fields is 5 minutes. Cannot be set if the
Profile specifies the key and certificate encryption algorithms and the HMAC algorithm used to create the PKCS12 keystore. Default value is LegacyRC2 for backward compatibility.
: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
: Less secure algorithm. Use this option for maximal compatibility.
: Secure algorithm. Use this option in case you have to always use secure algorithms (e.g., because of company policy). Please note that the security of the algorithm is not that important in reality, because the unencrypted certificate and private key are also stored in the Secret.
: Encodes PKCS#12 files using algorithms that are considered modern as of 2026. Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC. The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256. Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher, or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements.
@@ -5956,7 +6395,7 @@ description: >-
VaultAuth
(Appears on: VaultIssuer)
-
VaultAuth is configuration used to authenticate with a Vault server. The order of precedence is [tokenSecretRef, appRole, clientCertificate or kubernetes].
+
VaultAuth is configuration used to authenticate with a Vault server. The order of precedence is [tokenSecretRef, appRole, clientCertificate, kubernetes, aws].
@@ -6016,6 +6455,19 @@ description: >-
Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server.
+
+
+ aws
+
+
+ VaultAWSAuth
+
+ |
+
+ (Optional)
+ AWS authenticates with Vault using AWS IAM authentication. This allows authentication using IAM roles for service accounts (IRSA), EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+ |
+
VaultClientCertificateAuth
@@ -6324,6 +6776,76 @@ description: >-
Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. Only one of CyberArk Certificate Manager may be specified.
+
+
+ ngts
+
+
+ VenafiNGTS
+
+ |
+
+ (Optional)
+ NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+ |
+
+
+
+
VenafiNGTS
+
(Appears on: VenafiIssuer)
+
+
VenafiNGTS defines connection configuration for the Palo Alto Networks Next Generation Trust Services (NGTS) platform using OAuth 2.0 Client Credentials.
+
+
+
+
+ | Field |
+ Description |
+
+
+
+
+
+ url
+
+ string
+ |
+
+ (Optional)
+ URL is the base URL for the NGTS API endpoint. Defaults to “https://api.strata.paloaltonetworks.com/ngts” if not set.
+ |
+
+
+
+ tokenEndpoint
+
+ string
+ |
+
+ (Optional)
+ TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, for example “https://auth.apps.paloaltonetworks.com/oauth2/access_token”. Defaults to “https://auth.apps.paloaltonetworks.com/oauth2/access_token” if not set.
+ |
+
+
+
+ tsgID
+
+ string
+ |
+
+ TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, for example “1234567890”. The tsg_id: prefix is added automatically. This field is required.
+ |
+
+
+
+ credentialsRef
+
+ github.com/cert-manager/cert-manager/pkg/apis/meta/v1.LocalObjectReference
+ |
+
+ CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 Client ID and Client Secret. The secret must contain the keys ‘client-id’ and ‘client-secret’.
+ |
+
VenafiTPP
@@ -6607,6 +7129,16 @@ description: >-
Defines the ability to run the http01 solver as root for troubleshooting issues
+
+
+ solverRuntimeClassName
+
+ string
+ |
+
+ Defines the runtime class used when spawning new ACME HTTP01 challenge solver pods.
+ |
+
solverNameservers
@@ -6617,6 +7149,16 @@ description: >-
A list of comma separated dns server endpoints used for ACME HTTP01 check requests. This should be a list containing host and port, for example [“8.8.8.8:53”,“8.8.4.4:53”] Allows specifying a list of custom nameservers to perform HTTP01 checks on.
|
+
+
+ solverExtraLabels
+
+ map[string]string
+ |
+
+ Extra labels applied to all dynamically-created ACME HTTP01 solver resources (pods, services, ingresses, or Gateway API HTTPRoutes). Applied in addition to the standard ACME challenge identification labels. The following ACME identity label keys are reserved and will be silently ignored: acme.cert-manager.io/http-domain, acme.cert-manager.io/http-token, acme.cert-manager.io/http01-solver.
