Update Helm release cert-manager to v1.19.2 #621
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: AverageMarcus/cluster.fun#621
Reference in New Issue
Block a user
Delete Branch "renovate/cert-manager-1.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1.11.0→v1.19.2Release Notes
cert-manager/cert-manager (cert-manager)
v1.19.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We updated Go to fix some vulnerabilities in the standard library.
Changes since
v1.19.1Bug or Regression
CVE-2025-47914andCVE-2025-58181which were reported by Trivy. (#8283, @SgtCoDFish)v1.25.5to fixCVE-2025-61727andCVE-2025-61729(#8294, @wallrj-cyberark)global.nodeSelectorto helm chart to perform amergeand allow for a singlenodeSelectorto be set across all services. (#8233, @cert-manager-bot)Other (Cleanup or Flake)
golang/x/crypto(#8270, @SgtCoDFish)v1.19.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We reverted the CRD-based API defaults for
Certificate.Spec.IssuerRefandCertificateRequest.Spec.IssuerRefafter they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager1.20.We fixed a bug that caused certificates to be re-issued unexpectedly if the
issuerRefkind or group was changed to one of the "runtime" default values.We upgraded Go to
1.25.3to address the following security vulnerabilities:CVE-2025-61724,CVE-2025-58187,CVE-2025-47912,CVE-2025-58183,CVE-2025-61723,CVE-2025-58186,CVE-2025-58185,CVE-2025-58188, andCVE-2025-61725.Changes since
v1.19.0:Bug or Regression
issuerRefof a Certificate was omitted, upgrading to1.19.xincorrectly caused the certificate to be renewed (#8175, @cert-manager-bot)v1.19.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.
Changes since
v1.18.0:Feature
global.nodeSelectorto helm chart to allow for a singlenodeSelectorto be set across all services. (#7818, @StingRayZA)pathTypeExactin ACME HTTP01 Ingress challenge solvers. (#7795, @sspreitzer)applyconfigurationsallowing clients to make type-safe server-side apply requests for cert-manager resources. (#7866, @erikgb)certmanager_certificate_challenge_statusPrometheus metric. (#7736, @hjoshi123)protocolfield forrfc2136DNS01 provider (#7881, @hjoshi123)hostUsersflag to all pods. Not set by default. (#7973, @hjoshi123)--acme-http01-solver-resource-*settings. (#7972, @lunarwhite)CAInjectorMergingfeature has been promoted to BETA and is now enabled by default (#8017, @ThatsMrTalbot)certificatemetrics to the collector approach. (#7856, @hjoshi123)Bug or Regression
error waiting for authorization(#7796, @hjoshi123)class,ingressClassName,name) are specified simultaneously (#8021, @lunarwhite)global.rbac.disableHTTPChallengesRoleHelm option. (#7836, @inteon)pathlabel of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. (#8109, @mladen-rusev-cyberark)ingress-nginxin E2E tests to ensure compatibility (#7792, @wallrj)Other (Cleanup or Flake)
tokenrequestRoleBinding resource to improve consistency (#7761, @lunarwhite)maps.Copyfor cleaner map handling (#8092, @quantpoet)vault-client-goto the newvault/apiclient. (#8059, @armagankaratosun)v1.18.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We updated Go to fix some vulnerabilities in the standard library.
Changes since
v1.18.3Bug or Regression
CVE-2025-47914andCVE-2025-58181which were reported by Trivy. (#8282, @SgtCoDFish)v1.24.11to fixCVE-2025-61727andCVE-2025-61729(#8295, @wallrj-cyberark)Other (Cleanup or Flake)
golang/x/crypto(#8271, @SgtCoDFish)v1.18.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We fixed a bug which caused certificates to be re-issued unexpectedly, if the issuerRef kind or group was changed to one of the "runtime" default values. We increased the size limit when parsing PEM certificate chains to handle leaf certificates with large numbers of DNS named or other identities. We upgraded Go to 1.24.9 to fix various non-critical security vulnerabilities.
Changes since
v1.18.2:Bug or Regression
Other (Cleanup or Flake)
v1.18.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We fixed a bug in the CSR's name constraints construction (only applies if you have enabled the
NameConstraintsfeature gate).We dropped the new
global.rbac.disableHTTPChallengesRoleHelm option due to a bug we found, this feature will be released inv1.19instead.Changes since
v1.18.1:Bug or Regression
global.rbac.disableHTTPChallengesRoleHelm option. (#7837, @cert-manager-bot)v1.18.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We have added a new feature gate
ACMEHTTP01IngressPathTypeExact, to allowingress-nginxusers to turn off the new default IngressPathType: Exactbehavior, in ACME HTTP01 Ingress challenge solvers.This change fixes the following issue: #7791
We have increased the ACME challenge authorization timeout to two minutes, which we hope will fix a timeout error (
error waiting for authorization), which has been reported by multiple users, since the release of cert-managerv1.16.0.This change should fix the following issues: #7337, #7444, and #7685.
