 to 1.17.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#1275](https://github.com/NVIDIA/k8s-device-plugin/pull/1275) - Bump nvidia/cuda from 12.9.0-base-ubi9 to 12.9.1-base-ubi9 in /deployments/container by [@dependabot](https://github.com/dependabot)\[bot] in [#1300](https://github.com/NVIDIA/k8s-device-plugin/pull/1300) - Bump github.com/NVIDIA/go-nvml from 0.12.4-1 to 0.12.9-0 by [@dependabot](https://github.com/dependabot)\[bot] in [#1287](https://github.com/NVIDIA/k8s-device-plugin/pull/1287) - Bump golang from 1.23.9 to 1.23.10 in /deployments/devel by [@dependabot](https://github.com/dependabot)\[bot] in [#1283](https://github.com/NVIDIA/k8s-device-plugin/pull/1283) - Bump golang from 1.23.10 to 1.23.11 in /deployments/devel by [@dependabot](https://github.com/dependabot)\[bot] in [#1318](https://github.com/NVIDIA/k8s-device-plugin/pull/1318) - Bump release v0.17.3 by [@elezar](https://github.com/elezar) in [#1326](https://github.com/NVIDIA/k8s-device-plugin/pull/1326) - Backport: Bump golang.org/x/oauth2 from 0.23.0 to 0.27.0 by [@cdesiniotis](https://github.com/cdesiniotis) in [#1328](https://github.com/NVIDIA/k8s-device-plugin/pull/1328) - Updated .release:staging to stage device-plugin images in nvstaging by [@elezar](https://github.com/elezar) in [#1329](https://github.com/NVIDIA/k8s-device-plugin/pull/1329) **Full Changelog**: <https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.2...v0.17.3> ### [`v0.17.2`](https://github.com/NVIDIA/k8s-device-plugin/releases/tag/v0.17.2) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.1...v0.17.2) #### What's Changed - Update nvidia.com/gpu.product label to include blackwell architectures - Update documentation to indicate that nvidia.com/gpu.memory label is in MiB instead of MB **Full Changelog**: <https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.1...v0.17.2> ### [`v0.17.1`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#Version-v0171) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.0...v0.17.1) - Ensure that generated CDI specs do not contain `enable-cuda-compat` hooks - Remove nvidia.com/gpu.imex-domain label - Ignore XID error 109 - Add `ada-lovelace` architecture label for compute capability 8.9 - Ensure FAIL\_ON\_INIT\_ERROR boolean env is quoted - Honor fail-on-init-error when no resources are found </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://forge.superkooka.com/Superkooka/infra-gitops/pulls/13