+ |
+
ControllerConfiguration
@@ -6750,7 +7292,7 @@ description: >-
Whether gateway API integration is enabled within cert-manager. The ExperimentalGatewayAPISupport feature gate must also be enabled (default as of 1.15).
-Deprecated: use GatewayAPIConfig.Enabled instead.
+ Deprecated: use GatewayAPIConfig.Enabled instead.
|
@@ -6761,19 +7303,7 @@ description: >-
|
Specifies whether the ListenerSet controller should be enabled with-in cert-manager. This along with ListenerSet feature gate enabled allows the user to consume ListenerSet for self-service TLS.
-Deprecated: use GatewayAPIConfig.EnableListenerSet instead.
- |
-
-
-
- gatewayAPI
-
-
- GatewayAPIConfig
-
- |
-
- gatewayAPI configures Gateway API integration options for cert-manager.
+ Deprecated: use GatewayAPIConfig.EnableListenerSet instead.
|
@@ -6926,6 +7456,18 @@ description: >-
pemSizeLimitsConfig configures the maximum sizes for PEM-encoded data
+
+
+ gatewayAPI,omitzero
+
+
+ GatewayAPIConfig
+
+ |
+
+ gatewayAPI configures the behaviour of the Gateway API integration
+ |
+
certificateRequestMinimumBackoffDuration
@@ -6933,13 +7475,23 @@ description: >-
github.com/cert-manager/cert-manager/pkg/apis/config/shared/v1alpha1.Duration
|
- CertificateRequestMinimumBackoffDuration configures the initial backoff duration when a certificate request fails. This duration is exponentially increased (up to a maximum of 32 hours) based on the number of consecutive failures.
+ certificateRequestMinimumBackoffDuration configures the minimum backoff duration when a certificate request fails (default 1h). The backoff delay starts at this value and is exponentially increased with each consecutive failure, up to the configured maximum backoff duration.
+ |
+
+
+
+ certificateRequestMaximumBackoffDuration
+
+ github.com/cert-manager/cert-manager/pkg/apis/config/shared/v1alpha1.Duration
+ |
+
+ certificateRequestMaximumBackoffDuration configures the maximum backoff duration when a certificate request fails. The backoff delay starts at the minimum backoff duration and is exponentially increased with each consecutive failure, but will never exceed this maximum (default 32h).
|
GatewayAPIConfig
-
(Appears on: ControllerConfiguration)
+
(Appears on: ControllerConfiguration)
@@ -6976,7 +7528,7 @@ description: >-
[]string
|
- ExtraProtocols is a list of additional Gateway Listener protocol types that the Gateway API shim should treat as TLS-capable. By default, only HTTPS and TLS protocol types are processed.
+ ExtraProtocols is a list of additional Gateway Listener protocol types that the Gateway API shim should treat as TLS-capable. By default, only HTTPS and TLS protocol types are processed. Each entry must exactly match the protocol string as it appears on the Gateway Listener, e.g. “DTLS”.
|
@@ -7293,4 +7845,4 @@ description: >-
-
Generated with gen-crd-api-reference-docs on git commit 0bca8fd.
+
Generated with gen-crd-api-reference-docs on git commit ae67234.
diff --git a/content/docs/releases/release-notes/release-notes-1.21.md b/content/docs/releases/release-notes/release-notes-1.21.md
index e4397c93721..33a167f9a2a 100644
--- a/content/docs/releases/release-notes/release-notes-1.21.md
+++ b/content/docs/releases/release-notes/release-notes-1.21.md
@@ -3,11 +3,31 @@ title: Release 1.21
description: 'cert-manager release notes: cert-manager 1.21'
---
+:::warning
+These are **draft release notes**. cert-manager v1.21 is currently a pre-release and is **not recommended for use in production**. The final release notes will be published when v1.21.0 is released.