Changes since
v1.18.0:Feature
ACMEHTTP01IngressPathTypeExact, to allowingress-nginxusers to turn off the new default IngressPathType: Exactbehavior, in ACME HTTP01 Ingress challenge solvers. (#7810, @sspreitzer)Bug or Regression
error waiting for authorization. (#7801, @hjoshi123)Other (Cleanup or Flake)
#7807, @wallrj)v1.18.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.18 introduces several new features and breaking changes. Highlights include support for ACME certificate profiles, a new default for
Certificate.Spec.PrivateKey.RotationPolicynow set toAlways(breaking change), and the defaultCertificate.Spec.RevisionHistoryLimitnow set to1(potentially breaking).Known Issues
Changes since
v1.17.2:Feature
app.kubernetes.io/managed-by: cert-managerlabel to the created Let's Encrypt account keys (#7577, @terinjokes)certmanager_certificate_not_before_timestamp_seconds,certmanager_certificate_not_after_timestamp_seconds). (#7612, @solidDoWant)--extra-certificate-annotations, which sets a list of annotation keys to be copied from Ingress-like to resulting Certificate object (#7083, @k0da)issshort name for the cert-managerIssuerresource. (#7373, @SgtCoDFish)cissshort name for the cert-managerClusterIssuerresource (#7373, @SgtCoDFish)global.rbac.disableHTTPChallengesRolehelm value to disable HTTP-01 ACME challenges. This allows cert-manager to drop its permission to create pods, improving security when HTTP-01 challenges are not required. (#7666, @ali-hamza-noor)FindZoneByFqdn(#7596, @ThatsIvan)UseDomainQualifiedFinalizerfeature to GA. (#7735, @jsoref)Certificate.Spec.PrivateKey.RotationPolicychanged fromNevertoAlways. (#7723, @wallrj)Documentation
Bug or Regression
go-josedependency to addressCVE-2025-27144. (#7606, @SgtCoDFish)golang.org/x/oauth2to patchCVE-2025-22868. (#7638, @NicholasBlaskey)golang.org/x/cryptoto patchGHSA-hcg3-q754-cr77. (#7638, @NicholasBlaskey)github.com/golang-jwt/jwtto patchGHSA-mh63-6h87-95cp. (#7638, @NicholasBlaskey)ImplementationSpecifictoExactfor a reliable handling of ingress controllers and enhanced security. (#7767, @sspreitzer)--namespace=<namespace>: limit the scope of cert-manager to a single namespace and disable cluster-scoped controllers. (#7678, @tsaarni)commonNamefield; IP addresses are no longer added to the DNSsubjectAlternativeNamelist and are instead added to theipAddressesfield as expected. (#7081, @johnjcool)certmanager_certificate_renewal_timestamp_secondsmetric help text indicating that the metric is relative to expiration time, rather than Unix epoch time. (#7609, @solidDoWant)Passthroughmode. (#6986, @vehagn)golang.org/x/netfixingCVE-2025-22870. (#7619, @dependabot[bot])Other (Cleanup or Flake)
third_party/forked/acmepackage with support for the ACME profiles extension. (#7776, @wallrj)AdditionalCertificateOutputFormatsfeature to GA, making additional formats always enabled. (#7744, @erikgb)ValidateCAA. Setting this feature gate is now a no-op which does nothing but print a warning log line (#7553, @SgtCoDFish)v1.24.4(#7785, @wallrj)v1.17.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We fixed a bug in the CSR's name constraints construction (only applies if you have enabled the
NameConstraintsfeature gate).Changes since
v1.17.3:Bug or Regression
v1.17.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release addresses several vulnerabilities reported by the Trivy security scanner. It is built with the latest version of Go 1.23.
We have increased the ACME challenge authorization timeout to two minutes, which we hope will fix a timeout error (
error waiting for authorization), which has been reported by multiple users, in: #7337, #7444, and #7685.Changes since
v1.17.2:Bug or Regression
waiting for authorization(#7798, @hjoshi123)Other (Cleanup or Flake)
v1.17.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release addresses several vulnerabilities reported by the Trivy security scanner. It is built with the latest version of Go 1.23 and includes various dependency updates.
Changes since
v1.17.1Bug or Regression
v1.23.8to fixCVE-2025-22871(#7701,@wallrj)go-josedependency to addressCVE-2025-27144(#7603,@SgtCoDFish)golang.org/x/netto addressCVE-2025-22870reported by Trivy (#7622,@SgtCoDFish)golang.org/x/netto fixCVE-2025-22872(#7703,@wallrj)golang.org/x/oauth2to patchCVE-2025-22868(#7692,@lentzi90)golang.org/x/cryptoto patchGHSA-hcg3-q754-cr77(#7692,@lentzi90)github.com/golang-jwt/jwtto patchGHSA-mh63-6h87-95cp(#7692,@lentzi90)v1.17.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release is primarily intended to address a breaking change in Cloudflare's API which impacted ACME DNS-01 challenges using Cloudflare.
