From a9530708e4fd1d0b0eabb0e1d987ddac08e01d82 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Wed, 1 Jul 2026 06:16:41 +0000 Subject: [PATCH 1/6] Generate community and changelog sections for 1.21 release notes Populate the contributors, maintainers, steering committee, and v1.21.0 changelog sections using the release-notes generator tool (scripts/release-notes). Signed-off-by: Richard Wall --- .../release-notes/release-notes-1.21.md | 130 +++++++++++++----- 1 file changed, 92 insertions(+), 38 deletions(-) diff --git a/content/docs/releases/release-notes/release-notes-1.21.md b/content/docs/releases/release-notes/release-notes-1.21.md index e4397c93721..f44747aa4a0 100644 --- a/content/docs/releases/release-notes/release-notes-1.21.md +++ b/content/docs/releases/release-notes/release-notes-1.21.md @@ -160,60 +160,114 @@ As always, we'd like to thank all of the community members who helped in this re A special thanks to: -- TODO +{/* BEGIN contributors */} +- [`@Copilot`](https://github.com/Copilot) +- [`@FelixPhipps`](https://github.com/FelixPhipps) +- [`@Peac36`](https://github.com/Peac36) +- [`@SebTardif`](https://github.com/SebTardif) +- [`@apkatsikas`](https://github.com/apkatsikas) +- [`@bitloi`](https://github.com/bitloi) +- [`@dap0am`](https://github.com/dap0am) +- [`@figaw`](https://github.com/figaw) +- [`@immanuwell`](https://github.com/immanuwell) +- [`@jabbrwcky`](https://github.com/jabbrwcky) +- [`@jnohlgard`](https://github.com/jnohlgard) +- [`@jsoref`](https://github.com/jsoref) +- [`@ltwongaa`](https://github.com/ltwongaa) +- [`@lunarwhite`](https://github.com/lunarwhite) +- [`@mateenali66`](https://github.com/mateenali66) +- [`@onurmicoogullari`](https://github.com/onurmicoogullari) +- [`@putongyong`](https://github.com/putongyong) +- [`@seanorama`](https://github.com/seanorama) +- [`@texasich`](https://github.com/texasich) +{/* END contributors */} for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: -- [@inteon](https://github.com/inteon) -- [@erikgb](https://github.com/erikgb) -- [@SgtCoDFish](https://github.com/SgtCoDFish) -- [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) -- [@munnerz](https://github.com/munnerz) -- [@maelvls](https://github.com/maelvls) +{/* BEGIN maintainers */} +- [`@SgtCoDFish`](https://github.com/SgtCoDFish) +- [`@ThatsMrTalbot`](https://github.com/ThatsMrTalbot) +- [`@erikgb`](https://github.com/erikgb) +- [`@hjoshi123`](https://github.com/hjoshi123) +- [`@inteon`](https://github.com/inteon) +- [`@maelvls`](https://github.com/maelvls) +- [`@munnerz`](https://github.com/munnerz) +- [`@wallrj`](https://github.com/wallrj) +- [`@wallrj-cyberark`](https://github.com/wallrj-cyberark) +{/* END maintainers */} And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: -- [@FlorianLiebhart](https://github.com/FlorianLiebhart) -- [@ssyno](https://github.com/ssyno) -- [@ianarsenault](https://github.com/ianarsenault) -- [@TrilokGeer](https://github.com/TrilokGeer) +{/* BEGIN steerers */} +- [`@FlorianLiebhart`](https://github.com/FlorianLiebhart) +- [`@TrilokGeer`](https://github.com/TrilokGeer) +- [`@ianarsenault`](https://github.com/ianarsenault) +- [`@ssyno`](https://github.com/ssyno) +{/* END steerers */} +{/* BEGIN changelog v1.21.0 */} ## `v1.21.0` -### Feature - -- Add the `waitInsteadOfSelfCheck` solver option for ACME HTTP01 and DNS01 challenges, allowing cert-manager to skip its own self-check and ask the ACME server to validate after a configured wait. See the [ACME issuer documentation](../../configuration/acme/README.md#skip-the-self-check-with-waitinsteadofselfcheck) for configuration details. +Changes since `v1.20.0`: -### Documentation +### Feature -TODO +- Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([`#8808`](https://github.com/cert-manager/cert-manager/pull/8808), [`@FelixPhipps`](https://github.com/FelixPhipps)) +- Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([`#8893`](https://github.com/cert-manager/cert-manager/pull/8893), [`@lunarwhite`](https://github.com/lunarwhite)) +- Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([`#8858`](https://github.com/cert-manager/cert-manager/pull/8858), [`@wallrj`](https://github.com/wallrj)) +- Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([`#8791`](https://github.com/cert-manager/cert-manager/pull/8791), [`@jsoref`](https://github.com/jsoref)) +- Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([`#8761`](https://github.com/cert-manager/cert-manager/pull/8761), [`@lunarwhite`](https://github.com/lunarwhite)) +- Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([`#8523`](https://github.com/cert-manager/cert-manager/pull/8523), [`@dap0am`](https://github.com/dap0am)) +- Added ARI support through the ACMEUseARI feature gate. ([`#8798`](https://github.com/cert-manager/cert-manager/pull/8798), [`@hjoshi123`](https://github.com/hjoshi123)) +- Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([`#8422`](https://github.com/cert-manager/cert-manager/pull/8422), [`@bitloi`](https://github.com/bitloi)) +- Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([`#8727`](https://github.com/cert-manager/cert-manager/pull/8727), [`@hjoshi123`](https://github.com/hjoshi123)) +- Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([`#8683`](https://github.com/cert-manager/cert-manager/pull/8683), [`@ThatsMrTalbot`](https://github.com/ThatsMrTalbot)) +- Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([`#8841`](https://github.com/cert-manager/cert-manager/pull/8841), [`@seanorama`](https://github.com/seanorama)) +- Cainjector: + - A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([`#8614`](https://github.com/cert-manager/cert-manager/pull/8614), [`@figaw`](https://github.com/figaw)) +- Disabled client side rate-limiting if AP&F is enabled. ([`#8757`](https://github.com/cert-manager/cert-manager/pull/8757), [`@hjoshi123`](https://github.com/hjoshi123)) +- Extend the Venafi/CyberArk integration to also support PANW NGTS. ([`#8779`](https://github.com/cert-manager/cert-manager/pull/8779), [`@FelixPhipps`](https://github.com/FelixPhipps)) +- Feat(certificate): adding certificate renewal policies ([`#8258`](https://github.com/cert-manager/cert-manager/pull/8258), [`@hjoshi123`](https://github.com/hjoshi123)) +- Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([`#8692`](https://github.com/cert-manager/cert-manager/pull/8692), [`@erikgb`](https://github.com/erikgb)) +- Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([`#8927`](https://github.com/cert-manager/cert-manager/pull/8927), [`@jabbrwcky`](https://github.com/jabbrwcky)) +- Promote the CAInjectorMerging feature gate to GA ([`#8583`](https://github.com/cert-manager/cert-manager/pull/8583), [`@Copilot`](https://github.com/apps/copilot-swe-agent)) +- When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([`#8749`](https://github.com/cert-manager/cert-manager/pull/8749), [`@apkatsikas`](https://github.com/apkatsikas)) ### Bug or Regression -- Fix webhook serving certificate not being renewed after system suspend or VM - live migration. - ([#8464](https://github.com/cert-manager/cert-manager/pull/8464), - [@Peac36](https://github.com/Peac36)) +- **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 (#7213) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([`#8931`](https://github.com/cert-manager/cert-manager/pull/8931), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark)) +- ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([`#8760`](https://github.com/cert-manager/cert-manager/pull/8760), [`@texasich`](https://github.com/texasich)) +- Add dns issuer secrets validation before marking it as ready ([`#8255`](https://github.com/cert-manager/cert-manager/pull/8255), [`@Peac36`](https://github.com/Peac36)) +- Add missing issuer finalizer RBAC to the order controller to support owner references ([`#8654`](https://github.com/cert-manager/cert-manager/pull/8654), [`@erikgb`](https://github.com/erikgb)) +- ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([`#8822`](https://github.com/cert-manager/cert-manager/pull/8822), [`@lunarwhite`](https://github.com/lunarwhite)) +- Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in #8808. ([`#8843`](https://github.com/cert-manager/cert-manager/pull/8843), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark)) +- Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([`#8651`](https://github.com/cert-manager/cert-manager/pull/8651), [`@mateenali66`](https://github.com/mateenali66)) +- Fix webhook serving certificate not being renewed after system suspend. ([`#8464`](https://github.com/cert-manager/cert-manager/pull/8464), [`@Peac36`](https://github.com/Peac36)) +- Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([`#8962`](https://github.com/cert-manager/cert-manager/pull/8962), [`@hjoshi123`](https://github.com/hjoshi123)) +- Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([`#8947`](https://github.com/cert-manager/cert-manager/pull/8947), [`@ThatsMrTalbot`](https://github.com/ThatsMrTalbot)) +- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([`#8619`](https://github.com/cert-manager/cert-manager/pull/8619), [`@hjoshi123`](https://github.com/hjoshi123)) +- Fixed infinite re-issuance loop when issuer returns an already expired certificate ([`#8610`](https://github.com/cert-manager/cert-manager/pull/8610), [`@onurmicoogullari`](https://github.com/onurmicoogullari)) +- Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([`#8821`](https://github.com/cert-manager/cert-manager/pull/8821), [`@wallrj`](https://github.com/wallrj)) +- Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([`#8803`](https://github.com/cert-manager/cert-manager/pull/8803), [`@SebTardif`](https://github.com/SebTardif)) +- Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([`#8813`](https://github.com/cert-manager/cert-manager/pull/8813), [`@immanuwell`](https://github.com/immanuwell)) +- Harden ACME Challenge and Order resources: reject user-created Challenges + without Order ownership, enforce Order spec immutability, and detect + pre-placed same-name Challenges with mismatched specs. ([`#8948`](https://github.com/cert-manager/cert-manager/pull/8948), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark)) +- Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([`#8753`](https://github.com/cert-manager/cert-manager/pull/8753), [`@FelixPhipps`](https://github.com/FelixPhipps)) +- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([`#8664`](https://github.com/cert-manager/cert-manager/pull/8664), [`@jnohlgard`](https://github.com/jnohlgard)) +- Remove ACME Challenge `create` and Order `create`/`patch`/`update` from + the cert-manager-edit aggregate ClusterRole to prevent direct + manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([`#8958`](https://github.com/cert-manager/cert-manager/pull/8958), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark)) +- Remove issuer owner reference from challenges blocking challenge garbage collection ([`#8743`](https://github.com/cert-manager/cert-manager/pull/8743), [`@erikgb`](https://github.com/erikgb)) +- Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([`#8577`](https://github.com/cert-manager/cert-manager/pull/8577), [`@putongyong`](https://github.com/putongyong)) +- Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([`#8930`](https://github.com/cert-manager/cert-manager/pull/8930), [`@wallrj-cyberark`](https://github.com/wallrj-cyberark)) ### Other (Cleanup or Flake) -- Removed Helm values `prometheus.servicemonitor.targetPort`, - `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The - metrics path (`/metrics`) and target port name (`http-metrics`) are now - hardcoded. The controller Service metrics port is renamed from - `tcp-prometheus-servicemonitor` to `http-metrics`. Users must remove these - keys from their values overrides before upgrading. See the - [upgrading notes](../upgrading/upgrading-1.20-1.21.md) for details. - ([cert-manager/cert-manager#8952](https://github.com/cert-manager/cert-manager/pull/8952), - [@erikgb](https://github.com/erikgb)) -- Removed the default `tokenrequest` Role and RoleBinding from the Helm chart - that granted the controller ServiceAccount permission to mint tokens for - itself. No documented workflow requires this RBAC. Users who relied on the - undocumented pattern of pointing `serviceAccountRef.name` at the controller - ServiceAccount must create their own Role and RoleBinding, or migrate to a - dedicated ServiceAccount. See the - [upgrading notes](../upgrading/upgrading-1.20-1.21.md) for details. - ([cert-manager/cert-manager#8931](https://github.com/cert-manager/cert-manager/pull/8931), - [@wallrj-cyberark](https://github.com/wallrj-cyberark)) +- API cleanup: removed deprecated ObjectReference ([`#8625`](https://github.com/cert-manager/cert-manager/pull/8625), [`@inteon`](https://github.com/inteon)) +- Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([`#8952`](https://github.com/cert-manager/cert-manager/pull/8952), [`@erikgb`](https://github.com/erikgb)) +- The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([`#8732`](https://github.com/cert-manager/cert-manager/pull/8732), [`@ThatsMrTalbot`](https://github.com/ThatsMrTalbot)) +- Update base images to Debian 13 ([`#8849`](https://github.com/cert-manager/cert-manager/pull/8849), [`@ltwongaa`](https://github.com/ltwongaa)) +{/* END changelog v1.21.0 */} From 3575880a2d66587cfbaa0cd3c057c90fc015ccc0 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Wed, 1 Jul 2026 07:45:17 +0000 Subject: [PATCH 2/6] Bump cert_manager_latest_version to v1.21.0-beta.0 Signed-off-by: Richard Wall --- content/docs/variables.