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.20.0` → `v1.21.1` | | [quay.io/jetstack/charts/cert-manager-csi-driver](https://cert-manager.io/docs/usage/csi-driver) ([source](https://github.com/cert-manager/csi-driver)) | minor | `v0.14.0` → `v0.16.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/141) for more information. --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Known Issues - **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` — `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See [#9031](https://github.com/cert-manager/cert-manager/issues/9031) for details. - **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#8407](https://github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#8994](https://github.com/cert-manager/cert-manager/issues/8994) for details. - **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See [#9036](https://github.com/cert-manager/cert-manager/issues/9036) for details and a fix proposal. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](https://github.com/cert-manager/cert-manager/issues/8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](https://github.com/cert-manager/cert-manager/issues/8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](https://github.com/cert-manager/cert-manager/issues/8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](https://github.com/cert-manager/cert-manager/issues/8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](https://github.com/cert-manager/cert-manager/issues/8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [#8779](https://github.com/cert-manager/cert-manager/issues/8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [#8976](https://github.com/cert-manager/cert-manager/issues/8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](https://github.com/cert-manager/cert-manager/issues/8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](https://github.com/cert-manager/cert-manager/issues/8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](https://github.com/cert-manager/cert-manager/issues/8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](https://github.com/cert-manager/cert-manager/issues/8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](https://github.com/cert-manager/cert-manager/issues/8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](https://github.com/cert-manager/cert-manager/issues/8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](https://github.com/cert-manager/cert-manager/issues/8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](https://github.com/cert-manager/cert-manager/issues/8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](https://github.com/cert-manager/cert-manager/issues/8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](https://github.com/cert-manager/cert-manager/issues/8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](https://github.com/cert-manager/cert-manager/issues/8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](https://github.com/cert-manager/cert-manager/issues/8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](https://github.com/cert-manager/cert-manager/issues/8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](https://github.com/cert-manager/cert-manager/issues/8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](https://github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](https://github.com/cert-manager/cert-manager/issues/8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](https://github.com/cert-manager/cert-manager/issues/8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](https://github.com/cert-manager/cert-manager/issues/8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](https://github.com/cert-manager/cert-manager/issues/8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](https://github.com/cert-manager/cert-manager/issues/8808). ([#8843](https://github.com/cert-manager/cert-manager/issues/8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](https://github.com/cert-manager/cert-manager/issues/8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](https://github.com/cert-manager/cert-manager/issues/8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](https://github.com/cert-manager/cert-manager/issues/8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](https://github.com/cert-manager/cert-manager/issues/8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](https://github.com/cert-manager/cert-manager/issues/8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](https://github.com/cert-manager/cert-manager/issues/8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](https://github.com/cert-manager/cert-manager/issues/8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](https://github.com/cert-manager/cert-manager/issues/8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](https://github.com/cert-manager/cert-manager/issues/8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](https://github.com/cert-manager/cert-manager/issues/8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](https://github.com/cert-manager/cert-manager/issues/8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](https://github.com/cert-manager/cert-manager/issues/8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](https://github.com/cert-manager/cert-manager/issues/8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](https://github.com/cert-manager/cert-manager/issues/8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.3...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. ##### Known Issues - **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` — `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See [#9031](https://github.com/cert-manager/cert-manager/issues/9031) for details. - **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#8407](https://github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#8994](https://github.com/cert-manager/cert-manager/issues/8994) for details. - **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See [#9036](https://github.com/cert-manager/cert-manager/issues/9036) for details and a fix proposal. ##### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](https://github.com/cert-manager/cert-manager/issues/8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](https://github.com/cert-manager/cert-manager/issues/8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](https://github.com/cert-manager/cert-manager/issues/8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](https://github.com/cert-manager/cert-manager/issues/8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](https://github.com/cert-manager/cert-manager/issues/8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [#8779](https://github.com/cert-manager/cert-manager/issues/8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [#8976](https://github.com/cert-manager/cert-manager/issues/8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](https://github.com/cert-manager/cert-manager/issues/8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](https://github.com/cert-manager/cert-manager/issues/8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](https://github.com/cert-manager/cert-manager/issues/8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) ##### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) ##### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](https://github.com/cert-manager/cert-manager/issues/8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](https://github.com/cert-manager/cert-manager/issues/8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](https://github.com/cert-manager/cert-manager/issues/8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](https://github.com/cert-manager/cert-manager/issues/8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](https://github.com/cert-manager/cert-manager/issues/8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](https://github.com/cert-manager/cert-manager/issues/8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](https://github.com/cert-manager/cert-manager/issues/8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](https://github.com/cert-manager/cert-manager/issues/8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](https://github.com/cert-manager/cert-manager/issues/8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](https://github.com/cert-manager/cert-manager/issues/8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](https://github.com/cert-manager/cert-manager/issues/8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](https://github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](https://github.com/cert-manager/cert-manager/issues/8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](https://github.com/cert-manager/cert-manager/issues/8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](https://github.com/cert-manager/cert-manager/issues/8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](https://github.com/cert-manager/cert-manager/issues/8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](https://github.com/cert-manager/cert-manager/issues/8808). ([#8843](https://github.com/cert-manager/cert-manager/issues/8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](https://github.com/cert-manager/cert-manager/issues/8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](https://github.com/cert-manager/cert-manager/issues/8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](https://github.com/cert-manager/cert-manager/issues/8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](https://github.com/cert-manager/cert-manager/issues/8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](https://github.com/cert-manager/cert-manager/issues/8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](https://github.com/cert-manager/cert-manager/issues/8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](https://github.com/cert-manager/cert-manager/issues/8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](https://github.com/cert-manager/cert-manager/issues/8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](https://github.com/cert-manager/cert-manager/issues/8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](https://github.com/cert-manager/cert-manager/issues/8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](https://github.com/cert-manager/cert-manager/issues/8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](https://github.com/cert-manager/cert-manager/issues/8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](https://github.com/cert-manager/cert-manager/issues/8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](https://github.com/cert-manager/cert-manager/issues/8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.20.3`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.3...v1.20.3) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint. This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs. All users should upgrade. > \[!WARNING] > **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly. ##### Changes by Kind ##### Bug or Regression - Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#8940](https://github.com/cert-manager/cert-manager/issues/8940), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8759](https://github.com/cert-manager/cert-manager/issues/8759), [@cert-manager-bot](https://github.com/cert-manager-bot)) ##### Other (Cleanup or Flake) - Bump go to 1.26.3, other deps to fix several govulncheck issues ([#8789](https://github.com/cert-manager/cert-manager/issues/8789), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#8926](https://github.com/cert-manager/cert-manager/issues/8926), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ### [`v1.20.3`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.2...v1.20.3) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint. This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs. All users should upgrade. > \[!WARNING] > **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly. ##### Changes by Kind ##### Bug or Regression - Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#8940](https://github.com/cert-manager/cert-manager/issues/8940), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8759](https://github.com/cert-manager/cert-manager/issues/8759), [@cert-manager-bot](https://github.com/cert-manager-bot)) ##### Other (Cleanup or Flake) - Bump go to 1.26.3, other deps to fix several govulncheck issues ([#8789](https://github.com/cert-manager/cert-manager/issues/8789), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#8926](https://github.…

