ops/homelab

Fork 0

chore(deps): update quay.io/jetstack/charts/cert-manager docker tag to v1.21.3 #128

Open

renovate-bot wants to merge 1 commit from renovate/quay.io-jetstack-charts-cert-manager-1.x into main

renovate-bot commented

2026-08-01 21:10:42 +00:00

Member

This PR contains the following updates:

Package	Update	Change
quay.io/jetstack/charts/cert-manager (source)	patch	`1.21.0` → `v1.21.3`

Release Notes

cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)

`v1.21.3`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.3 removes trust in the compromised eMudhra CA (see eMudhra Compromise). The updated base images no longer include the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes crypto/x509 reject certificate chains that pass through the compromised intermediates (CVE-2026-111943).

It also fixes an ACME ARI renewal loop, stops the controller copying a private key from a Secret that the Certificate does not own, and quotes the proxy values in the Helm chart. It updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

Added status.acme.ari.certID to track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. (#9292, @hjoshi123)
Helm chart: quote the http_proxy, https_proxy and no_proxy values when rendering the controller Deployment env vars, so values like *.example.com no longer break the manifest. (#9407, @pujitha24)
The requestmanager and issuing controllers now only consume the Secret named by status.nextPrivateKeySecretName when it carries the cert-manager.io/next-private-key label and is owned by the Certificate, matching the invariant the keymanager controller already enforces. Previously a principal able to write the certificates/status subresource, but not to read Secrets, could name any Secret in the namespace and have its private key copied into spec.secretName. The keymanager controller no longer creates the next private key Secret under the name in status.nextPrivateKeySecretName. It always uses a generated name, records a NotOwned Warning event when the field names a Secret it does not own, and repoints the field at the Secret it owns rather than deleting that Secret when the two disagree. The Secret named by spec.secretName is never treated as a next private key Secret, even if spec.secretTemplate labels it as one. (#9368, @wallrj)

Other (Cleanup or Flake)

Upgrade Go to 1.26.9, fixing CVEs in the crypto/tls, net/http, net/textproto and html/template packages. (#9444, @wallrj-cyberark)
Upgrade Go to 1.26.10, fixing a CVE in the crypto/x509 package. (#9501, @wallrj-cyberark)
Bump golang.org/x/net to v0.60.0 to fix reported security vulnerabilities (#9451)
Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace and otlptracegrpc to v1.45.0 to fix a reported security vulnerability (#9374, #9375)
Update distroless base images, removing the compromised "emSign ECC Root CA - G3" root certificate (#9351, #9414, #9493, #9495)

`v1.21.3`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

All users should upgrade.

Changes by Kind

Bug or Regression

Added status.acme.ari.certID to track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. (#9292, @hjoshi123)
Helm chart: quote the http_proxy, https_proxy and no_proxy values when rendering the controller Deployment env vars, so values like *.example.com no longer break the manifest. (#9407, @pujitha24)
The requestmanager and issuing controllers now only consume the Secret named by status.nextPrivateKeySecretName when it carries the cert-manager.io/next-private-key label and is owned by the Certificate, matching the invariant the keymanager controller already enforces. Previously a principal able to write the certificates/status subresource, but not to read Secrets, could name any Secret in the namespace and have its private key copied into spec.secretName. The keymanager controller no longer creates the next private key Secret under the name in status.nextPrivateKeySecretName. It always uses a generated name, records a NotOwned Warning event when the field names a Secret it does not own, and repoints the field at the Secret it owns rather than deleting that Secret when the two disagree. The Secret named by spec.secretName is never treated as a next private key Secret, even if spec.secretTemplate labels it as one. (#9368, @wallrj)

Other (Cleanup or Flake)

Upgrade Go to 1.26.9, fixing CVEs in the crypto/tls, net/http, net/textproto and html/template packages. (#9444, @wallrj-cyberark)
Upgrade Go to 1.26.10, fixing a CVE in the crypto/x509 package. (#9501, @wallrj-cyberark)
Bump golang.org/x/net to v0.60.0 to fix reported security vulnerabilities (#9451)
Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace and otlptracegrpc to v1.45.0 to fix a reported security vulnerability (#9374, #9375)
Update distroless base images, removing the compromised "emSign ECC Root CA - G3" root certificate (#9351, #9414, #9493, #9495)