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/docs/variables.json b/content/docs/variables.json index e41106acaeb..73abe335c26 100644 --- a/content/docs/variables.json +++ b/content/docs/variables.json @@ -1,3 +1,3 @@ { - "cert_manager_latest_version": "v1.20.3" + "cert_manager_latest_version": "v1.21.0-beta.0" } From 2b1dbfd0f856a0e924cb36a7cead0740ffa1cb37 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Wed, 1 Jul 2026 08:02:49 +0000 Subject: [PATCH 3/6] [release-1.21] Generate API and CLI reference docs from release-1.21 - Update gendocs script to pull from release-1.21 branch - Regenerate content/docs/reference/api-docs.md from release-1.21 - Regenerate content/docs/cli/{cainjector,controller}.md from release-1.21 Signed-off-by: Richard Wall --- content/docs/cli/cainjector.md | 2 +- content/docs/cli/controller.md | 7 +- content/docs/reference/api-docs.md | 600 +++++++++++++++++- scripts/gendocs/generate-new-import-path-docs | 2 +- 4 files changed, 584 insertions(+), 27 deletions(-) diff --git a/content/docs/cli/cainjector.md b/content/docs/cli/cainjector.md index 569fda749f2..8849190b236 100644 --- a/content/docs/cli/cainjector.md +++ b/content/docs/cli/cainjector.md @@ -25,9 +25,9 @@ Flags: --feature-gates mapStringBool A set of key=value pairs that describe feature gates for alpha/experimental features. Options are: AllAlpha=true|false (ALPHA - default=false) AllBeta=true|false (BETA - default=false) - CAInjectorMerging=true|false (BETA - default=true) ServerSideApply=true|false (ALPHA - default=false) -h, --help help for cainjector + --ignore-namespaces strings Comma-separated list of namespaces to ignore secrets from. Should not be used with --namespace. --kubeconfig string Paths to a kubeconfig. Only required if out-of-cluster. --leader-elect If true, cainjector will perform leader election between instances to ensure no more than one instance of cainjector operates at a time (default true) --leader-election-lease-duration duration The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled. (default 1m0s) diff --git a/content/docs/cli/controller.md b/content/docs/cli/controller.md index 06d6ff28cff..7ae65441082 100644 --- a/content/docs/cli/controller.md +++ b/content/docs/cli/controller.md @@ -14,6 +14,7 @@ Usage: controller [flags] Flags: + --acme-http01-solver-extra-labels mapStringString A set of key=value pairs for additional labels to apply to dynamically-created ACME HTTP01 solver resources (pods, services, ingresses, or Gateway API HTTPRoutes). The following ACME identity label keys are reserved and will be silently ignored: acme.cert-manager.io/http-domain, acme.cert-manager.io/http-token, acme.cert-manager.io/http01-solver. These labels can be overridden by per-Issuer podTemplate/ingressTemplate/GatewayHTTPRoute.Labels. --acme-http01-solver-image string The docker image to use to solve ACME HTTP01 challenges. You most likely will not need to change this parameter unless you are testing a new feature or developing cert-manager. (default "quay.io/jetstack/cert-manager-acmesolver:canary") --acme-http01-solver-nameservers strings A list of comma separated dns server endpoints used for ACME HTTP01 check requests. This should be a list containing host and port, for example 8.8.8.8:53,8.8.4.4:53 --acme-http01-solver-resource-limits-cpu string Defines the resource limits CPU size when spawning new ACME HTTP01 challenge solver pods. (default "100m") @@ -21,8 +22,10 @@ Flags: --acme-http01-solver-resource-request-cpu string Defines the resource request CPU size when spawning new ACME HTTP01 challenge solver pods. (default "10m") --acme-http01-solver-resource-request-memory string Defines the resource request Memory size when spawning new ACME HTTP01 challenge solver pods. (default "64Mi") --acme-http01-solver-run-as-non-root Defines the ability to run the http01 solver as root for troubleshooting issues (default true) + --acme-http01-solver-runtime-class-name string RuntimeClassName to apply to ACME HTTP01 solver pods --auto-certificate-annotations strings The annotation consumed by the ingress-shim controller to indicate an ingress is requesting a certificate (default [kubernetes.io/tls-acme]) - --certificate-request-minimum-backoff-duration duration Duration of the initial certificate request backoff when a certificate request fails. The backoff duration is exponentially increased based on consecutive failures, up to a maximum of 32 hours. (default 1h0m0s) + --certificate-request-maximum-backoff-duration duration Maximum duration to back off when a certificate request fails. The backoff delay starts at the minimum backoff duration and is exponentially increased with each consecutive failure, but will never exceed this maximum (default 32h). (default 32h0m0s) + --certificate-request-minimum-backoff-duration duration Minimum duration to back off when a certificate request fails (default 1h). The backoff delay starts at this value and is exponentially increased with each consecutive failure, up to the configured maximum backoff duration. (default 1h0m0s) --cluster-issuer-ambient-credentials Whether a cluster-issuer may make use of ambient credentials for issuers. 'Ambient Credentials' are credentials drawn from the environment, metadata services, or local files which are not explicitly configured in the ClusterIssuer API object. When this flag is enabled, the following sources for credentials are also used: AWS - All sources the Go SDK defaults to, notably including any EC2 IAM roles available via instance metadata. (default true) --cluster-resource-namespace string Namespace to store resources owned by cluster scoped resources such as ClusterIssuer in. This must be specified if ClusterIssuers are enabled. (default "kube-system") --concurrent-workers int The number of concurrent workers for each controller. (default 5) @@ -43,6 +46,7 @@ Flags: --extra-certificate-annotations strings Extra annotation to be added by the ingress-shim controller to certificate object --feature-gates mapStringBool A set of key=value pairs that describe feature gates for alpha/experimental features. Options are: ACMEHTTP01IngressPathTypeExact=true|false (BETA - default=true) + ACMEUseARI=true|false (ALPHA - default=false) AllAlpha=true|false (ALPHA - default=false) AllBeta=true|false (BETA - default=false) ExperimentalCertificateSigningRequestControllers=true|false (ALPHA - default=false) @@ -56,6 +60,7 @@ Flags: StableCertificateRequestName=true|false (BETA - default=true) UseCertificateRequestBasicConstraints=true|false (ALPHA - default=false) ValidateCAA=true|false (ALPHA - default=false) + --gateway-api-extra-protocols strings A comma-separated list of additional Gateway Listener protocol types that the Gateway API shim should treat as TLS-capable. By default, only HTTPS and TLS protocol types are processed. Each entry must exactly match the protocol string as it appears on the Gateway Listener, e.g. 'DTLS'. -h, --help help for controller --issuer-ambient-credentials Whether an issuer may make use of ambient credentials. 'Ambient Credentials' are credentials drawn from the environment, metadata services, or local files which are not explicitly configured in the Issuer API object. When this flag is enabled, the following sources for credentials are also used: AWS - All sources the Go SDK defaults to, notably including any EC2 IAM roles available via instance metadata. --kube-api-burst int the maximum burst queries-per-second of requests sent to the Kubernetes apiserver (default 50) diff --git a/content/docs/reference/api-docs.md b/content/docs/reference/api-docs.md index 703cba3960b..cbbd139c172 100644 --- a/content/docs/reference/api-docs.md +++ b/content/docs/reference/api-docs.md @@ -328,7 +328,7 @@ description: >- (Optional) -

Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec.

+

Duration is the duration for the not after date for the requested certificate. This is set on order creation as per the ACME spec.

@@ -342,6 +342,17 @@ description: >-

Profile allows requesting a certificate profile from the ACME server. Supported profiles are listed by the server’s ACME directory URL.

+ + + replaces +
+ string + + + (Optional) +

Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this Order is intended to replace. When set, cert-manager will include the “replaces” field on the newOrder request to the ACME server if and only if the server advertises ARI support in its directory. The CertID has the form “base64url(AKI).base64url(serial)” and is derived locally from the currently issued leaf certificate.

+ + @@ -529,6 +540,21 @@ description: >-

Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow.

+ + + waitInsteadOfSelfCheck +
+ + Kubernetes meta/v1.Duration + + + + (Optional) +

WaitInsteadOfSelfCheck, if set, skips cert-manager’s self-check and instead waits this long after presentation before asking the ACME server to validate the challenge.

+

This is an advanced escape hatch for environments where cert-manager’s self-check cannot succeed from its own network or DNS viewpoint even though the ACME server can still validate successfully, for example due to split-horizon DNS or NAT hairpinning.

+

A value of 0 skips the self-check and asks the ACME server to validate immediately after presentation, relying on the ACME server’s own validation retries (RFC 8555 section 8.2) to succeed once the challenge has propagated. A negative duration is rejected. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, for example 30s or 2m.

+ +

ACMEChallengeSolverDNS01

@@ -2479,7 +2505,20 @@ description: >- (Optional) -

presented will be set to true if the challenge values for this challenge are currently ‘presented’. This does not imply the self check is passing. Only that the values have been ‘submitted’ for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured).

+

Presented is true once cert-manager has configured the solver resources needed to expose this challenge’s validation material. For example, the DNS01 TXT record has been created, or the HTTP01 solver has been configured to serve the challenge token. This does not imply the self check is passing, that the ACME server has validated the challenge, or that cert-manager has already accepted the challenge with the ACME server.

+ + + + + presentedAt +
+ + Kubernetes meta/v1.Time + + + + (Optional) +

PresentedAt records when cert-manager first configured the solver resources for this challenge. This is used by the optional delay-based readiness logic.

@@ -2615,7 +2654,7 @@ description: >- (Optional) -

Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec.

+

Duration is the duration for the not after date for the requested certificate. This is set on order creation as per the ACME spec.

@@ -2629,6 +2668,17 @@ description: >-

Profile allows requesting a certificate profile from the ACME server. Supported profiles are listed by the server’s ACME directory URL.

+ + + replaces +
+ string + + + (Optional) +

Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this Order is intended to replace. When set, cert-manager will include the “replaces” field on the newOrder request to the ACME server if and only if the server advertises ARI support in its directory. The CertID has the form “base64url(AKI).base64url(serial)” and is derived locally from the currently issued leaf certificate.

+ +

OrderStatus

@@ -2963,6 +3013,16 @@ description: >-

If set, this limits the scope of cainjector to a single namespace. If set, cainjector will not update resources with certificates outside of the configured namespace.

+ + + ignoreNamespaces +
+ []string + + +

Comma-separated list of namespaces to ignore secrets from. Should not be used with –namespace.

+ + leaderElectionConfig @@ -3301,6 +3361,19 @@ description: >- renewBefore derived from the renewBeforePercentage and duration fields is 5 minutes. Cannot be set if the renewBefore field is set.

+ + + renewal +
+ + CertificateRenewal + + + + (Optional) +

renewal allows configuration of how your certificate is renewed. If the policy mentioned is RenewBefore then the controller respects renewBefore and renewBeforePercentage.

+ + dnsNames @@ -3893,6 +3966,43 @@ description: >- +

ACMERenewalWindow

+

(Appears on: CertificateACMEARIStatus)

+
+ + + + + + + + + + + + + + + + + +
FieldDescription
+ start +
+ + Kubernetes meta/v1.Time + + 		+

Start is the start of the suggested renewal window.

+
+ end +
+ + Kubernetes meta/v1.Time + + 		+

End is the end of the suggested renewal window.

+

CAIssuer

(Appears on: IssuerConfig)

@@ -3949,6 +4059,106 @@ description: >- +

CertificateACMEARIStatus

+

(Appears on: CertificateACMEStatus)

+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+ suggestedWindow +
+ + ACMERenewalWindow + + 		+ (Optional) +

SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773.

+
+ explanationURL +
+ string + 		+ (Optional) +

ExplanationURL is a human-readable URL that may explain why the suggested window has its current value.

+
+ lastChecked +
+ + Kubernetes meta/v1.Time + + 		+ (Optional) +

LastChecked is the time at which the ACME server was last checked for renewal information.

+
+ nextCheck +
+ + Kubernetes meta/v1.Time + + 		+ (Optional) +

NextCheck is the time at which the ACME server will next be checked for renewal information.

+
+ lastError +
+ string + 		+ (Optional) +

LastError is the last error encountered when checking the ACME server for renewal information, if any.

+
+

CertificateACMEStatus

+

(Appears on: CertificateStatus)

+
+ + + + + + + + + + + + + +
FieldDescription
+ ari +
+ + CertificateACMEARIStatus + + 		+ (Optional) +

ARI stores the ACME Renewal Information that is fetched from the ACME server in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled.

+

CertificateAdditionalOutputFormat

(Appears on: CertificateSpec)

@@ -4237,6 +4447,119 @@ description: >- +

CertificateRenewal

+

(Appears on: CertificateSpec)

+
+ + + + + + + + + + + + + + + + + +
FieldDescription
+ policy +
+ + CertificateRenewalPolicy + + 		+

policy must be one of Disabled, RenewBefore.

+
+ windows +
+ + []CertificateRenewalWindows + + 		+ (Optional) +

windows mentions the behavior of when the renewal must happen.

+
+

CertificateRenewalPolicy (string alias)

+

(Appears on: CertificateRenewal)

+
+ + + + + + + + + + + + + + + + + +
ValueDescription
+

"Disabled"

+
+

"RenewBefore"

+
+

CertificateRenewalWindows

+

(Appears on: CertificateRenewal)

+
+

CertificateRenewalWindows is the definition for renewal windows

+
+ + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+ timezone +
+ string + 		+ (Optional) +

timezone is IANA compliant timezone. For example America/Denver. If this field is not set, timezone is treated as UTC.