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.19.x` → `1.21.x` | | [longhorn](https://github.com/longhorn/longhorn) ([source](https://github.com/longhorn/charts)) | minor | `v1.11.1` → `1.12.1` | | [nvidia-device-plugin](https://github.com/NVIDIA/k8s-device-plugin) | minor | `0.17.0` → `0.20.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/6) for more information. --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.21.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.2) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.2) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities. All users should upgrade. #### Changes by Kind ##### Bug or Regression - ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. ([#9239](https://github.com/cert-manager/cert-manager/issues/9239), [@FelixPhipps](https://github.com/FelixPhipps)) - Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. ([#9222](https://github.com/cert-manager/cert-manager/issues/9222), [@FelixPhipps](https://github.com/FelixPhipps)) - De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret ([#9234](https://github.com/cert-manager/cert-manager/issues/9234), [@speer](https://github.com/speer)) - Fix certificate renewal windows using February 29 cron schedules across non-leap century years. ([#9240](https://github.com/cert-manager/cert-manager/issues/9240), [@wieghx](https://github.com/wieghx)) - Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. ([#9235](https://github.com/cert-manager/cert-manager/issues/9235), [@lunarwhite](https://github.com/lunarwhite)) - Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. ([#9278](https://github.com/cert-manager/cert-manager/issues/9278), [@arpitjain099](https://github.com/arpitjain099)) - Fixed a bug where `replaces` field was being populated for the wrong issuer on issuer changes ([#9236](https://github.com/cert-manager/cert-manager/issues/9236), [@hjoshi123](https://github.com/hjoshi123)) - Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. ([#9313](https://github.com/cert-manager/cert-manager/issues/9313), [@shashankvarma499](https://github.com/shashankvarma499)) - Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. ([#9238](https://github.com/cert-manager/cert-manager/issues/9238), [@thc1006](https://github.com/thc1006)) - Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. ([#9312](https://github.com/cert-manager/cert-manager/issues/9312), [@shashankvarma499](https://github.com/shashankvarma499)) - Fixed an issue where the body of a non-Vault HTTP response from `spec.vault.server` could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. ([#9262](https://github.com/cert-manager/cert-manager/issues/9262), [@FelixPhipps](https://github.com/FelixPhipps)) - Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects ([#9314](https://github.com/cert-manager/cert-manager/issues/9314), [@KR-Ravindra](https://github.com/KR-Ravindra)) - The ACME HTTP-01 self-check no longer reflects the fetched response body in `Challenge.status.reason`, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. ([#9232](https://github.com/cert-manager/cert-manager/issues/9232), [@FelixPhipps](https://github.com/FelixPhipps)) - The `vault` issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced `Issuer`, unless ambient credentials are explicitly enabled via `--issuer-ambient-credentials`. `ClusterIssuer` and explicit `serviceAccountRef` (IRSA) configurations are unaffected. ([#9231](https://github.com/cert-manager/cert-manager/issues/9231), [@FelixPhipps](https://github.com/FelixPhipps)) ##### Other (Cleanup or Flake) - Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. ([#9151](https://github.com/cert-manager/cert-manager/issues/9151), [@wallrj](https://github.com/wallrj)) - Upgrade Go to 1.26.8. ([#9323](https://github.com/cert-manager/cert-manager/issues/9323), [@wallrj](https://github.com/wallrj)) - Bump `google.golang.org/grpc` to v1.83.2 to fix reported security vulnerabilities ([#9255](https://github.com/cert-manager/cert-manager/issues/9255), [#9317](https://github.com/cert-manager/cert-manager/issues/9317)) - Bump `golang.org/x/crypto` to v0.56.0 to fix reported security vulnerabilities ([#9265](https://github.com/cert-manager/cert-manager/issues/9265)) ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. #### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.4...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. #### Known Issues - **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` — `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See [#9031](https://github.com/cert-manager/cert-manager/issues/9031) for details. - **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#8407](https://github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#8994](https://github.com/cert-manager/cert-manager/issues/8994) for details. - **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See [#9036](https://github.com/cert-manager/cert-manager/issues/9036) for details and a fix proposal. #### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](https://github.com/cert-manager/cert-manager/issues/8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](https://github.com/cert-manager/cert-manager/issues/8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](https://github.com/cert-manager/cert-manager/issues/8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](https://github.com/cert-manager/cert-manager/issues/8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](https://github.com/cert-manager/cert-manager/issues/8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [#8779](https://github.com/cert-manager/cert-manager/issues/8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [#8976](https://github.com/cert-manager/cert-manager/issues/8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](https://github.com/cert-manager/cert-manager/issues/8