Many thanks to the community members who reported this issue!
Changes by Kind
Bug or Regression
v1.17.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.17.0 is a feature release with several improvements, including:
Major Themes
RSA Certificate Compliance
The United States Department of Defense published a memo in 2022 which introduced some requirements on the kinds of cryptography they require to be supported in software they use.
In effect, the memo requires that software be able to support larger RSA keys (3072-bit and 4096-bit) and hashing algorithms (SHA-384 at a minimum).
cert-manager supported large RSA keys long before the memo was published, but a quirk in implementation meant that cert-manager always used SHA-256 when signing with RSA.
In v1.17.0, cert-manager will choose a hash algorithm based on the RSA key length: 3072-bit keys will use SHA-384, and 4096-bit keys will use SHA-512. This matches similar behavior already present for ECDSA signatures.
Our expectation is that this change will have minimal impact beyond a slight increase to security and better compliance; we're not aware of Kubernetes based environments which support RSA 2048 with SHA-256 but fail with RSA 4096 and SHA-512. However, if you're using larger RSA keys, you should be aware of the change.
Easier Keystore Passwords for PKCS#12 and JKS
Specifying passwords on PKCS#12 and JKS keystores is supported in cert-manager
for compatibility reasons with software which expects or requires passwords to be set; however, these passwords are not relevant to security and never have been in cert-manager.
The initial implementation of the
keystoresfeature required these "passwords" to be stored in a Kubernetes secret, which would then be read by cert-manager when creating the keystore after a certificate was issued. This is cumbersome, especially when many passwords are set to default values such aschangeitorpassword.In cert-manager v1.17, it's now possible to set a keystore password using a literal string value inside the
Certificateresource itself, making this process much easier with no change to security.For example:
The new
passwordfield is mutually exclusive with thepasswordSecretReffield, so be sure to only set one.Feature Flag Promotions / Deprecations
cert-manager's feature flags allow for easier testing and adoption of new features with a reduced risk of breaking changes. In cert-manager v1.17, two feature gates have been promoted to "beta", and as such are now enabled by default in all installations:
NameConstraints, allowing users to specify the name constraints extension which can be helpful when creating CA certificates for private PKIUseDomainQualifiedFinalizer, which stops a Kubernetes warning from being printed in logsIn addition, we added a new feature gate:
CAInjectorMerging, which intelligently combines certificates used by theCAInjectorcomponent, making it safer to use when issuing certificates are rotated. If you're making heavy use of the CA injector, you should consider enabling this feature gate.Finally, we deprecated the
ValidateCAAfeature gate which will be removed entirely in cert-manager v1.18.0. This feature gate aimed to validate theCAADNS record during ACME issuance, but has seen low adoption and limited testing since its introduction back in 2019.Other Changes
There are many other PRs which were merged in this release cycle and we'd encourage you to read the release notes below. One PR that's worth highlighting is a change to add more structured logging information to certain log lines.
If you were previously filtering logs using
grepor similar tools (which is highly discouraged!) be aware that some log lines have changed format.Community
As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.
A special thanks to:
for their contributions, comments and support!
Also, thanks to the cert-manager maintainer team for their help in this release:
And finally, thanks to the cert-manager steering committee for their feedback in this release cycle:
Changes by Kind
Feature
webhook.extraEnvallows you to set custom environment variables in the webhook Pod.Helm: New value
cainjector.extraEnvallows you to set custom environment variables in the cainjector Pod.Helm: New value
startupapicheck.extraEnvallows you to set custom environment variables in the startupapicheck Pod. (#7317, @wallrj)pki.DecodeX509CertificateSetBytesis able to parse, to enable reading larger TLS trust bundles (#7464, @SgtCoDFish)UseDomainQualifiedFinalizerfeature to Beta. (#7488, @jsoref)tplfunction on keys and values, to aid with workload identity configuration (#7501, @fcrespofastly)Documentation
--dns01-recursive-nameservers(#7367, @SgtCoDFish)enableGatewayAPIin the config example. (#7354, @puerco)Bug or Regression
podDisruptionBudget.minAvailableandpodDisruptionBudget.maxAvailablevalues. (#7343, @inteon)renewBeforePercentageto comply with its spec (#7421, @adam-sroka)enabledto be set as a value to toggle cert-manager as a dependency. (#7350, @inteon)Other (Cleanup or Flake)
ValidateCAAfeature gate is now deprecated, with removal scheduled for cert-manager 1.18. In 1.17, enabling this feature gate will print a warning. (#7491, @jsoref)Neither --kubeconfig nor --master was specifiedwarning message when the controller and the webhook services boot (#7457, @Peac36)v1.16.5Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release addresses several vulnerabilities reported by the Trivy security scanner. It is built with the latest version of Go 1.23 and includes various dependency updates.