`v1.21.2`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#9239, @FelixPhipps)
Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#9222, @FelixPhipps)
De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#9234, @speer)
Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#9240, @wieghx)
Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#9235, @lunarwhite)
Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#9278, @arpitjain099)
Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#9236, @hjoshi123)
Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#9313, @shashankvarma499)
Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#9238, @thc1006)
Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#9312, @shashankvarma499)
Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#9262, @FelixPhipps)
Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#9314, @KR-Ravindra)
The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#9232, @FelixPhipps)
The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#9231, @FelixPhipps)

Other (Cleanup or Flake)

Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. (#9151, @wallrj)
Upgrade Go to 1.26.8. (#9323, @wallrj)
Bump google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities (#9255, #9317)
Bump golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities (#9265)

`v1.21.2`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

All users should upgrade.

Changes by Kind

Bug or Regression

ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#9239, @FelixPhipps)
Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#9222, @FelixPhipps)
De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#9234, @speer)
Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#9240, @wieghx)
Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#9235, @lunarwhite)
Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#9278, @arpitjain099)
Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#9236, @hjoshi123)
Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#9313, @shashankvarma499)
Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#9238, @thc1006)
Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#9312, @shashankvarma499)
Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#9262, @FelixPhipps)
Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#9314, @KR-Ravindra)
The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#9232, @FelixPhipps)
The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#9231, @FelixPhipps)

Other (Cleanup or Flake)

Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. (#9151, @wallrj)
Upgrade Go to 1.26.8. (#9323, @wallrj)
Bump google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities (#9255, #9317)
Bump golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities (#9265)

`v1.21.1`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @sklirg)
Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @SebTardif)
Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @wallrj-cyberark)
Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#9012, @mateenali66)

Other (Cleanup or Flake)

Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)
Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#9063)
Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#9072)
Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#9073)
Update distroless base images (#9000, #9025)

`v1.21.1`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

All users should upgrade.

Changes by Kind

Bug or Regression

Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @sklirg)
Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @SebTardif)
Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @wallrj-cyberark)
Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#9012, @mateenali66)

Other (Cleanup or Flake)

Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)
Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#9063)
Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#9072)
Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#9073)
Update distroless base images (#9000, #9025)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | patch | `1.21.0` → `v1.21.3` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.3`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.3) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.3...v1.21.3) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.3 removes trust in the compromised eMudhra CA (see [eMudhra Compromise](https://cert-manager.io/docs/trust/trust-manager/#emudhra-compromise)). The updated base images no longer include the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes `crypto/x509` reject certificate chains that pass through the compromised intermediates ([CVE-2026-111943](https://pkg.go.dev/vuln/GO-2026-6809)). It also fixes an ACME ARI renewal loop, stops the controller copying a private key from a Secret that the Certificate does not own, and quotes the proxy values in the Helm chart. It updates Go and several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Added `status.acme.ari.certID` to track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. ([#9292](https://github.com/cert-manager/cert-manager/issues/9292), [@hjoshi123](https://github.com/hjoshi123)) - Helm chart: quote the `http_proxy`, `https_proxy` and `no_proxy` values when rendering the controller Deployment env vars, so values like `*.example.com` no longer break the manifest. ([#9407](https://github.com/cert-manager/cert-manager/issues/9407), [@pujitha24](https://github.com/pujitha24)) - The `requestmanager` and `issuing` controllers now only consume the Secret named by `status.nextPrivateKeySecretName` when it carries the `cert-manager.io/next-private-key` label and is owned by the Certificate, matching the invariant the `keymanager` controller already enforces. Previously a principal able to write the `certificates/status` subresource, but not to read Secrets, could name any Secret in the namespace and have its private key copied into `spec.secretName`. The `keymanager` controller no longer creates the next private key Secret under the name in `status.nextPrivateKeySecretName`. It always uses a generated name, records a `NotOwned` Warning event when the field names a Secret it does not own, and repoints the field at the Secret it owns rather than deleting that Secret when the two disagree. The Secret named by `spec.secretName` is never treated as a next private key Secret, even if `spec.secretTemplate` labels it as one. ([#9368](https://github.com/cert-manager/cert-manager/issues/9368), [@wallrj](https://github.com/wallrj)) ##### Other (Cleanup or Flake) - Upgrade Go to 1.26.9, fixing CVEs in the crypto/tls, net/http, net/textproto and html/template packages. ([#9444](https://github.com/cert-manager/cert-manager/issues/9444), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Upgrade Go to 1.26.10, fixing a CVE in the crypto/x509 package. ([#9501](https://github.com/cert-manager/cert-manager/issues/9501), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `golang.org/x/net` to v0.60.0 to fix reported security vulnerabilities ([#9451](https://github.com/cert-manager/cert-manager/issues/9451)) - Bump `go.opentelemetry.io/otel/exporters/otlp/otlptrace` and `otlptracegrpc` to v1.45.0 to fix a reported security vulnerability ([#9374](https://github.com/cert-manager/cert-manager/issues/9374), [#9375](https://github.com/cert-manager/cert-manager/issues/9375)) - Update distroless base images, removing the compromised "emSign ECC Root CA - G3" root certificate ([#9351](https://github.com/cert-manager/cert-manager/issues/9351), [#9414](https://github.com/cert-manager/cert-manager/issues/9414), [#9493](https://github.com/cert-manager/cert-manager/issues/9493), [#9495](https://github.com/cert-manager/cert-manager/issues/9495)) ### [`v1.21.3`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.3) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.2...v1.21.3) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.3 removes trust in the compromised eMudhra CA (see [eMudhra Compromise](https://cert-manager.io/docs/trust/trust-manager/#emudhra-compromise)). The updated base images no longer include the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes `crypto/x509` reject certificate chains that pass through the compromised intermediates ([CVE-2026-111943](https://pkg.go.dev/vuln/GO-2026-6809)). It also fixes an ACME ARI renewal loop, stops the controller copying a private key from a Secret that the Certificate does not own, and quotes the proxy values in the Helm chart. It updates Go and several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Added `status.acme.ari.certID` to track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. ([#9292](https://github.com/cert-manager/cert-manager/issues/9292), [@hjoshi123](https://github.com/hjoshi123)) - Helm chart: quote the `http_proxy`, `https_proxy` and `no_proxy` values when rendering the controller Deployment env vars, so values like `*.example.com` no longer break the manifest. ([#9407](https://github.com/cert-manager/cert-manager/issues/9407), [@pujitha24](https://github.com/pujitha24)) - The `requestmanager` and `issuing` controllers now only consume the Secret named by `status.nextPrivateKeySecretName` when it carries the `cert-manager.io/next-private-key` label and is owned by the Certificate, matching the invariant the `keymanager` controller already enforces. Previously a principal able to write the `certificates/status` subresource, but not to read Secrets, could name any Secret in the namespace and have its private key copied into `spec.secretName`. The `keymanager` controller no longer creates the next private key Secret under the name in `status.nextPrivateKeySecretName`. It always uses a generated name, records a `NotOwned` Warning event when the field names a Secret it does not own, and repoints the field at the Secret it owns rather than deleting that Secret when the two disagree. The Secret named by `spec.secretName` is never treated as a next private key Secret, even if `spec.secretTemplate` labels it as one. ([#9368](https://github.com/cert-manager/cert-manager/issues/9368), [@wallrj](https://github.com/wallrj)) ##### Other (Cleanup or Flake) - Upgrade Go to 1.26.9, fixing CVEs in the crypto/tls, net/http, net/textproto and html/template packages. ([#9444](https://github.com/cert-manager/cert-manager/issues/9444), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Upgrade Go to 1.26.10, fixing a CVE in the crypto/x509 package. ([#9501](https://github.com/cert-manager/cert-manager/issues/9501), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `golang.org/x/net` to v0.60.0 to fix reported security vulnerabilities ([#9451](https://github.com/cert-manager/cert-manager/issues/9451)) - Bump `go.opentelemetry.io/otel/exporters/otlp/otlptrace` and `otlptracegrpc` to v1.45.0 to fix a reported security vulnerability ([#9374](https://github.com/cert-manager/cert-manager/issues/9374), [#9375](https://github.com/cert-manager/cert-manager/issues/9375)) - Update distroless base images, removing the compromised "emSign ECC Root CA - G3" root certificate ([#9351](https://github.com/cert-manager/cert-manager/issues/9351), [#9414](https://github.com/cert-manager/cert-manager/issues/9414), [#9493](https://github.com/cert-manager/cert-manager/issues/9493), [#9495](https://github.com/cert-manager/cert-manager/issues/9495)) ### [`v1.21.