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](https://github.com/cert-manager/cert-manager/issues/8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](https://github.com/cert-manager/cert-manager/issues/8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) #### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) #### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](https://github.com/cert-manager/cert-manager/issues/8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](https://github.com/cert-manager/cert-manager/issues/8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](https://github.com/cert-manager/cert-manager/issues/8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](https://github.com/cert-manager/cert-manager/issues/8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](https://github.com/cert-manager/cert-manager/issues/8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](https://github.com/cert-manager/cert-manager/issues/8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](https://github.com/cert-manager/cert-manager/issues/8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](https://github.com/cert-manager/cert-manager/issues/8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](https://github.com/cert-manager/cert-manager/issues/8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](https://github.com/cert-manager/cert-manager/issues/8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](https://github.com/cert-manager/cert-manager/issues/8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](https://github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](https://github.com/cert-manager/cert-manager/issues/8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](https://github.com/cert-manager/cert-manager/issues/8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](https://github.com/cert-manager/cert-manager/issues/8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](https://github.com/cert-manager/cert-manager/issues/8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](https://github.com/cert-manager/cert-manager/issues/8808). ([#8843](https://github.com/cert-manager/cert-manager/issues/8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](https://github.com/cert-manager/cert-manager/issues/8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](https://github.com/cert-manager/cert-manager/issues/8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](https://github.com/cert-manager/cert-manager/issues/8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](https://github.com/cert-manager/cert-manager/issues/8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](https://github.com/cert-manager/cert-manager/issues/8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](https://github.com/cert-manager/cert-manager/issues/8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](https://github.com/cert-manager/cert-manager/issues/8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](https://github.com/cert-manager/cert-manager/issues/8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](https://github.com/cert-manager/cert-manager/issues/8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](https://github.com/cert-manager/cert-manager/issues/8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](https://github.com/cert-manager/cert-manager/issues/8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](https://github.com/cert-manager/cert-manager/issues/8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](https://github.com/cert-manager/cert-manager/issues/8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](https://github.com/cert-manager/cert-manager/issues/8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.20.4`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.4) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.3...v1.20.4) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This patch release updates Go and several dependencies to fix reported security vulnerabilities, and fixes a bug where ingress-shim removed the applyset label from cached Ingress and Gateway objects. All users should upgrade. > \[!NOTE] > **Security scanners still report three `golang.org/x/crypto` findings.** None of them affects cert-manager and we do not plan to fix them in the 1.20 line. > > - [CVE-2026-56855](https://nvd.nist.gov/vuln/detail/CVE-2026-56855) and [CVE-2026-78662](https://nvd.nist.gov/vuln/detail/CVE-2026-78662) are deadlocks in the `golang.org/x/crypto/ssh` connection multiplexer, triggered by a malicious SSH peer after a connection is established. cert-manager never opens an SSH connection. Only the controller links the `ssh` package, through `vcert`, which uses it to format a public key. The fix, `golang.org/x/crypto` v0.56.0, requires Go language version 1.26, which we will not adopt in a patch release. `govulncheck` confirms the vulnerable functions are not called. > - [GO-2026-5932](https://pkg.go.dev/vuln/GO-2026-5932) marks `golang.org/x/crypto/openpgp` as unmaintained. cert-manager does not import that package and there is no fixed version. > > cert-manager 1.21 already uses `golang.org/x/crypto` v0.56.0, so upgrade to 1.21 if you need a clean scan. #### Changes by Kind ##### Bug or Regression - Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects ([#9315](https://github.com/cert-manager/cert-manager/issues/9315), [@KR-Ravindra](https://github.com/KR-Ravindra)) ##### Other (Cleanup or Flake) - Update Go to 1.26.5 and then 1.26.6, which include security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages ([#8995](https://github.com/cert-manager/cert-manager/issues/8995), [@wallrj-cyberark](https://github.com/wallrj-cyberark); [#9152](https://github.com/cert-manager/cert-manager/issues/9152), [@wallrj](https://github.com/wallrj)) - Bump `golang.org/x/net` to v0.58.0, `golang.org/x/text` to v0.41.0 and `golang.org/x/crypto` to