Changes since
v1.16.4:Bug or Regression
v1.23.8to fixCVE-2025-22871(#7706,@wallrj)github.com/golang-jwt/jwt/v5tov5.2.2to fixCVE-2025-30204(#7708,@wallrj)golang.org/x/netto fixCVE-2025-22872(#7707,@wallrj)go-josedependency to addressCVE-2025-27144(#7602,@SgtCoDFish)golang.org/x/netto addressCVE-2025-22870reported by Trivy (#7623,@SgtCoDFish)v1.16.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release is primarily intended to address a breaking change in Cloudflare's API which impacted ACME DNS-01 challenges using Cloudflare.
Many thanks to the community members who reported this issue!
Changes by Kind
Bug or Regression
v1.16.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.16.3 is a patch release mainly focused around bumping dependencies to address reported CVEs: CVE-2024-45337 and CVE-2024-45338.
We don't believe that cert-manager is actually vulnerable; this release is instead intended to satisfy vulnerability scanners.
It also includes a bug fix to the new
renewBeforePercentagefield. If you were usingrenewBeforePercentage, see PR #7421 for more information.Changes
Bug
golang.org/x/netandgolang.org/x/cryptoto address CVE-2024-45337 and CVE-2024-45338 (#7485, @erikgb)renewBeforePercentageto comply with its spec (#7441, @cert-manager-bot)Other
v1.16.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release of cert-manager 1.16 makes several changes to how PEM input is validated, adding maximum sizes appropriate to the type of PEM data which is being parsed.
This is to prevent an unacceptable slow-down in parsing specially crafted PEM data. The issue was found by Google's OSS-Fuzz project.
The issue is low severity; to exploit the PEM issue would require privileged access which would likely allow Denial-of-Service through other methods.
Note also that since most PEM data parsed by cert-manager comes from
ConfigMaporSecretresources which have a max size limit of approximately 1MB, it's difficult to force cert-manager to parse large amounts of PEM data.Further information is available in https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4
In addition, the version of Go used to build cert-manager 1.16 was updated along with the base images.
Changes by Kind
Bug or Regression
Other (Cleanup or Flake)
v1.16.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
The cert-manager 1.16 release includes: new Helm chart features, more Prometheus metrics, memory optimizations, and various improvements and bug fixes for the ACME issuer and Venafi Issuer.
📖 Read the complete 1.16 release notes before upgrading.
📜Changes since
v1.16.0Bug or Regression
@inteon)podDisruptionBudget.minAvailableandpodDisruptionBudget.maxAvailablevalues. (#7345,@inteon)enabledto be set as a value to toggle cert-manager as a dependency. (#7356,@inteon)v1.16.0caused cert-manager's ACME ClusterIssuer to look in the wrong namespace for resources required for the issuance (e.g. credential Secrets). This is now fixed inv1.16.1. (#7342,@inteon)v1.16.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
The cert-manager 1.16 release includes: new Helm chart features, more Prometheus metrics, memory optimizations, and various improvements and bug fixes for the ACME issuer and Venafi Issuer.
📖 Read the complete 1.16 release notes at cert-manager.io.
⚠️ Known issues
❗ Breaking changes
📖 Read the complete 1.16 release notes at cert-manager.io.
📜 Changes since v1.15.0
📖 Read the complete 1.16 release notes at cert-manager.io.
Feature
SecretRefsupport for Venafi TPP issuer CA Bundle (#7036,@sankalp-at-gh)renewBeforePercentagealternative torenewBefore(#6987,@cbroglie)@wallrj)@wallrj)@joshmue)@mindw)app.kubernetes.io/managed-by: cert-managerlabel to the cert-manager-webhook-ca Secret (#7154,@jrcichra)@ThatsMrTalbot)@Jasper-Ben)@wallrj)@wallrj)AWS_REGIONenvironment variable.Feature: The Route53 DNS solver of the ACME Issuer now uses the "ambient" region (
AWS_REGIONorAWS_DEFAULT_REGION) ifissuer.spec.acme.solvers.dns01.route53.regionis empty; regardless of the flags--issuer-ambient-credentialsand--cluster-issuer-ambient-credentials. (#7299,@wallrj)@inteon)--controllersflag only specifies disabled controllers, the default controllers are now enabled implicitly.Added
disableAutoApprovalandapproveSignerNamesHelm chart options. (#7049,@inteon)config.apiVersionandconfig.kindwithin the Helm chart. (#7126,@ThatsMrTalbot)@Guitarkalle)cainjector, by only caching the metadata of Secret resources.Reduce the load on the K8S API server when
cainjectorstarts up, by only listing the metadata of Secret resources. (#7161,@wallrj)AWS_REGIONandAWS_DEFAULT_REGIONenvironment variables, which is set by the IAM for Service Accounts (IRSA) webhook and by the Pod Identity webhook.The
issuer.spec.acme.solvers.dns01.route53.regionfield is now optional.The API documentation of the
regionfield has been updated to explain when and how the region value is used. (#7287,@wallrj)Breaking: cert-manager will no longer use the API Key authentication method which was deprecated in 20.2 and since removed in 24.1 of TPP. (#7084,