+:::
+
cert-manager v1.21 includes:
-- Removal of the default `tokenrequest` RBAC from the Helm chart (breaking change)
-- Removal of Challenge and Order write permissions from the `cert-manager-edit` aggregate ClusterRole (breaking change)
-- Removal of configurable metrics path and port name Helm values (breaking change)
+**New features:**
+- ACME Renewal Information (ARI / RFC 9773) support via the `ACMEUseARI` feature gate
+- AWS IAM authentication (IRSA, EKS Pod Identity, ambient EC2/ECS) for the Vault issuer
+- Modern2026 PKCS#12 encoding profile (FIPS 140-3 compatible)
+- Certificate renewal policies
+- `waitInsteadOfSelfCheck` solver option — skip cert-manager's self-check for split-horizon DNS or NAT hairpin environments
+- `--certificate-request-maximum-backoff-duration` flag — cap the exponential retry backoff for failed CertificateRequests
+- Webhook serving certificate renewal fixed after system suspend or VM live migration
+- Venafi OAuth token observability and `AuthFailed` Issuer condition; PANW NGTS support added
+- Gateway API: HTTP01 ListenerSet parentRef fallback annotation; additional listener protocols; `CAInjectorMerging` promoted to GA
+- cainjector `--ignore-namespaces` flag
+- `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods
+- `startupapicheck.ttlSecondsAfterFinished` Helm value for automatic Job cleanup
+- `--acme-http01-solver-extra-labels` flag to propagate `global.commonLabels` to solver resources
+
+**Breaking changes:**
+- Removal of the default `tokenrequest` RBAC from the Helm chart
+- Removal of Challenge and Order write permissions from the `cert-manager-edit` aggregate ClusterRole
+- Removal of configurable metrics path and port name Helm values
## Major Themes
@@ -154,66 +174,297 @@ resume.
More details are available in the PR:
https://github.com/cert-manager/cert-manager/pull/8464.
+### ACME Renewal Information (ARI) support
+
+cert-manager 1.21 adds experimental support for RFC 9773 ACME Renewal
+Information (ARI), behind the `ACMEUseARI` feature gate. When enabled, and when
+the ACME server advertises a `renewalInfo` endpoint, cert-manager queries the
+server for its recommended renewal window before deciding whether to re-issue a
+certificate. This allows ACME servers — including Let's Encrypt — to proactively
+prompt renewal of certificates affected by mass revocations or CA key rollovers,
+without requiring operators to intervene.
+
+([cert-manager/cert-manager#8798](https://github.com/cert-manager/cert-manager/pull/8798),
+[@hjoshi123](https://github.com/hjoshi123))
+
+### AWS IAM authentication for the Vault issuer
+
+The Vault issuer now supports AWS IAM-based authentication in three modes:
+
+- **IRSA (IAM Roles for Service Accounts)**: the cert-manager controller pod
+ assumes an AWS IAM role via Kubernetes projected service account tokens.
+- **EKS Pod Identity**: authentication via the EKS Pod Identity agent sidecar.
+- **Ambient credentials**: uses the EC2/ECS instance metadata service when
+ running on AWS without an explicitly configured role.
+
+All three modes avoid the need to store long-lived AWS credentials as Kubernetes
+Secrets.
+
+([cert-manager/cert-manager#8422](https://github.com/cert-manager/cert-manager/pull/8422),
+[@bitloi](https://github.com/bitloi))
+
+### Modern2026 PKCS#12 encoding profile
+
+cert-manager 1.21 adds the `Modern2026` profile for PKCS#12 output, based on
+the `go-pkcs12` library's Modern2026 encoder. This profile uses FIPS 140-3
+approved algorithms (AES-256 + SHA-256 KDFs) instead of the legacy 3DES/RC2
+defaults. It is suitable for environments with FIPS or compliance requirements
+that prohibit older cipher suites.
+
+([cert-manager/cert-manager#8841](https://github.com/cert-manager/cert-manager/pull/8841),
+[@seanorama](https://github.com/seanorama))
+
+### Certificate renewal policies
+
+cert-manager 1.21 adds `renewalPolicies` to the Certificate API, allowing
+operators to fine-tune when cert-manager triggers a renewal. This complements the
+existing `renewBefore` and `renewBeforePercentage` fields, providing more
+expressive control over renewal scheduling.