v0.55.0 to fix [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600), [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852) and [CVE-2026-56854](https://nvd.nist.gov/vuln/detail/CVE-2026-56854) ([#9040](https://github.com/cert-manager/cert-manager/issues/9040), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.83.2 to fix [CVE-2026-84304](https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc), [CVE-2026-84445](https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj), [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) and [one further advisory](https://github.com/advisories/GHSA-hrxh-6v49-42gf) ([#9062](https://github.com/cert-manager/cert-manager/issues/9062), [#9257](https://github.com/cert-manager/cert-manager/issues/9257), [#9316](https://github.com/cert-manager/cert-manager/issues/9316)) - Bump `github.com/google/cel-go` to v0.30.0 to fix [a reported vulnerability](https://github.com/advisories/GHSA-gcjh-h69q-9w9g) ([#9070](https://github.com/cert-manager/cert-manager/issues/9070), [#9186](https://github.com/cert-manager/cert-manager/issues/9186)) - Bump `software.sslmate.com/src/go-pkcs12` to v0.7.2 to fix [a reported vulnerability](https://github.com/advisories/GHSA-mpwr-8vm7-h73f) ([#8988](https://github.com/cert-manager/cert-manager/issues/8988)) - Bump `golang.org/x/mod`, `go.opentelemetry.io/otel` and `go.etcd.io/etcd/client/pkg/v3` to versions flagged by security scanners ([#9143](https://github.com/cert-manager/cert-manager/issues/9143), [#9071](https://github.com/cert-manager/cert-manager/issues/9071), [#9185](https://github.com/cert-manager/cert-manager/issues/9185)) - Update the distroless base images ([#8991](https://github.com/cert-manager/cert-manager/issues/8991), [#9024](https://github.com/cert-manager/cert-manager/issues/9024), [#9055](https://github.com/cert-manager/cert-manager/issues/9055), [#9325](https://github.com/cert-manager/cert-manager/issues/9325)) - The release staging process now signs `metadata.json` with cosign so the publish step can verify its authenticity ([#9090](https://github.com/cert-manager/cert-manager/issues/9090), [@FelixPhipps](https://github.com/FelixPhipps)) ### [`v1.20.3`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.2...v1.20.3) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint. This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs. All users should upgrade. > \[!WARNING] > **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly. #### Changes by Kind ##### Bug or Regression - Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#8940](https://github.com/cert-manager/cert-manager/issues/8940), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8759](https://github.com/cert-manager/cert-manager/issues/8759), [@cert-manager-bot](https://github.com/cert-manager-bot)) ##### Other (Cleanup or Flake) - Bump go to 1.26.3, other deps to fix several govulncheck issues ([#8789](https://github.com/cert-manager/cert-manager/issues/8789), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#8926](https://github.com/cert-manager/cert-manager/issues/8926), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ### [`v1.20.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.2) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.1...v1.20.2) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.2 fixes invalid YAML generated in the Helm chart when both `webhook.config` and `webhook.volumes` are defined, and bumps Go to 1.26.2 along with dependencies to address reported vulnerabilities. #### Changes by Kind ##### Bug or Regression - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8665](https://github.com/cert-manager/cert-manager/issues/8665), [@cert-manager-bot](https://github.com/cert-manager-bot)) ##### Other (Cleanup or Flake) - Bump go dependencies with reported vulnerabilities ([#8704](https://github.com/cert-manager/cert-manager/issues/8704), [@erikgb](https://github.com/erikgb)) - Bump go to 1.26.2 ([#8703](https://github.com/cert-manager/cert-manager/issues/8703), [@erikgb](https://github.com/erikgb)) ### [`v1.20.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.0...v1.20.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate `parentRef` bug when both issuer config and annotations are present (Gateway API). ##### Bug or Regression - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8658](https://github.com/cert-manager/cert-manager/issues/8658), [@hjoshi123](https://github.com/hjoshi123)) - Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. ([#8655](https://github.com/cert-manager/cert-manager/issues/8655), [@erikgb](https://github.com/erikgb)) - Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. ([#8657](https://github.com/cert-manager/cert-manager/issues/8657), [@erikgb](https://github.com/erikgb)) ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.19.6...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](https://github.com/cert-manager/cert-manager/issues/8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](https://github.com/cert-manager/cert-manager/issues/8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](https://github.com/cert-manager/cert-manager/issues/8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](https://github.com/cert-manager/cert-manager/issues/8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](https://github.com/cert-manager/cert-manager/issues/8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](https://github.com/cert-manager/cert-manager/issues/8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](https://github.com/cert-manager/cert-manager/issues/7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](https://github.com/cert-manager/cert-manager/issues/7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](https://github.com/cert-manager/cert-manager/issues/8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](https://github.com/cert-manager/cert-manager/issues/8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](https://github.com/cert-manager/cert-manager/issues/8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](https://github.com/cert-manager/cert-manager/issues/8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](https://github.com/cert-manager/cert-manager/issues/8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSets` feature