@hawksight)@aidy)webhook.extraEnv, allows you to set custom environment variables in the webhook Pod.Helm: New value
cainjector.extraEnv, allows you to set custom environment variables in the cainjector Pod.Helm: New value
startupapicheck.extraEnv, allows you to set custom environment variables in the startupapicheck Pod. (#7319,@wallrj)Bug or Regression
metadata.finalizers: "finalizer.acme.cert-manager.io": prefer a domain-qualified finalizer name to avoid accidental conflicts with other finalizer writers(#7273,@jsoref)aws-globalSTS region which is now required by thegithub.com/aws/aws-sdk-go-v2library. (#7108,@inteon)@inteon)@inteon)@wallrj)@wallrj)grpc-goto fixGHSA-xr7q-jx4m-x55m(#7164,@SgtCoDFish)go-retryablehttpdependency to fixCVE-2024-6104(#7125,@SgtCoDFish)@eplightning)endpointAdditionalPropertiesin thePodMonitortemplate of the Helm chart (#7190,@wallrj)@miguelvr)@bdols)@inteon)@inteon)KeyUsagesX.509 extension is no longer added when there are no key usages set (in accordance to RFC 5280 Section 4.2.1.3) (#7250,@inteon)github.com/Azure/azure-sdk-for-go/sdk/azidentityto addressCVE-2024-35255(#7087,@dependabot[bot])Other (Cleanup or Flake)
Removed:
(acme.)cert-manager.io/v1alpha2
(acme.)cert-manager.io/v1alpha3
(acme.)cert-manager.io/v1beta1 (#7278,
@inteon)v0.31.0removes a lot of noisyreflector.go: unable to sync list result: internal error: cannot cast object DeletedFinalStateUnknownerrors from logs. (#7237,@inteon)v1.23.2(#7324,@cert-manager-bot)v1.15.5Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager v1.15.5 contains simple dependency bumps to address reported CVEs (CVE-2024-45337 and CVE-2024-45338).
We don't believe that cert-manager is actually vulnerable; this release is instead intended to satisfy vulnerability scanners.
Changes
Bug or Regression
Other (Cleanup or Flake)
v1.15.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release of cert-manager 1.15 makes several changes to how PEM input is validated, adding maximum sizes appropriate to the type of PEM data which is being parsed.
This is to prevent an unacceptable slow-down in parsing specially crafted PEM data. The issue was found by Google's OSS-Fuzz project.
The issue is low severity; to exploit the PEM issue would require privileged access which would likely allow Denial-of-Service through other methods.
Note also that since most PEM data parsed by cert-manager comes from
ConfigMaporSecretresources which have a max size limit of approximately 1MB, it's difficult to force cert-manager to parse large amounts of PEM data.Further information is available in https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4
In addition, the version of Go used to build cert-manager 1.15 was updated along with the base images, and a Route53 bug fix was backported.
Changes by Kind
Bug or Regression
Other (Cleanup or Flake)
v1.15.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
🔗 See v1.15.0 for more information about cert-manager 1.15 and read-before-upgrade info.
📜 Changes since
v1.15.2Bug or Regression
v1.15.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
🔗 See v1.15.0 for more information about cert-manager 1.15 and read-before-upgrade info.
📜 Changes since
v1.15.1Bug or Regression
route53: explicitly set theaws-globalSTS region which is now required by thegithub.com/aws/aws-sdk-go-v2library. (#7189,@cert-manager-bot)grpc-goto fixGHSA-xr7q-jx4m-x55m(#7167,@SgtCoDFish)@cert-manager-bot)endpointAdditionalPropertiesin thePodMonitortemplate of the Helm chart (#7191,@inteon)HTTPRouteresources (#7186,@cert-manager-bot)golangfrom1.22.3to1.22.5(#7165,@github-actions)v1.15.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
🔗 See v1.15.0 for more information about cert-manager 1.15 and read-before-upgrade info.
📜 Changes since v1.15.0
Bug or Regression
Other (Cleanup or Flake)
v1.15.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.15 promotes several features to beta, including GatewayAPI support (
ExperimentalGatewayAPISupport), the ability to provide a subject in the Certificate that will be used literally in the CertificateSigningRequest (LiteralCertificateSubject) and the outputting of additional certificate formats (AdditionalCertificateOutputFormats).Community
Thanks again to all open-source contributors with commits in this release, including: @Pionerd, @SgtCoDFish, @ThatsMrTalbot, @andrey-dubnik, @bwaldrep, @eplightning, @erikgb, @findnature, @gplessis, @import-shiburin, @inteon, @jkroepke, @lunarwhite, @mangeshhambarde, @pwhitehead-splunk & @rodrigorfk, @wallrj.
Thanks also to the following cert-manager maintainers for their contributions during this release: @SgtCoDFish, @SpectralHiss, @ThatsMrTalbot, @hawksight, @inteon, @maelvls & @wallrj.
Equally thanks to everyone who provided feedback, helped users and raised issues on GitHub and Slack and joined our meetings!