+
+ windowDuration +
+ + Kubernetes meta/v1.Duration + + 		+

windowDuration is how long the cron definition is active for. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.

+
+ cron +
+ string + 		+

cron is a cron compliant string to allow when the renewal should be allowed. Format is as shown below:

+
+

| | | | | | | | | day of the week (0–6) (Sunday to Saturday; | | | month (1–12) 7 is also Sunday on some systems) | | day of the month (1–31) | hour (0–23) minute (0–59)

+

CertificateRequestCondition

(Appears on: CertificateRequestStatus)

@@ -4678,6 +5001,19 @@ description: >- renewBefore derived from the renewBeforePercentage and duration fields is 5 minutes. Cannot be set if the renewBefore field is set.

+ + + renewal +
+ + CertificateRenewal + + + + (Optional) +

renewal allows configuration of how your certificate is renewed. If the policy mentioned is RenewBefore then the controller respects renewBefore and renewBeforePercentage.

+ + dnsNames @@ -5005,6 +5341,19 @@ description: >-

The number of continuous failed issuance attempts up till now. This field gets removed (if set) on a successful issuance and gets set to 1 if unset and an issuance has failed. If an issuance has failed, the delay till the next issuance will be calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - 1).

+ + + acme +
+ + CertificateACMEStatus + + + + (Optional) +

ACME stores information that is fetched from the ACME CA server.

+ +

GenericIssuer

@@ -5656,7 +6005,7 @@ description: >- (Optional)

Profile specifies the key and certificate encryption algorithms and the HMAC algorithm used to create the PKCS12 keystore. Default value is LegacyRC2 for backward compatibility.

If provided, allowed values are: - LegacyRC2: Deprecated. Not supported by default in OpenSSL 3 or Java 20. LegacyDES: Less secure algorithm. Use this option for maximal compatibility. Modern2023: Secure algorithm. Use this option in case you have to always use secure algorithms (e.g., because of company policy). Please note that the security of the algorithm is not that important in reality, because the unencrypted certificate and private key are also stored in the Secret.

+ LegacyRC2: Deprecated. Not supported by default in OpenSSL 3 or Java 20. LegacyDES: Less secure algorithm. Use this option for maximal compatibility. Modern2023: Secure algorithm. Use this option in case you have to always use secure algorithms (e.g., because of company policy). Please note that the security of the algorithm is not that important in reality, because the unencrypted certificate and private key are also stored in the Secret. Modern2026: Encodes PKCS#12 files using algorithms that are considered modern as of 2026. Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC. The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256. Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher, or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements.

@@ -5718,6 +6067,14 @@ description: >-

see: https://pkg.go.dev/software.sslmate.com/src/go-pkcs12#Modern2023

+ + +

"Modern2026"

+ + +

see: https://pkg.go.dev/software.sslmate.com/src/go-pkcs12#Modern2026

+ +

PrivateKeyAlgorithm (string alias)

@@ -5818,7 +6175,7 @@ description: >-

ServiceAccountRef

-

(Appears on: VaultKubernetesAuth)

+

(Appears on: VaultAWSAuth, VaultKubernetesAuth)

ServiceAccountRef is a service account used by cert-manager to request a token. By default two audiences are included: the address of the Vault server as specified on the issuer, and a generated audience taking the form of vault://namespace-name/issuer-name for an Issuer and vault://issuer-name for a ClusterIssuer. The expiration of the token is also set by cert-manager to 10 minutes.

@@ -5908,6 +6265,88 @@ description: >- +

VaultAWSAuth

+

(Appears on: VaultAuth)

+
+

VaultAWSAuth authenticates with Vault using AWS IAM authentication. See https://www.vaultproject.io/docs/auth/aws for more details.

+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+ mountPath +
+ string + 		+ (Optional) +

The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to /v1/auth/foo, will use the path /v1/auth/foo/login to authenticate with Vault. If unspecified, the default value “/v1/auth/aws” will be used.

+
+ role +
+ string + 		+

A required field containing the Vault Role to assume when authenticating.

+
+ region +
+ string + 		+ (Optional) +

The AWS region to use for authentication. If not specified, the region will be determined from AWS_REGION or AWS_DEFAULT_REGION environment variables, falling back to “us-east-1” if not set.

+
+ serviceAccountRef +
+ + ServiceAccountRef + + 		+ (Optional) +

A reference to a service account that will be used to request a web identity token for IRSA (IAM Roles for Service Accounts) authentication.

+
+ iamRoleArn +
+ string + 		+ (Optional) +

The ARN of the AWS IAM role to assume using the Kubernetes service account token. Required when using IRSA (serviceAccountRef is set). This role must have a trust policy that allows the OIDC provider to assume it.

+
+ vaultHeaderValue +
+ string + 		+ (Optional) +

The Vault header value to include in the STS signing request. This is used to prevent replay attacks.

+

VaultAppRole

(Appears on: VaultAuth)

@@ -5956,7 +6395,7 @@ description: >-

VaultAuth

(Appears on: VaultIssuer)

-

VaultAuth is configuration used to authenticate with a Vault server. The order of precedence is [tokenSecretRef, appRole, clientCertificate or kubernetes].

+

VaultAuth is configuration used to authenticate with a Vault server. The order of precedence is [tokenSecretRef, appRole, clientCertificate, kubernetes, aws].

@@ -6016,6 +6455,19 @@ description: >-

Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server.

+ + + +
+ aws +
+ + VaultAWSAuth + + 		+ (Optional) +

AWS authenticates with Vault using AWS IAM authentication. This allows authentication using IAM roles for service accounts (IRSA), EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).

+

VaultClientCertificateAuth

@@ -6324,6 +6776,76 @@ description: >-

Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. Only one of CyberArk Certificate Manager may be specified.

+ + + ngts +
+ + VenafiNGTS + + + + (Optional) +

NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.

+ + + + +

VenafiNGTS

+

(Appears on: VenafiIssuer)

+
+

VenafiNGTS defines connection configuration for the Palo Alto Networks Next Generation Trust Services (NGTS) platform using OAuth 2.0 Client Credentials.

+
+ + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
+ url +
+ string + 		+ (Optional) +

URL is the base URL for the NGTS API endpoint. Defaults to “https://api.strata.paloaltonetworks.com/ngts” if not set.

+
+ tokenEndpoint +
+ string + 		+ (Optional) +

TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, for example “https://auth.apps.paloaltonetworks.com/oauth2/access_token”. Defaults to “https://auth.apps.paloaltonetworks.com/oauth2/access_token” if not set.