gate ([#8394](https://github.com/cert-manager/cert-manager/issues/8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](https://github.com/cert-manager/cert-manager/issues/8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](https://github.com/cert-manager/cert-manager/issues/8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](https://github.com/cert-manager/cert-manager/issues/8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](https://github.com/cert-manager/cert-manager/issues/8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](https://github.com/cert-manager/cert-manager/issues/8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](https://github.com/cert-manager/cert-manager/issues/8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](https://github.com/cert-manager/cert-manager/issues/8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](https://github.com/cert-manager/cert-manager/issues/8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](https://github.com/cert-manager/cert-manager/issues/8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](https://github.com/cert-manager/cert-manager/issues/8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](https://github.com/cert-manager/cert-manager/issues/8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](https://github.com/cert-manager/cert-manager/issues/8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](https://github.com/cert-manager/cert-manager/issues/8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](https://github.com/cert-manager/cert-manager/issues/8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `XListenerSets` feature gate to `ListenerSets` ([#8501](https://github.com/cert-manager/cert-manager/issues/8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](https://github.com/cert-manager/cert-manager/issues/8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](https://github.com/cert-manager/cert-manager/issues/8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](https://github.com/cert-manager/cert-manager/issues/8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](https://github.com/cert-manager/cert-manager/issues/8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](https://github.com/cert-manager/cert-manager/issues/8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](https://github.com/cert-manager/cert-manager/issues/8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](https://github.com/cert-manager/cert-manager/issues/8426), [@hjoshi123](https://github.com/hjoshi123)) </details> <details> <summary>longhorn/charts (longhorn)</summary> ### [`v1.12.1`](https://github.com/longhorn/charts/releases/tag/longhorn-1.12.1) [Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.12.0...longhorn-1.12.1) Longhorn is a distributed block storage system for Kubernetes. ### [`v1.12.0`](https://github.com/longhorn/charts/releases/tag/longhorn-1.12.0) [Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.11.3...longhorn-1.12.0) Longhorn is a distributed block storage system for Kubernetes. ### [`v1.11.3`](https://github.com/longhorn/charts/releases/tag/longhorn-1.11.3) [Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.11.2...longhorn-1.11.3) Longhorn is a distributed block storage system for Kubernetes. ### [`v1.11.2`](https://github.com/longhorn/charts/releases/tag/longhorn-1.11.2) [Compare Source](https://github.com/longhorn/charts/compare/longhorn-1.11.1...longhorn-1.11.2) Longhorn is a distributed block storage system for Kubernetes. </details> <details> <summary>NVIDIA/k8s-device-plugin (nvidia-device-plugin)</summary> ### [`v0.20.0`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0200) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.3...v0.20.0) - Add configurable packed/distributed allocation policy for replicated and MIG resources ([#1621](https://github.com/NVIDIA/k8s-device-plugin/issues/1621)) - Prefer distinct physical GPUs when breaking distributed-allocation ties ([#1788](https://github.com/NVIDIA/k8s-device-plugin/issues/1788)) - Fix MIG resource matching so profiles with suffixes such as `-me`, `+me.all`, and `+gfx` are exposed as separate Kubernetes resources ([#1807](https://github.com/NVIDIA/k8s-device-plugin/issues/1807)) - Surface NVML errors when MIG device placement cannot be determined ([#1899](https://github.com/NVIDIA/k8s-device-plugin/issues/1899)) - Add support for the Rubin architecture family ([#1909](https://github.com/NVIDIA/k8s-device-plugin/issues/1909)) - Bump NVIDIA go-nvlib to v0.12.0 ([#1911](https://github.com/NVIDIA/k8s-device-plugin/issues/1911)) - Update the Node Feature Discovery chart to v0.19.0 and use OCI artifacts ([#1922](https://github.com/NVIDIA/k8s-device-plugin/issues/1922)) - Add third-party notices and a generator ([#1950](https://github.com/NVIDIA/k8s-device-plugin/issues/1950)) - Bump NVIDIA Container Toolkit to v1.20.0 ([#1958](https://github.com/NVIDIA/k8s-device-plugin/issues/1958)) - Add OCI standard image labels ([#1961](https://github.com/NVIDIA/k8s-device-plugin/issues/1961)) ### [`v0.19.3`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0193) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.2...v0.19.3) - bump nvcr.io/nvidia/distroless/go to v4.0.8-dev ([#1852](https://github.com/NVIDIA/k8s-device-plugin/issues/1852)) - revert default enablement of features mofed, gdrcopy and mofed ([#1837](https://github.com/NVIDIA/k8s-device-plugin/issues/1837)) - bump golang version to 1.26.4 ([#1828](https://github.com/NVIDIA/k8s-device-plugin/issues/1828)) - bump golang.org/x/net to v0.56.0 ([#1867](https://github.com/NVIDIA/k8s-device-plugin/issues/1867)) ### [`v0.19.2`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0192) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.1...v0.19.2) - Bump golang version to 1.26.3 ([#1754](https://github.com/NVIDIA/k8s-device-plugin/issues/1754)) - Bump nvidia/distroless/go to v4.0.6-dev ([#1806](https://github.com/NVIDIA/k8s-device-plugin/issues/1806)) - Bump nvidia-container-toolkit to v1.19.1 ([#1798](https://github.com/NVIDIA/k8s-device-plugin/issues/1798)) - Always use a dedicated service account in the helm chart ([#1804](https://github.com/NVIDIA/k8s-device-plugin/issues/1804)) ### [`v0.19.1`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0191) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.19.0...v0.19.1) - wsl: report a single "all" device to kubelet ([#1699](https://github.com/NVIDIA/k8s-device-plugin/issues/1699)) - Fix CDI spec generation to respect driver root for Tegra CSV files ([#1701](https://github.com/NVIDIA/k8s-device-plugin/issues/1701)) - Bump golang from 1.26.1 to 1.26.2 ([#1704](https://github.com/NVIDIA/k8s-device-plugin/issues/1704)) * Bump nvidia/distroless/go from v4.0.3-dev to v4.0.4-dev ([#1702](https://github.com/NVIDIA/k8s-device-plugin/issues/1702)) * Bump google.golang.org/grpc from 1.79.1 to 1.79.3 ([#1711](https://github.com/NVIDIA/k8s-device-plugin/issues/1711)) * Bump the k8s.io dependencies to v1.35.4 ([#1710](https://github.com/NVIDIA/k8s-device-plugin/issues/1710)) ### [`v0.19.0`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0190) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.18.2...v0.19.0) - Add --sleep-interval=infinite support to GFD for running as a pod ([#1603](https://github.com/NVIDIA/k8s-device-plugin/issues/1603)) - Fix image tag in static deployment ([#1604](https://github.com/NVIDIA/k8s-device-plugin/issues/1604)) - Add ownerReference to NodeFeature CRs for garbage collection ([#1597](https://github.com/NVIDIA/k8s-device-plugin/issues/1597)) - Change default value for gds, gdrcopy and mofed flags ([#1550](https://github.com/NVIDIA/k8s-device-plugin/issues/1550)) - Fix healthchecking on old devices ([#1562](https://github.com/NVIDIA/k8s-device-plugin/issues/1562)) - Enable NodeFeature API by default in GFD ([#1504](https://github.com/NVIDIA/k8s-device-plugin/issues/1504)) - Build multiarch images on native GitHub runners ([#1468](https://github.com/NVIDIA/k8s-device-plugin/issues/1468)) ### [`v0.18.2`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0182) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.18.1...v0.18.2) - Ensure that cdi.FeatureFlags are passed to CDI library - Fix race condition in config-manager when label is unset - Fix nested container use cases by ensuring that IPC sockets are not mounted readonly - Bump NVIDIA Container Toolkit to v1.18.2 - Bump distroless base image to v3.2.2-dev ### [`v0.18.1`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0181) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.18.0...v0.18.1) - Allow CDI feature flags to be set - Pass driver root to nvinfo.New in device plugin main - Bump NVIDIA Container Toolkit to v1.18.1 - Bump distroless base image to v3.2.1-dev - Bump github.com/opencontainers/selinux from 1.12.0 to 1.13.1 ([#1506](https://github.com/NVIDIA/k8s-device-plugin/issues/1506)) ### [`v0.18.0`](https://github.com/NVIDIA/k8s-device-plugin/blob/HEAD/CHANGELOG.md#v0180) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.4...v0.18.0) - Rename getHealthCheckXids and clarify documentation - Add support for explicitly enabling XIDs in health checks - Deduplicate requested device IDs - Check for nil before reading boolean config values - Make gated modes (GDS, MOFED, GDRCOPY) optional in CDI - Add support for setting gdrcopyEnabled - Ignore errors getting device memory using NVML - Ensure that directory volumes have Directory type - Switch to plain golang image for builds - Remove unneeded intermediate container - Update CI definitions - Switch to distroless golang image - Update README.md with RuntimeClass - Pass a single context throughout the device-plugin method call stack ([#1284](https://github.com/NVIDIA/k8s-device-plugin/issues/1284)) - Remove internal logger in favour of klog ([#1277](https://github.com/NVIDIA/k8s-device-plugin/issues/1277)) - Remove FAIL\_ON\_INIT\_ERROR from static examples - Detect blackwell architecture - Updated .release:staging to stage device-plugin images in nvstaging - Use MiB instead of MB for gpu-memory - Ignore XID error 109 - Update README.md adjust set docker runtime default - Remove nvidia.com/gpu.imex-domain label - Fix containerd runc config error when creating a kind cluster - Use stable nividia-container-toolkit repo when creating a kind cluster - Switch to context package in go stdlib - Raise a warning instead of an error if GPU mode labeler fails - Add ada-lovelace architecture label for compute capability 8.9 - Ensure FAIL\_ON\_INIT\_ERROR boolean env is quoted - Honor fail-on-init-error when no resources are found - Enable hostPID in the mps-control-daemon pod ([#1045](https://github.com/NVIDIA/k8s-device-plugin/issues/1045)) ### [`v0.17.4`](https://github.com/NVIDIA/k8s-device-plugin/releases/tag/v0.17.4) [Compare Source](https://github.com/NVIDIA/k8s-device-plugin/compare/v0.17.3...v0.17.4) #### What's Changed - Bump slackapi/slack-github-action from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#1317](https://github.com/NVIDIA/k8s-device-plugin/pull/1317) - Bump github.com/NVIDIA/go-nvlib from 0.7.2 to 0.7.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#1346](https://github.com/NVIDIA/k8s-device-plugin/pull/1346) - Bump golang from 1.23.11 to 1.23.12 in /deployments/devel by [@dependabot](https://github.com/dependabot)\[bot] in [#1355](https:/…