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
Changes by Kind
Feature
--enable-gateway-apiflag to enable the integration. (#6961, @ThatsMrTalbot)For example:
cert-manager-certificaterequests-issuer-venafi/v1.15.0+(linux/amd64)+cert-manager/ef068a59008f6ed919b98a7177921ddc9e297200. (#6865, @wallrj)LiteralCertificateSubjectfeature to Beta. (#7030, @inteon)extraObjects; a list of yaml manifests which will helm will install and uninstall with the cert-manager manifests. (#6424, @gplessis)cert-manager.io/allow-direct-injectionin annotations (#6801, @jkroepke)Design
Bug or Regression
preferredChainis configured. (#6755, @import-shiburin)disableAutoApprovalandapproveSignerNamesHelm chart options. (#7054, @inteon)Other (Cleanup or Flake)
crds.keepandcrds.enabledHelm options can now be used instead of theinstallCRDsoption. (#6760, @inteon)slicesandk8s.io/apimachinery/pkg/utilpackages.Removed deprecated CSR functions which have been replaced with other functions in the
pkg/util/pkipackage. (#6730, @inteon)cmctlandkubectl cert-mangerhave been moved to the https://github.com/cert-manager/cmctl repo and will be versioned separately starting with cmctl v2.0.0 (#6663, @inteon)pkg/util/pki/ParseSubjectStringToRawDERBytesfunction. (#6994, @inteon)--controllersflag only specifies disabled controllers, the default controllers are now enabled implicitly. (#7054, @inteon)GO-2024-2824. (#6996, @github-actions[bot])v1.14.7Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.14.6
Bugfixes
Other (Cleanup or Flake)
v1.14.6Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.14.5
Other (Cleanup or Flake)
v1.14.5Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.14.5fixes a bug in the DigitalOcean DNS-01 provider which could cause incorrect DNS records to be deleted when using a domain with a CNAME. Special thanks to @BobyMCbobs for reporting this issue and testing the fix!It also patches CVE-2023-45288.
📜 Changes since v1.14.4
preferredChainis configured: see 1.14 release notes for more information.Changes
Bug or Regression
v1.14.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
⚠️ Known Issues
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.14.0 release notes
📜 Changes since v1.14.3
Bug or Regression
cert-manager.io/allow-direct-injectionin annotations (#6809, @jetstack-bot)Other (Cleanup or Flake)
v1.14.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
⚠️ Known Issues
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.14.0 release notes
📜 Changes since v1.14.2
Bug or Regression
v1.14.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
⚠️ Known Issues
preferredChainis configured: see release docs for more info and mitigationsℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See
Breaking changesin v1.14.0 release notes📜 Changes since
v1.14.1Bug or Regression
Other (Cleanup or Flake)
v1.14.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
⚠️ Known Issues (please install
v1.14.2)preferredChainis configured: see release docs for more info and mitigationsCAandSelfSignedissuers issue certificates with SANs set to non-critical even when the subject is empty. It incorrectly copies the critical field from the CSR.🔧 Breaking changes
See
Breaking changesin v1.14.0 release notesℹ️ Documentation
📜 Changes since
v1.14.0Bug or Regression
cmctl experimental installto panic. (#6706, @inteon)v1.14.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.14 brings a variety of features, security improvements and bug fixes, including: support for creating X.509 certificates with "Other Name" fields, and support for creating CA certificates with "Name Constraints" and "Authority Information Accessors" extensions.
⚠️ Known Issues (please install
v1.14.2)preferredChainis configured: see release docs for more info and mitigationsCAandSelfSignedissuers issue certificates with SANs set to non-critical even when the subject is empty. It incorrectly copies the critical field from the CSR.v1.14.0, the Helm chart for this version was found to use the wrong OCI image for thecainjectorDeployment,which caused the Helm installation to fail.
In order to complete the release, the cert-manager team have manually updated the Helm chart for this version,
which contains all the Helm chart fixes which are in
v1.14.1.startupapicheckimage in namespaces other than cert-manager.cmctl experimental installto panic.🔧 Breaking Changes
The startupapicheck job uses a new OCI image called "startupapicheck", instead of the ctl image.
If you run in an environment in which images cannot be pulled, be sure to include the new image.
The KeyUsage and BasicConstraints extensions will now be encoded as critical in the CertificateRequest's CSR blob.
🗺️ Major Themes
New X.509 Features
The cert-manager Certificate resource now allows you to configure a subset of "Other Name" SANs,
which are described in the Subject Alternative Name section of RFC 5280 (on page 37).
We specifically support any
otherNametype with aUTF-8value, such as the User Principal Name orsAMAccountName.These are useful when issuing unique certificates for authenticating with LDAP systems such as Microsoft Active Directory.
For example you can create certificates with this block in the spec:
The feature is still in alpha stage and requires you to enable the
OtherNamefeature flag in the controller and webhook components.New CA certificate Features
You can now specify the X.509 v3 Authority Information Accessors extension,
with URLs for certificates issued by the CA issuer.