+
+([cert-manager/cert-manager#8258](https://github.com/cert-manager/cert-manager/pull/8258),
+[@hjoshi123](https://github.com/hjoshi123))
+
+### Gateway API improvements
+
+Several improvements to the Gateway API integration land in 1.21:
+
+- **HTTP01 ListenerSet parentRef fallback**: the new
+ `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes
+ cert-manager to use the parent Gateway as the solver HTTPRoute parentRef
+ instead of the ListenerSet. This enables TLS-only ListenerSets (which cannot
+ receive HTTP challenges) to rely on a shared Gateway HTTP listener for ACME
+ validation.
+ ([#8749](https://github.com/cert-manager/cert-manager/pull/8749),
+ [@apkatsikas](https://github.com/apkatsikas))
+
+- **`cert-manager.io/ignore-tls-listeners` annotation**: allows Gateway TLS
+ listeners to be excluded from certificate management, useful when some
+ listeners are managed by a different controller.
+ ([#8727](https://github.com/cert-manager/cert-manager/pull/8727),
+ [@hjoshi123](https://github.com/hjoshi123))
+
+- **Additional listener protocols**: the Gateway API integration now recognizes
+ configurable listener protocols beyond the default set, making cert-manager
+ compatible with custom protocol extensions.
+ ([#8683](https://github.com/cert-manager/cert-manager/pull/8683),
+ [@ThatsMrTalbot](https://github.com/ThatsMrTalbot))
+
+- **`enableGatewayAPI` configuration restructure**: the `enableGatewayAPI` and
+ `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are
+ deprecated in favor of a `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`
+ sub-struct. The old fields continue to work.
+ ([#8732](https://github.com/cert-manager/cert-manager/pull/8732),
+ [@ThatsMrTalbot](https://github.com/ThatsMrTalbot))
+
+### cainjector improvements
+
+- **`CAInjectorMerging` promoted to GA**: the `CAInjectorMerging` feature gate is
+ now unconditionally enabled and will be removed in a future release. This
+ changes how cainjector merges CA data into webhook and API service objects.
+ ([#8583](https://github.com/cert-manager/cert-manager/pull/8583))
+
+- **Server-side apply unconditional**: cainjector now always uses server-side
+ apply (SSA) to patch CA bundles, and the `ServerSideApply` feature gate is
+ deprecated. SSA removes the last-applied-configuration annotation bloat and
+ makes conflict detection more reliable.
+ ([#8692](https://github.com/cert-manager/cert-manager/pull/8692),
+ [@erikgb](https://github.com/erikgb))
+
+- **`--ignore-namespaces` flag**: the new cainjector flag accepts a
+ comma-separated list of namespace names that cainjector will skip when
+ watching Secrets for injection. This reduces the number of watch events in
+ clusters with a large number of namespaces or where some namespaces contain
+ large secrets that cainjector does not need.
+ ([#8614](https://github.com/cert-manager/cert-manager/pull/8614),
+ [@figaw](https://github.com/figaw))
+
+### Venafi integration updates
+
+cert-manager 1.21 adds two improvements to the Venafi/CyberArk integration:
+
+- **OAuth token observability**: a new `AuthFailed` reason on the Issuer
+ `Ready` condition distinguishes authentication failures (bad or expired
+ credentials) from transient infrastructure errors, making it easier to
+ diagnose Venafi connectivity problems.
+ ([#8808](https://github.com/cert-manager/cert-manager/pull/8808),
+ [@FelixPhipps](https://github.com/FelixPhipps))
+
+- **PANW NGTS support**: the Venafi issuer now supports PANW Next-Generation
+ Trust Services as a backend, in addition to Venafi TPP and Venafi Control
+ Plane.
+ ([#8779](https://github.com/cert-manager/cert-manager/pull/8779),
+ [@FelixPhipps](https://github.com/FelixPhipps))
+
+### ACME security hardening
+
+The ACME Challenge and Order controllers now enforce stricter resource
+ownership rules (GHSA-8rvj-mm4h-c258):
+
+- Challenges without a valid Order owner reference are rejected.
+- Order specs are now immutable after creation.