+
+ tsgID +
+ string + 		+

TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, for example “1234567890”. The tsg_id: prefix is added automatically. This field is required.

+
+ credentialsRef +
+ github.com/cert-manager/cert-manager/pkg/apis/meta/v1.LocalObjectReference + 		+

CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 Client ID and Client Secret. The secret must contain the keys ‘client-id’ and ‘client-secret’.

+

VenafiTPP

@@ -6607,6 +7129,16 @@ description: >-

Defines the ability to run the http01 solver as root for troubleshooting issues

+ + + solverRuntimeClassName +
+ string + + +

Defines the runtime class used when spawning new ACME HTTP01 challenge solver pods.

+ + solverNameservers @@ -6617,6 +7149,16 @@ description: >-

A list of comma separated dns server endpoints used for ACME HTTP01 check requests. This should be a list containing host and port, for example [“8.8.8.8:53”,“8.8.4.4:53”] Allows specifying a list of custom nameservers to perform HTTP01 checks on.

+ + + solverExtraLabels +
+ map[string]string + + +

Extra labels applied to all dynamically-created ACME HTTP01 solver resources (pods, services, ingresses, or Gateway API HTTPRoutes). Applied in addition to the standard ACME challenge identification labels. The following ACME identity label keys are reserved and will be silently ignored: acme.cert-manager.io/http-domain, acme.cert-manager.io/http-token, acme.cert-manager.io/http01-solver.

+ +

ControllerConfiguration

@@ -6750,7 +7292,7 @@ description: >-

Whether gateway API integration is enabled within cert-manager. The ExperimentalGatewayAPISupport feature gate must also be enabled (default as of 1.15).

-

Deprecated: use GatewayAPIConfig.Enabled instead.

+

Deprecated: use GatewayAPIConfig.Enabled instead.

@@ -6761,19 +7303,7 @@ description: >-

Specifies whether the ListenerSet controller should be enabled with-in cert-manager. This along with ListenerSet feature gate enabled allows the user to consume ListenerSet for self-service TLS.

-

Deprecated: use GatewayAPIConfig.EnableListenerSet instead.

- - - - - gatewayAPI -
- - GatewayAPIConfig - - - -

gatewayAPI configures Gateway API integration options for cert-manager.

+

Deprecated: use GatewayAPIConfig.EnableListenerSet instead.

@@ -6926,6 +7456,18 @@ description: >-

pemSizeLimitsConfig configures the maximum sizes for PEM-encoded data

+ + + gatewayAPI,omitzero +
+ + GatewayAPIConfig + + + +

gatewayAPI configures the behaviour of the Gateway API integration

+ + certificateRequestMinimumBackoffDuration @@ -6933,13 +7475,23 @@ description: >- github.com/cert-manager/cert-manager/pkg/apis/config/shared/v1alpha1.Duration -

CertificateRequestMinimumBackoffDuration configures the initial backoff duration when a certificate request fails. This duration is exponentially increased (up to a maximum of 32 hours) based on the number of consecutive failures.

+

certificateRequestMinimumBackoffDuration configures the minimum backoff duration when a certificate request fails (default 1h). The backoff delay starts at this value and is exponentially increased with each consecutive failure, up to the configured maximum backoff duration.

+ + + + + certificateRequestMaximumBackoffDuration +
+ github.com/cert-manager/cert-manager/pkg/apis/config/shared/v1alpha1.Duration + + +

certificateRequestMaximumBackoffDuration configures the maximum backoff duration when a certificate request fails. The backoff delay starts at the minimum backoff duration and is exponentially increased with each consecutive failure, but will never exceed this maximum (default 32h).

GatewayAPIConfig

-

(Appears on: ControllerConfiguration)

+

(Appears on: ControllerConfiguration)

@@ -6976,7 +7528,7 @@ description: >- []string @@ -7293,4 +7845,4 @@ description: >-
-

ExtraProtocols is a list of additional Gateway Listener protocol types that the Gateway API shim should treat as TLS-capable. By default, only HTTPS and TLS protocol types are processed.

+

ExtraProtocols is a list of additional Gateway Listener protocol types that the Gateway API shim should treat as TLS-capable. By default, only HTTPS and TLS protocol types are processed. Each entry must exactly match the protocol string as it appears on the Gateway Listener, e.g. “DTLS”.
-

Generated with gen-crd-api-reference-docs on git commit 0bca8fd.

+

Generated with gen-crd-api-reference-docs on git commit ae67234.