Users can now use name constraints in CA certificates.
To know more details on name constraints check out RFC section https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
Security
An ongoing security audit of the cert-manager code revealed some weaknesses which we have addressed in this release,
such as using more secure default settings in the HTTP servers that serve metrics, healthz and pprof endpoints.
This will help mitigate denial-of-service attacks against those important services.
All the cert-manager containers are now configured with read only root file system by default,
to prevent unexpected changes to the file system of the OCI image.
And it is now possible to configure the metrics server to use HTTPS rather than HTTP,
so that clients can verify the identity of the metrics server.
Other
The liveness probe of the cert-manager controller Pod is now enabled by default.
There is a new option
.spec.keystores.pkcs12.algorithmsto specify encryption and MAC algorithms for PKCS.🤝 Community
Thanks again to all open-source contributors with commits in this release, including:
Thanks also to the following cert-manager maintainers for their contributions during this release:
Equally thanks to everyone who provided feedback, helped users and raised issues on GitHub and Slack and joined our meetings!
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
📜 Changes
Feature
"cluster-autoscaler.kubernetes.io/safe-to-evict": "true". You can provide an annotation of"cluster-autoscaler.kubernetes.io/safe-to-evict": "false"in yourpodTemplateif you don't like this. (#6349, @jsoref)Also, the controller's liveness probe is now enabled by default. (#6328, @inteon)
otherNameSANS in Certificates (#6404, @SpectralHiss)readOnlyRootFilesystemby default. (#6453, @wallrj).spec.keystores.pkcs12.algorithmsto specify encryption and MAC algorithms for PKCS#12 keystores. Fixes issues #5957 and #6523. (#6548, @snorwin)readOnlyRootFilesystem: true(#6462, @wallrj)revisionHistoryLimit(#6248, @tberreis)spec.namespaceSelectorfor webhooks (#6638, @jkroepke)Bug or Regression
.Values.configis set. (#6357, @ABWassim)GHSA-vgf6-pvf4-34rq: The webhook server now returns HTTP error 413 (Content Too Large) for requests with body size>= 3MiB. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory.The webhook server now returns HTTP error 400 (Bad Request) if the request contains an empty body.
The webhook server now returns HTTP error 500 (Internal Server Error) rather than crashing, if the code panics while handling a request. (#6498, @inteon)
BadConfigwarnings anymore (#6347, @lauraseidler)ReadHeaderTimeoutin allhttp.Serverinstances (#6534, @wallrj)WebSDK CertRequest Module Requested CertificateorThis certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.. (#6398, @maelvls).Values.webhook.configis set. (#6360, @ABWassim)otherNameSAN changes in Certificate resources trigger re-issuance. (#6620, @SpectralHiss)startupapicheckimage toquay.io(#6609, @wallrj)Other (Cleanup or Flake)
1.21.3to addressCVE-2023-39325. Also bumps base images. (#6410, @SgtCoDFish)golang.org/x/net v0.15.0 => v0.17.0as part of addressingCVE-2023-44487/CVE-2023-39325(#6427, @SgtCoDFish)crypto/md5, a weak cryptographic primitive; usinggolangci-lint/gosec(G501). (#6581, @wallrj)crypto/sha1, a weak cryptographic primitive; usinggolangci-lint/gosec(G505). (#6579, @wallrj)math/randinstead ofcrypto/rand); usinggolangci-lint/gosec(G404). (#6582, @wallrj)pkg/util.RandStringRunesandpkg/controller/test.RandStringBytes. Usek8s.io/apimachinery/pkg/util/rand.Stringinstead. (#6585, @wallrj)subject.serialNumberwhile using a literal certificate subject. This was a mistake and has been fixed. (#6533, @inteon)github.com/emicklei/go-restful/v3tov3.11.0becausev3.10.2is labeled as "DO NOT USE". (#6366, @inteon)sets.Settype in place of the deprecatedsets.String. (#6586, @wallrj)v1.21.6(#6628, @SgtCoDFish)autorestdependency (#5452, @phillebaba)v1.13.6Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.13.6fixes a bug in the DigitalOcean DNS-01 provider which could cause incorrect DNS records to be deleted when using a domain with a CNAME. Special thanks to @BobyMCbobs for reporting this issue and testing the fix!It also patches CVE-2023-45288.
Known Issues
preferredChainis configured: see 1.14 release notes for more information.Changes
Bug or Regression
v1.13.5Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
⚠️ Known Issues
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.13.0 release notes
📜 Changes since v1.13.4
Bug or Regression
cert-manager.io/allow-direct-injectionin annotations (#6810, @jetstack-bot)Other (Cleanup or Flake)
v1.13.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
⚠️ Known Issues
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.13.0 release notes
📜 Changes since v1.13.3
Bug or Regression
Other (Cleanup or Flake)
github.com/containerd/containerd@v1.7.12(#6684, @wallrj)v1.13.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release contains fixes for the following security vulnerabilities in the cert-manager-controller:
GO-2023-2334: Decryption of malicious PBES2 JWE objects can consume unbounded system resources.If you use ArtifactHub Security report or trivy, this patch will also silence the following warning about a vulnerability in code which is imported but not used by the cert-manager-controller:
CVE-2023-47108: DoS vulnerability inotelgrpcdue to unbound cardinality metrics.An ongoing security audit of cert-manager suggested some changes to the webhook code to mitigate DoS attacks, and these are included in this patch release.