+- Pre-placed Challenges with a mismatched spec are detected and refused.
+
+This prevents a malicious actor with write access to Order or Challenge
+resources from influencing ACME validation in unexpected ways.
+
+Additionally, ACME challenges no longer permanently fail on transient network
+errors (TLS handshake timeouts, DNS resolution failures, context cancellation)
+during nonce fetches or authorization waits. The workqueue retries with
+exponential backoff instead.
+
+([cert-manager/cert-manager#8948](https://github.com/cert-manager/cert-manager/pull/8948),
+[#8760](https://github.com/cert-manager/cert-manager/pull/8760))
+
+### Notable bug fixes
+
+- **Integer overflow in `renewBeforePercentage`**: Certificates with durations
+ longer than approximately 3 years were incorrectly rejected by validation or
+ assigned incorrect renewal times due to a 32-bit integer overflow in the
+ percentage arithmetic. Fixed in
+ [#8947](https://github.com/cert-manager/cert-manager/pull/8947)
+ ([@ThatsMrTalbot](https://github.com/ThatsMrTalbot)).
+
+- **Infinite re-issuance loop**: cert-manager no longer enters an infinite
+ re-issuance loop when an issuer returns an already-expired certificate.
+ Fixed in
+ [#8610](https://github.com/cert-manager/cert-manager/pull/8610)
+ ([@onurmicoogullari](https://github.com/onurmicoogullari)).
+
+- **DNS issuer secrets validated before ready**: the DNS issuer now validates
+ that the referenced Secret exists and is well-formed before marking the issuer
+ Ready, preventing silent misconfiguration.
+ Fixed in
+ [#8255](https://github.com/cert-manager/cert-manager/pull/8255)
+ ([@Peac36](https://github.com/Peac36)).
+
+- **Vault path traversal validation**: the Vault issuer webhook now rejects
+ `..` path segments in `spec.vault.path` and auth mount path fields,
+ preventing `path.Join` from silently resolving relative segments before
+ constructing the Vault API URL.
+ Fixed in
+ [#8930](https://github.com/cert-manager/cert-manager/pull/8930).
+
+- **DNS-over-HTTPS response body unbounded read**: the DNS-over-HTTPS client
+ now caps response body reads at 128 KB, preventing a potential OOM from a
+ malicious or misconfigured DoH resolver.
+ Fixed in
+ [#8803](https://github.com/cert-manager/cert-manager/pull/8803)
+ ([@SebTardif](https://github.com/SebTardif)).
+
## Community
As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.
A special thanks to:
-- TODO
+{/* BEGIN contributors */}
+- [`@Copilot`](https://github.com/Copilot)
+- [`@FelixPhipps`](https://github.com/FelixPhipps)
+- [`@Peac36`](https://github.com/Peac36)
+- [`@SebTardif`](https://github.com/SebTardif)
+- [`@apkatsikas`](https://github.com/apkatsikas)
+- [`@bitloi`](https://github.com/bitloi)
+- [`@dap0am`](https://github.com/dap0am)
+- [`@figaw`](https://github.com/figaw)
+- [`@immanuwell`](https://github.com/immanuwell)
+- [`@jabbrwcky`](https://github.com/jabbrwcky)
+- [`@jnohlgard`](https://github.com/jnohlgard)
+- [`@jsoref`](https://github.com/jsoref)
+- [`@ltwongaa`](https://github.com/ltwongaa)
+- [`@lunarwhite`](https://github.com/lunarwhite)
+- [`@mateenali66`](https://github.com/mateenali66)
+- [`@onurmicoogullari`](https://github.com/onurmicoogullari)
+- [`@putongyong`](https://github.com/putongyong)
+- [`@seanorama`](https://github.com/seanorama)
+- [`@texasich`](https://github.com/texasich)
+{/* END contributors */}
for their contributions, comments and support!