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.2) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.2...v1.21.2) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. ([#9239](https://github.com/cert-manager/cert-manager/issues/9239), [@FelixPhipps](https://github.com/FelixPhipps)) - Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. ([#9222](https://github.com/cert-manager/cert-manager/issues/9222), [@FelixPhipps](https://github.com/FelixPhipps)) - De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret ([#9234](https://github.com/cert-manager/cert-manager/issues/9234), [@speer](https://github.com/speer)) - Fix certificate renewal windows using February 29 cron schedules across non-leap century years. ([#9240](https://github.com/cert-manager/cert-manager/issues/9240), [@wieghx](https://github.com/wieghx)) - Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. ([#9235](https://github.com/cert-manager/cert-manager/issues/9235), [@lunarwhite](https://github.com/lunarwhite)) - Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. ([#9278](https://github.com/cert-manager/cert-manager/issues/9278), [@arpitjain099](https://github.com/arpitjain099)) - Fixed a bug where `replaces` field was being populated for the wrong issuer on issuer changes ([#9236](https://github.com/cert-manager/cert-manager/issues/9236), [@hjoshi123](https://github.com/hjoshi123)) - Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. ([#9313](https://github.com/cert-manager/cert-manager/issues/9313), [@shashankvarma499](https://github.com/shashankvarma499)) - Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. ([#9238](https://github.com/cert-manager/cert-manager/issues/9238), [@thc1006](https://github.com/thc1006)) - Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. ([#9312](https://github.com/cert-manager/cert-manager/issues/9312), [@shashankvarma499](https://github.com/shashankvarma499)) - Fixed an issue where the body of a non-Vault HTTP response from `spec.vault.server` could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. ([#9262](https://github.com/cert-manager/cert-manager/issues/9262), [@FelixPhipps](https://github.com/FelixPhipps)) - Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects ([#9314](https://github.com/cert-manager/cert-manager/issues/9314), [@KR-Ravindra](https://github.com/KR-Ravindra)) - The ACME HTTP-01 self-check no longer reflects the fetched response body in `Challenge.status.reason`, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. ([#9232](https://github.com/cert-manager/cert-manager/issues/9232), [@FelixPhipps](https://github.com/FelixPhipps)) - The `vault` issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced `Issuer`, unless ambient credentials are explicitly enabled via `--issuer-ambient-credentials`. `ClusterIssuer` and explicit `serviceAccountRef` (IRSA) configurations are unaffected. ([#9231](https://github.com/cert-manager/cert-manager/issues/9231), [@FelixPhipps](https://github.com/FelixPhipps)) ##### Other (Cleanup or Flake) - Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. ([#9151](https://github.com/cert-manager/cert-manager/issues/9151), [@wallrj](https://github.com/wallrj)) - Upgrade Go to 1.26.8. ([#9323](https://github.com/cert-manager/cert-manager/issues/9323), [@wallrj](https://github.com/wallrj)) - Bump `google.golang.org/grpc` to v1.83.2 to fix reported security vulnerabilities ([#9255](https://github.com/cert-manager/cert-manager/issues/9255), [#9317](https://github.com/cert-manager/cert-manager/issues/9317)) - Bump `golang.org/x/crypto` to v0.56.0 to fix reported security vulnerabilities ([#9265](https://github.com/cert-manager/cert-manager/issues/9265)) ### [`v1.21.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.2) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.2) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. ([#9239](https://github.com/cert-manager/cert-manager/issues/9239), [@FelixPhipps](https://github.com/FelixPhipps)) - Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. ([#9222](https://github.com/cert-manager/cert-manager/issues/9222), [@FelixPhipps](https://github.com/FelixPhipps)) - De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret ([#9234](https://github.com/cert-manager/cert-manager/issues/9234), [@speer](https://github.com/speer)) - Fix certificate renewal windows using February 29 cron schedules across non-leap century years. ([#9240](https://github.com/cert-manager/cert-manager/issues/9240), [@wieghx](https://github.com/wieghx)) - Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. ([#9235](https://github.com/cert-manager/cert-manager/issues/9235), [@lunarwhite](https://github.com/lunarwhite)) - Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. ([#9278](https://github.com/cert-manager/cert-manager/issues/9278), [@arpitjain099](https://github.com/arpitjain099)) - Fixed a bug where `replaces` field was being populated for the wrong issuer on issuer changes ([#9236](https://github.com/cert-manager/cert-manager/issues/9236), [@hjoshi123](https://github.com/hjoshi123)) - Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. ([#9313](https://github.com/cert-manager/cert-manager/issues/9313), [@shashankvarma499](https://github.com/shashankvarma499)) - Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. ([#9238](https://github.com/cert-manager/cert-manager/issues/9238), [@thc1006](https://github.com/thc1006)) - Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. ([#9312](https://github.com/cert-manager/cert-manager/issues/9312), [@shashankvarma499](https://github.com/shashankvarma499)) - Fixed an issue where the body of a non-Vault HTTP response from `spec.vault.server` could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. ([#9262](https://github.com/cert-manager/cert-manager/issues/9262), [@FelixPhipps](https://github.com/FelixPhipps)) - Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects ([#9314](https://github.com/cert-manager/cert-manager/issues/9314), [@KR-Ravindra](https://github.com/KR-Ravindra)) - The ACME HTTP-01 self-check no longer reflects the fetched response body in `Challenge.status.reason`, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. ([#9232](https://github.com/cert-manager/cert-manager/issues/9232), [@FelixPhipps](https://github.com/FelixPhipps)) - The `vault` issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced `Issuer`, unless ambient credentials are explicitly enabled via `--issuer-ambient-credentials`. `ClusterIssuer` and explicit `serviceAccountRef` (IRSA) configurations are unaffected. ([#9231](https://github.com/cert-manager/cert-manager/issues/9231), [@FelixPhipps](https://github.com/FelixPhipps)) ##### Other (Cleanup or Flake) - Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. ([#9151](https://github.com/cert-manager/cert-manager/issues/9151), [@wallrj](https://github.com/wallrj)) - Upgrade Go to 1.26.8. ([#9323](https://github.com/cert-manager/cert-manager/issues/9323), [@wallrj](https://github.com/wallrj)) - Bump `google.golang.org/grpc` to v1.83.2 to fix reported security vulnerabilities ([#9255](https://github.com/cert-manager/cert-manager/issues/9255), [#9317](https://github.com/cert-manager/cert-manager/issues/9317)) - Bump `golang.org/x/crypto` to v0.56.0 to fix reported security vulnerabilities ([#9265](https://github.com/cert-manager/cert-manager/issues/9265)) ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-08-01 21:10:42 +00:00