diff --git a/scripts/gendocs/generate-new-import-path-docs b/scripts/gendocs/generate-new-import-path-docs index 8b4557eee9d..950a6833b8b 100755 --- a/scripts/gendocs/generate-new-import-path-docs +++ b/scripts/gendocs/generate-new-import-path-docs @@ -139,7 +139,7 @@ EOF # For final releases such as v1.20.0, DOCS_FOLDER should be `docs` (or a # versioned docs folder name such as `v1.20-docs`), and CM_BRANCH should be # the release branch, e.g. `release-1.20`. -CM_BRANCH="release-1.20" +CM_BRANCH="release-1.21" DOCS_FOLDER="docs" genversionwithcli "$CM_BRANCH" "$DOCS_FOLDER" From a21efea465962d652efe38db763f61d75ff9d7fd Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Wed, 1 Jul 2026 08:56:34 +0000 Subject: [PATCH 4/6] Expand Major Themes section for v1.21.0-beta.0 release notes - Rewrote the intro summary to list all new features alongside breaking changes - Added major theme sections for: ARI (RFC 9773), AWS IAM auth for Vault, Modern2026 PKCS#12 profile, certificate renewal policies, Gateway API improvements (ListenerSet parentRef fallback, ignore-tls-listeners, additional protocols, enableGatewayAPI restructure), cainjector improvements (CAInjectorMerging GA, SSA unconditional, --ignore-namespaces flag), Venafi integration updates (OAuth observability, PANW NGTS support), ACME security hardening (GHSA-8rvj-mm4h-c258, transient error retry), and a Notable Bug Fixes subsection covering integer overflow, infinite re-issuance loop, DNS issuer validation, Vault path traversal, and DoH OOM - Added new GitHub handles and terms to .spelling allowlist Signed-off-by: Richard Wall --- .spelling | 17 ++ .../release-notes/release-notes-1.21.md | 199 +++++++++++++++++- 2 files changed, 213 insertions(+), 3 deletions(-) diff --git a/.spelling b/.spelling index 47c6c456d54..40cfd40f123 100644 --- a/.spelling +++ b/.spelling @@ -1545,3 +1545,20 @@ parentrefnamespace parentreffallback everping kodareef +apkatsikas +bitloi +figaw +gwapi +immanuwell +injectables +jabbrwcky +jnohlgard +ltwongaa +mateenali +onurmicoogullari +putongyong +samplewebhook +seanorama +Tardif +texasich +workqueue diff --git a/content/docs/releases/release-notes/release-notes-1.21.md b/content/docs/releases/release-notes/release-notes-1.21.md index f44747aa4a0..525bf8b4875 100644 --- a/content/docs/releases/release-notes/release-notes-1.21.md +++ b/content/docs/releases/release-notes/release-notes-1.21.md @@ -5,9 +5,25 @@ description: 'cert-manager release notes: cert-manager 1.21' cert-manager v1.21 includes: -- Removal of the default `tokenrequest` RBAC from the Helm chart (breaking change) -- Removal of Challenge and Order write permissions from the `cert-manager-edit` aggregate ClusterRole (breaking change) -- Removal of configurable metrics path and port name Helm values (breaking change) +**New features:** +- ACME Renewal Information (ARI / RFC 9773) support via the `ACMEUseARI` feature gate +- AWS IAM authentication (IRSA, EKS Pod Identity, ambient EC2/ECS) for the Vault issuer +- Modern2026 PKCS#12 encoding profile (FIPS 140-3 compatible) +- Certificate renewal policies +- `waitInsteadOfSelfCheck` solver option — skip cert-manager's self-check for split-horizon DNS or NAT hairpin environments +- `--certificate-request-maximum-backoff-duration` flag — cap the exponential retry backoff for failed CertificateRequests +- Webhook serving certificate renewal fixed after system suspend or VM live migration +- Venafi OAuth token observability and `AuthFailed` Issuer condition; PANW NGTS support added +- Gateway API: HTTP01 ListenerSet parentRef fallback annotation; additional listener protocols; `CAInjectorMerging` promoted to GA +- cainjector `--ignore-namespaces` flag +- `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods +- `startupapicheck.ttlSecondsAfterFinished` Helm value for automatic Job cleanup +- `--acme-http01-solver-extra-labels` flag to propagate `global.commonLabels` to solver resources + +**Breaking changes:** +- Removal of the default `tokenrequest` RBAC from the Helm chart +- Removal of Challenge and Order write permissions from the `cert-manager-edit` aggregate ClusterRole +- Removal of configurable metrics path and port name Helm values ## Major Themes @@ -154,6 +170,183 @@ resume. More details are available in the PR: https://github.com/cert-manager/cert-manager/pull/8464. +### ACME Renewal Information (ARI) support + +cert-manager 1.21 adds experimental support for RFC 9773 ACME Renewal +Information (ARI), behind the `ACMEUseARI` feature gate. When enabled, and when +the ACME server advertises a `renewalInfo` endpoint, cert-manager queries the +server for its recommended renewal window before deciding whether to re-issue a +certificate. This allows ACME servers — including Let's Encrypt — to proactively +prompt renewal of certificates affected by mass revocations or CA key rollovers, +without requiring operators to intervene. + +([cert-manager/cert-manager#8798](https://github.com/cert-manager/cert-manager/pull/8798), +[@hjoshi123](https://github.com/hjoshi123)) + +### AWS IAM authentication for the Vault issuer + +The Vault issuer now supports AWS IAM-based authentication in three modes: + +- **IRSA (IAM Roles for Service Accounts)**: the cert-manager controller pod + assumes an AWS IAM role via Kubernetes projected service account tokens. +- **EKS Pod Identity**: authentication via the EKS Pod Identity agent sidecar. +- **Ambient credentials**: uses the EC2/ECS instance metadata service when + running on AWS without an explicitly configured role. + +All three modes avoid the need to store long-lived AWS credentials as Kubernetes +Secrets. + +([cert-manager/cert-manager#8422](https://github.com/cert-manager/cert-manager/pull/8422), +[@bitloi](https://github.com/bitloi)) + +### Modern2026 PKCS#12 encoding profile + +cert-manager 1.21 adds the `Modern2026` profile for PKCS#12 output, based on +the `go-pkcs12` library's Modern2026 encoder. This profile uses FIPS 140-3 +approved algorithms (AES-256 + SHA-256 KDFs) instead of the legacy 3DES/RC2 +defaults. It is suitable for environments with FIPS or compliance requirements +that prohibit older cipher suites. + +([cert-manager/cert-manager#8841](https://github.com/cert-manager/cert-manager/pull/8841), +[@seanorama](https://github.com/seanorama)) + +### Certificate renewal policies + +cert-manager 1.21 adds `renewalPolicies` to the Certificate API, allowing +operators to fine-tune when cert-manager triggers a renewal. This complements the +existing `renewBefore` and `renewBeforePercentage` fields, providing more +expressive control over renewal scheduling. + +([cert-manager/cert-manager#8258](https://github.com/cert-manager/cert-manager/pull/8258), +[@hjoshi123](https://github.com/hjoshi123)) + +### Gateway API improvements + +Several improvements to the Gateway API integration land in 1.21: + +- **HTTP01 ListenerSet parentRef fallback**: the new + `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes + cert-manager to use the parent Gateway as the solver HTTPRoute parentRef + instead of the ListenerSet. This enables TLS-only ListenerSets (which cannot + receive HTTP challenges) to rely on a shared Gateway HTTP listener for ACME + validation. + ([#8749](https://github.com/cert-manager/cert-manager/pull/8749), + [@apkatsikas](https://github.com/apkatsikas)) + +- **`cert-manager.io/ignore-tls-listeners` annotation**: allows Gateway TLS + listeners to be excluded from certificate management, useful when some + listeners are managed by a different controller. + ([#8727](https://github.com/cert-manager/cert-manager/pull/8727), + [@hjoshi123](https://github.com/hjoshi123)) + +- **Additional listener protocols**: the Gateway API integration now recognises + configurable listener protocols beyond the default set, making cert-manager + compatible with custom protocol extensions. + ([#8683](https://github.com/cert-manager/cert-manager/pull/8683), + [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) + +- **`enableGatewayAPI` configuration restructure**: the `enableGatewayAPI` and + `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are + deprecated in favour of a `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet` + sub-struct. The old fields continue to work. + ([#8732](https://github.com/cert-manager/cert-manager/pull/8732), + [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) + +### cainjector improvements + +- **`CAInjectorMerging` promoted to GA**: the `CAInjectorMerging` feature gate is + now unconditionally enabled and will be removed in a future release. This + changes how cainjector merges CA data into webhook and API service objects. + ([#8583](https://github.com/cert-manager/cert-manager/pull/8583)) + +- **Server-side apply unconditional**: cainjector now always uses server-side + apply (SSA) to patch CA bundles, and the `ServerSideApply` feature gate is + deprecated. SSA removes the last-applied-configuration annotation bloat and + makes conflict detection more reliable. + ([#8692](https://github.com/cert-manager/cert-manager/pull/8692), + [@erikgb](https://github.com/erikgb)) + +- **`--ignore-namespaces` flag**: the new cainjector flag accepts a + comma-separated list of namespace names that cainjector will skip when + watching Secrets for injection. This reduces the number of watch events in + clusters with a large number of namespaces or where some namespaces contain + large secrets that cainjector does not need. + ([#8614](https://github.com/cert-manager/cert-manager/pull/8614), + [@figaw](https://github.com/figaw)) + +### Venafi integration updates + +cert-manager 1.21 adds two improvements to the Venafi/CyberArk integration: + +- **OAuth token observability**: a new `AuthFailed` reason on the Issuer + `Ready` condition distinguishes authentication failures (bad or expired + credentials) from transient infrastructure errors, making it easier to + diagnose Venafi connectivity problems. + ([#8808](https://github.com/cert-manager/cert-manager/pull/8808), + [@FelixPhipps](https://github.com/FelixPhipps)) + +- **PANW NGTS support**: the Venafi issuer now supports PANW Next-Generation + Trust Services as a backend, in addition to Venafi TPP and Venafi Control + Plane. + ([#8779](https://github.com/cert-manager/cert-manager/pull/8779), + [@FelixPhipps](https://github.com/FelixPhipps)) + +### ACME security hardening + +The ACME Challenge and Order controllers now enforce stricter resource +ownership rules (GHSA-8rvj-mm4h-c258): + +- Challenges without a valid Order owner reference are rejected. +- Order specs are now immutable after creation. +- Pre-placed Challenges with a mismatched spec are detected and refused. + +This prevents a malicious actor with write access to Order or Challenge +resources from influencing ACME validation in unexpected ways. + +Additionally, ACME challenges no longer permanently fail on transient network +errors (TLS handshake timeouts, DNS resolution failures, context cancellation) +during nonce fetches or authorisation waits. The workqueue retries with +exponential backoff instead. + +([cert-manager/cert-manager#8948](https://github.com/cert-manager/cert-manager/pull/8948), +[#8760](https://github.com/cert-manager/cert-manager/pull/8760)) + +### Notable bug fixes + +- **Integer overflow in `renewBeforePercentage`**: Certificates with durations + longer than approximately 3 years were incorrectly rejected by validation or + assigned incorrect renewal times due to a 32-bit integer overflow in the + percentage arithmetic. Fixed in + [#8947](https://github.com/cert-manager/cert-manager/pull/8947) + ([@ThatsMrTalbot](https://github.com/ThatsMrTalbot)). + +- **Infinite re-issuance loop**: cert-manager no longer enters an infinite + re-issuance loop when an issuer returns an already-expired certificate. + Fixed in + [#8610](https://github.com/cert-manager/cert-manager/pull/8610) + ([@onurmicoogullari](https://github.com/onurmicoogullari)). + +- **DNS issuer secrets validated before ready**: the DNS issuer now validates + that the referenced Secret exists and is well-formed before marking the issuer + Ready, preventing silent misconfiguration. + Fixed in + [#8255](https://github.com/cert-manager/cert-manager/pull/8255) + ([@Peac36](https://github.com/Peac36)). + +- **Vault path traversal validation**: the Vault issuer webhook now rejects + `..` path segments in `spec.vault.path` and auth mount path fields, + preventing `path.Join` from silently resolving relative segments before + constructing the Vault API URL. + Fixed in + [#8930](https://github.com/cert-manager/cert-manager/pull/8930). + +- **DNS-over-HTTPS response body unbounded read**: the DNS-over-HTTPS client + now caps response body reads at 128 KB, preventing a potential OOM from a + malicious or misconfigured DoH resolver. + Fixed in + [#8803](https://github.com/cert-manager/cert-manager/pull/8803) + ([@SebTardif](https://github.com/SebTardif)). + ## Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. From 669df8ee47c2380af826517e17fc1065f687b162 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Wed, 1 Jul 2026 08:59:52 +0000 Subject: [PATCH 5/6] Add pre-release warning admonition to v1.21 release notes Signed-off-by: Richard Wall --- content/docs/releases/release-notes/release-notes-1.21.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/docs/releases/release-notes/release-notes-1.21.md b/content/docs/releases/release-notes/release-notes-1.21.md index 525bf8b4875..475237ecd4b 100644 --- a/content/docs/releases/release-notes/release-notes-1.21.md +++ b/content/docs/releases/release-notes/release-notes-1.21.md @@ -3,6 +3,10 @@ title: Release 1.21 description: 'cert-manager release notes: cert-manager 1.21' --- +:::warning +These are **draft release notes**. cert-manager v1.21 is currently a pre-release and is **not recommended for use in production**. The final release notes will be published when v1.21.0 is released. +::: + cert-manager v1.21 includes: **New features:** From e8a75cabd2ec4c2547ca6c72b27344cb8968a6ba Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Wed, 1 Jul 2026 09:02:55 +0000 Subject: [PATCH 6/6] Use US English spellings in release notes content Signed-off-by: Richard Wall --- content/docs/releases/release-notes/release-notes-1.21.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/docs/releases/release-notes/release-notes-1.21.md b/content/docs/releases/release-notes/release-notes-1.21.md index 475237ecd4b..33a167f9a2a 100644 --- a/content/docs/releases/release-notes/release-notes-1.21.md +++ b/content/docs/releases/release-notes/release-notes-1.21.md @@ -243,7 +243,7 @@ Several improvements to the Gateway API integration land in 1.21: ([#8727](https://github.com/cert-manager/cert-manager/pull/8727), [@hjoshi123](https://github.com/hjoshi123)) -- **Additional listener protocols**: the Gateway API integration now recognises +- **Additional listener protocols**: the Gateway API integration now recognizes configurable listener protocols beyond the default set, making cert-manager compatible with custom protocol extensions. ([#8683](https://github.com/cert-manager/cert-manager/pull/8683), @@ -251,7 +251,7 @@ Several improvements to the Gateway API integration land in 1.21: - **`enableGatewayAPI` configuration restructure**: the `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are - deprecated in favour of a `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet` + deprecated in favor of a `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet` sub-struct. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/pull/8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) @@ -309,7 +309,7 @@ resources from influencing ACME validation in unexpected ways. Additionally, ACME challenges no longer permanently fail on transient network errors (TLS handshake timeouts, DNS resolution failures, context cancellation) -during nonce fetches or authorisation waits. The workqueue retries with +during nonce fetches or authorization waits. The workqueue retries with exponential backoff instead. ([cert-manager/cert-manager#8948](https://github.com/cert-manager/cert-manager/pull/8948),