Also, thanks to the cert-manager maintainer team for their help in this release:
-- [@inteon](https://github.com/inteon)
-- [@erikgb](https://github.com/erikgb)
-- [@SgtCoDFish](https://github.com/SgtCoDFish)
-- [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)
-- [@munnerz](https://github.com/munnerz)
-- [@maelvls](https://github.com/maelvls)
+{/* BEGIN maintainers */}
+- [`@SgtCoDFish`](https://github.com/SgtCoDFish)
+- [`@ThatsMrTalbot`](https://github.com/ThatsMrTalbot)
+- [`@erikgb`](https://github.com/erikgb)
+- [`@hjoshi123`](https://github.com/hjoshi123)
+- [`@inteon`](https://github.com/inteon)
+- [`@maelvls`](https://github.com/maelvls)
+- [`@munnerz`](https://github.com/munnerz)
+- [`@wallrj`](https://github.com/wallrj)
+- [`@wallrj-cyberark`](https://github.com/wallrj-cyberark)
+{/* END maintainers */}
And finally, thanks to the cert-manager steering committee for their feedback in this release cycle:
-- [@FlorianLiebhart](https://github.com/FlorianLiebhart)
-- [@ssyno](https://github.com/ssyno)
-- [@ianarsenault](https://github.com/ianarsenault)
-- [@TrilokGeer](https://github.com/TrilokGeer)
+{/* BEGIN steerers */}
+- [`@FlorianLiebhart`](https://github.com/FlorianLiebhart)
+- [`@TrilokGeer`](https://github.com/TrilokGeer)
+- [`@ianarsenault`](https://github.com/ianarsenault)
+- [`@ssyno`](https://github.com/ssyno)
+{/* END steerers */}
+{/* BEGIN changelog v1.21.0 */}
## `v1.21.0`
-### Feature
+Changes since `v1.20.0`:
-- Add the `waitInsteadOfSelfCheck` solver option for ACME HTTP01 and DNS01 challenges, allowing cert-manager to skip its own self-check and ask the ACME server to validate after a configured wait. See the [ACME issuer documentation](../../configuration/acme/README.md#skip-the-self-check-with-waitinsteadofselfcheck) for configuration details.
-
-### Documentation
+### Feature
-TODO
+- Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([`#8808`](https://github.com/cert-manager/cert-manager/pull/8808), [`@FelixPhipps`](https://github.com/FelixPhipps))
+- Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([`#8893`](https://github.com/cert-manager/cert-manager/pull/8893), [`@lunarwhite`](https://github.com/lunarwhite))
+- Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([`#8858`](https://github.com/cert-manager/cert-manager/pull/8858), [`@wallrj`](https://github.com/wallrj))
+- Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([`#8791`](https://github.com/cert-manager/cert-manager/pull/8791), [`@jsoref`](https://github.com/jsoref))
+- Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([`#8761`](https://github.com/cert-manager/cert-manager/pull/8761), [`@lunarwhite`](https://github.com/lunarwhite))
+- Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([`#8523`](https://github.com/cert-manager/cert-manager/pull/8523), [`@dap0am`](https://github.com/dap0am))
+- Added ARI support through the ACMEUseARI feature gate. ([`#8798`](https://github.com/cert-manager/cert-manager/pull/8798), [`@hjoshi123`](https://github.com/hjoshi123))
+- Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([`#8422`](https://github.com/cert-manager/cert-manager/pull/8422), [`@bitloi`](https://github.com/bitloi))
+- Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([`#8727`](https://github.com/cert-manager/cert-manager/pull/8727), [`@hjoshi123`](https://github.com/hjoshi123))
+- Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([`#8683`](https://github.com/cert-manager/cert-manager/pull/8683), [`@ThatsMrTalbot`](https://github.com/ThatsMrTalbot))
+- Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([`#8841`](https://github.com/cert-manager/cert-manager/pull/8841), [`@seanorama`](https://github.com/seanorama))
+- Cainjector:
+ - A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([`#8614`](https://github.com/cert-manager/cert-manager/pull/8614), [`@figaw`](https://github.com/figaw))
+- Disabled client side rate-limiting if AP&F is enabled. ([`#8757`](https://github.com/cert-manager/cert-manager/pull/8757), [`@hjoshi123`](https://github.com/hjoshi123))
+- Extend the Venafi/CyberArk integration to also support PANW NGTS. ([`#8779`](https://github.com/cert-manager/cert-manager/pull/8779), [`@FelixPhipps`](https://github.com/FelixPhipps))
+- Feat(certificate): adding certificate renewal policies ([`#8258`](https://github.com/cert-manager/cert-manager/pull/8258), [`@hjoshi123`](https://github.com/hjoshi123))
+- Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([`#8692`](https://github.com/cert-manager/cert-manager/pull/8692), [`@erikgb`](https://github.com/erikgb))
+- Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([`#8927`](https://github.com/cert-manager/cert-manager/pull/8927), [`@jabbrwcky`](https://github.com/jabbrwcky))
+- Promote the CAInjectorMerging feature gate to GA ([`#8583`](https://github.com/cert-manager/cert-manager/pull/8583), [`@Copilot`](https://github.com/apps/copilot-swe-agent))
+- When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([`#8749`](https://github.com/cert-manager/cert-manager/pull/8749), [`@apkatsikas`](https://github.com/apkatsikas))
### Bug or Regression
-- Fix webhook serving certificate not being renewed after system suspend or VM
- live migration.