chore(deps): update quay.io/jetstack/charts/cert-manager docker tag to v1.21.1 665146e514

renovate-bot force-pushed renovate/quay.io-jetstack-charts-cert-manager-1.x from 665146e514 to 9e87e10ea4

2026-09-21 19:11:28 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update quay.io/jetstack/charts/cert-manager docker tag to v1.21.1~~ to chore(deps): update quay.io/jetstack/charts/cert-manager docker tag to v1.21.2

2026-09-21 19:11:32 +00:00

renovate-bot force-pushed renovate/quay.io-jetstack-charts-cert-manager-1.x from 9e87e10ea4 to a7d506f067

2026-10-23 21:07:37 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update quay.io/jetstack/charts/cert-manager docker tag to v1.21.2~~ to chore(deps): update quay.io/jetstack/charts/cert-manager docker tag to v1.21.3

2026-10-23 21:07:40 +00:00

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/quay.io-jetstack-charts-cert-manager-1.x:renovate/quay.io-jetstack-charts-cert-manager-1.x

git switch renovate/quay.io-jetstack-charts-cert-manager-1.x

Merge

Merge the changes and update on Forgejo.

git switch main

git merge --no-ff renovate/quay.io-jetstack-charts-cert-manager-1.x

git switch renovate/quay.io-jetstack-charts-cert-manager-1.x

git rebase main

git switch main

git merge --ff-only renovate/quay.io-jetstack-charts-cert-manager-1.x

git switch renovate/quay.io-jetstack-charts-cert-manager-1.x

git rebase main

git switch main

git merge --no-ff renovate/quay.io-jetstack-charts-cert-manager-1.x

git switch main

git merge --squash renovate/quay.io-jetstack-charts-cert-manager-1.x

git switch main

git merge --ff-only renovate/quay.io-jetstack-charts-cert-manager-1.x

git switch main

git merge renovate/quay.io-jetstack-charts-cert-manager-1.x

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ops/homelab!128

No description provided.

Rows
Columns