cert-manager-prow Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Mar 5, 2026

putongyong mentioned this pull request Mar 5, 2026

fix: use deterministic name for next-private-key Secret to prevent ra… #8539

Closed

ThatsMrTalbot reviewed Mar 5, 2026

View reviewed changes

refactor: simplified code by using new delete secret function signature.

8c75c19

Signed-off-by: putongyong <xieyong0226@gmail.com>

putongyong mentioned this pull request Mar 6, 2026

v1.19.3: Internal keymanager race condition triggers InvalidCertificate backoff when using external issuers (Google CAS) #8514

Closed

refactor: using ptr.Deref for checking skipped secret name.

3eb3311

Signed-off-by: putongyong <xieyong0226@gmail.com>

ThatsMrTalbot reviewed Mar 6, 2026

View reviewed changes

fix: return result of delete secret resources.

f2bdbe1

Signed-off-by: putongyong <xieyong0226@gmail.com>

ThatsMrTalbot reviewed Mar 14, 2026

View reviewed changes

fix: put back log message for cleaning up secrets duplicates.

1e9364b

Signed-off-by: putongyong <xieyong0226@gmail.com>

cert-manager-prow Bot added ok-to-test and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 14, 2026

lint: corrected import package order.

9812155

Signed-off-by: putongyong <xieyong0226@gmail.com>

cert-manager-prow Bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Mar 14, 2026

cert-manager-prow Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 14, 2026

cert-manager-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 14, 2026

cert-manager-prow Bot added kind/bug Categorizes issue or PR as related to a bug. and removed needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Mar 14, 2026

cert-manager-prow Bot merged commit 330e711 into cert-manager:master Mar 14, 2026
6 checks passed

Conversation

putongyong commented Mar 5, 2026

Pull Request Motivation

Kind

Release Note

Uh oh!

cert-manager-prow Bot commented Mar 5, 2026

Pull Request Motivation

Kind

Release Note

Uh oh!

cert-manager-prow Bot commented Mar 5, 2026

Uh oh!

putongyong commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

putongyong commented Mar 5, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

putongyong commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

putongyong commented Mar 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

putongyong commented Mar 9, 2026

Uh oh!

putongyong commented Mar 12, 2026

Uh oh!

ThatsMrTalbot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ThatsMrTalbot commented Mar 14, 2026

Uh oh!

ThatsMrTalbot commented Mar 14, 2026

Uh oh!

putongyong commented Mar 14, 2026

Uh oh!

ThatsMrTalbot commented Mar 14, 2026

Uh oh!

ThatsMrTalbot commented Mar 14, 2026

Uh oh!

cert-manager-prow Bot commented Mar 14, 2026

Uh oh!

putongyong commented Mar 14, 2026

Uh oh!

ThatsMrTalbot commented Mar 14, 2026

Uh oh!

Uh oh!

wallrj-cyberark commented Jul 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

putongyong commented Mar 5, 2026 •

edited

Loading

putongyong commented Mar 6, 2026 •

edited

Loading