- ([#8464](https://github.com/cert-manager/cert-manager/pull/8464),
- [@Peac36](https://github.com/Peac36))
+- **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 (#7213) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([`#8931`](https://github.com/cert-manager/cert-manager/pull/8931), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark))
+- ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([`#8760`](https://github.com/cert-manager/cert-manager/pull/8760), [`@texasich`](https://github.com/texasich))
+- Add dns issuer secrets validation before marking it as ready ([`#8255`](https://github.com/cert-manager/cert-manager/pull/8255), [`@Peac36`](https://github.com/Peac36))
+- Add missing issuer finalizer RBAC to the order controller to support owner references ([`#8654`](https://github.com/cert-manager/cert-manager/pull/8654), [`@erikgb`](https://github.com/erikgb))
+- ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([`#8822`](https://github.com/cert-manager/cert-manager/pull/8822), [`@lunarwhite`](https://github.com/lunarwhite))
+- Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in #8808. ([`#8843`](https://github.com/cert-manager/cert-manager/pull/8843), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark))
+- Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([`#8651`](https://github.com/cert-manager/cert-manager/pull/8651), [`@mateenali66`](https://github.com/mateenali66))
+- Fix webhook serving certificate not being renewed after system suspend. ([`#8464`](https://github.com/cert-manager/cert-manager/pull/8464), [`@Peac36`](https://github.com/Peac36))
+- Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([`#8962`](https://github.com/cert-manager/cert-manager/pull/8962), [`@hjoshi123`](https://github.com/hjoshi123))
+- Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([`#8947`](https://github.com/cert-manager/cert-manager/pull/8947), [`@ThatsMrTalbot`](https://github.com/ThatsMrTalbot))
+- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([`#8619`](https://github.com/cert-manager/cert-manager/pull/8619), [`@hjoshi123`](https://github.com/hjoshi123))
+- Fixed infinite re-issuance loop when issuer returns an already expired certificate ([`#8610`](https://github.com/cert-manager/cert-manager/pull/8610), [`@onurmicoogullari`](https://github.com/onurmicoogullari))
+- Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([`#8821`](https://github.com/cert-manager/cert-manager/pull/8821), [`@wallrj`](https://github.com/wallrj))
+- Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([`#8803`](https://github.com/cert-manager/cert-manager/pull/8803), [`@SebTardif`](https://github.com/SebTardif))
+- Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([`#8813`](https://github.com/cert-manager/cert-manager/pull/8813), [`@immanuwell`](https://github.com/immanuwell))
+- Harden ACME Challenge and Order resources: reject user-created Challenges
+ without Order ownership, enforce Order spec immutability, and detect
+ pre-placed same-name Challenges with mismatched specs. ([`#8948`](https://github.com/cert-manager/cert-manager/pull/8948), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark))
+- Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([`#8753`](https://github.com/cert-manager/cert-manager/pull/8753), [`@FelixPhipps`](https://github.com/FelixPhipps))
+- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([`#8664`](https://github.com/cert-manager/cert-manager/pull/8664), [`@jnohlgard`](https://github.com/jnohlgard))
+- Remove ACME Challenge `create` and Order `create`/`patch`/`update` from
+ the cert-manager-edit aggregate ClusterRole to prevent direct
+ manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([`#8958`](https://github.com/cert-manager/cert-manager/pull/8958), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark))
+- Remove issuer owner reference from challenges blocking challenge garbage collection ([`#8743`](https://github.com/cert-manager/cert-manager/pull/8743), [`@erikgb`](https://github.com/erikgb))
+- Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([`#8577`](https://github.com/cert-manager/cert-manager/pull/8577), [`@putongyong`](https://github.com/putongyong))
+- Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([`#8930`](https://github.com/cert-manager/cert-manager/pull/8930), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark))
### Other (Cleanup or Flake)
-- Removed Helm values `prometheus.servicemonitor.targetPort`,
- `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The
- metrics path (`/metrics`) and target port name (`http-metrics`) are now
- hardcoded. The controller Service metrics port is renamed from
- `tcp-prometheus-servicemonitor` to `http-metrics`. Users must remove these
- keys from their values overrides before upgrading. See the
- [upgrading notes](../upgrading/upgrading-1.20-1.21.md) for details.
- ([cert-manager/cert-manager#8952](https://github.com/cert-manager/cert-manager/pull/8952),
- [@erikgb](https://github.com/erikgb))
-- Removed the default `tokenrequest` Role and RoleBinding from the Helm chart
- that granted the controller ServiceAccount permission to mint tokens for
- itself. No documented workflow requires this RBAC. Users who relied on the
- undocumented pattern of pointing `serviceAccountRef.name` at the controller
- ServiceAccount must create their own Role and RoleBinding, or migrate to a
- dedicated ServiceAccount. See the
- [upgrading notes](../upgrading/upgrading-1.20-1.21.md) for details.
- ([cert-manager/cert-manager#8931](https://github.com/cert-manager/cert-manager/pull/8931),
- [@wallrj-cyberark](https://github.com/wallrj-cyberark))
+- API cleanup: removed deprecated ObjectReference ([`#8625`](https://github.com/cert-manager/cert-manager/pull/8625), [`@inteon`](https://github.com/inteon))
+- Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([`#8952`](https://github.com/cert-manager/cert-manager/pull/8952), [`@erikgb`](https://github.com/erikgb))
+- The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([`#8732`](https://github.com/cert-manager/cert-manager/pull/8732), [`@ThatsMrTalbot`](https://github.com/ThatsMrTalbot))
+- Update base images to Debian 13 ([`#8849`](https://github.com/cert-manager/cert-manager/pull/8849), [`@ltwongaa`](https://github.com/ltwongaa))
+{/* END changelog v1.21.0 */}
diff --git a/content/docs/variables.json b/content/docs/variables.json
index e41106acaeb..73abe335c26 100644
--- a/content/docs/variables.json
+++ b/content/docs/variables.json
@@ -1,3 +1,3 @@
{
- "cert_manager_latest_version": "v1.20.3"
+ "cert_manager_latest_version": "v1.21.0-beta.0"
}
diff --git a/scripts/gendocs/generate-new-import-path-docs b/scripts/gendocs/generate-new-import-path-docs
index 8b4557eee9d..950a6833b8b 100755
--- a/scripts/gendocs/generate-new-import-path-docs
+++ b/scripts/gendocs/generate-new-import-path-docs
@@ -139,7 +139,7 @@ EOF
# For final releases such as v1.20.0, DOCS_FOLDER should be `docs` (or a
# versioned docs folder name such as `v1.20-docs`), and CM_BRANCH should be
# the release branch, e.g. `release-1.20`.
-CM_BRANCH="release-1.20"
+CM_BRANCH="release-1.21"
DOCS_FOLDER="docs"
genversionwithcli "$CM_BRANCH" "$DOCS_FOLDER"