Changes
Bug or Regression
>= 3MiB. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory. (#6507, @inteon)ReadHeaderTimeoutin allhttp.Serverinstances. (#6538, @wallrj)otel,docker, andjoseto fix CVE alerts. See https://github.com/advisories/GHSA-8pgv-569h-w5rw, https://github.com/advisories/GHSA-jq35-85cj-fj4p, and https://github.com/advisories/GHSA-2c7c-3mj9-8fqh. (#6514, @inteon)Dependencies
Added
Nothing has changed.
Changed
cloud.google.com/go/firestore:v1.11.0 → v1.12.0cloud.google.com/go:v0.110.6 → v0.110.7github.com/felixge/httpsnoop:v1.0.3 → v1.0.4github.com/go-jose/go-jose/v3:v3.0.0 → v3.0.1github.com/go-logr/logr:v1.2.4 → v1.3.0github.com/golang/glog:v1.1.0 → v1.1.2github.com/google/go-cmp:v0.5.9 → v0.6.0go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc:v0.45.0 → v0.46.0go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp:v0.44.0 → v0.46.0go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc:v1.19.0 → v1.20.0go.opentelemetry.io/otel/exporters/otlp/otlptrace:v1.19.0 → v1.20.0go.opentelemetry.io/otel/metric:v1.19.0 → v1.20.0go.opentelemetry.io/otel/sdk:v1.19.0 → v1.20.0go.opentelemetry.io/otel/trace:v1.19.0 → v1.20.0go.opentelemetry.io/otel:v1.19.0 → v1.20.0go.uber.org/goleak:v1.2.1 → v1.3.0golang.org/x/sys:v0.13.0 → v0.14.0google.golang.org/genproto/googleapis/api:f966b18 → b8732ecgoogle.golang.org/genproto:f966b18 → b8732ecgoogle.golang.org/grpc:v1.58.3 → v1.59.0Removed
Nothing has changed.
v1.13.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.13.2 fixes some CVE alerts and contains fixes for:
⚠️ READ https://github.com/cert-manager/cert-manager/releases/tag/v1.13.0 before you upgrade from a < v1.13 version!
Changes since v1.13.1
Bug or Regression
WebSDK CertRequest Module Requested CertificateorThis certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.. (#6402, @maelvls)Other (Cleanup or Flake)
v1.13.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.13.1 contains a bugfix for a name collision bug in the StableCertificateRequestName feature that was enabled by default in v1.13.0.
⚠️ READ https://github.com/cert-manager/cert-manager/releases/tag/v1.13.0 before you upgrade from a < v1.13 version!
Changes since v1.13.0
Bug or Regression
Other (Cleanup or Flake)
github.com/emicklei/go-restful/v3tov3.11.0becausev3.10.2is labeled as "DO NOT USE". (#6368, @inteon)v1.13.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This is the 1.13 release of cert-manager!
cert-manager 1.13 brings support for DNS over HTTPS, support for loading options from a versioned
config file for the cert-manager controller, and more. This release also includes the promotion of
the StableCertificateRequestName and SecretsFilteredCaching feature gates to Beta.
Known issues
The
StableCertificateRequestNamethat was promoted to Beta contains a "name collision" bug: #6342This is fixed in v1.13.1+
Breaking Changes (You MUST read this before you upgrade!)
.featureGatesvalue set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Usewebhook.featureGatesfield instead to define features to be enabled on webhook. (#6093, @irbekrm)--feature-gatesflag, this will now break (unless the webhook actually has a feature by that name). (#6093, @irbekrm)Community
Welcome to these new cert-manager members (more info - #6260):
@jsoref
@FlorianLiebhart
@hawksight
@erikgb
Thanks again to all open-source contributors with commits in this release, including:
@AcidLeroy
@FlorianLiebhart
@lucacome
@cypres
@erikgb
@ubergesundheit
@jkroepke
@jsoref
@gdvalle
@rouke-broersma
@schrodit
@zhangzhiqiangcs
@arukiidou
@hawksight
@Richardds
@kahirokunn
Thanks also to the following cert-manager maintainers for their contributions during this release:
@SgtCoDFish
@maelvls
@irbekrm
@inteon
Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack and joined our meetings!
Special thanks to @AcidLeroy for adding "load options from a versioned config file" support for the cert-manager controller! This has been on our wishlist for a very long time. (see #5337)
Also, thanks a lot to @FlorianLiebhart for adding support for DNS over HTTPS for the ACME DNS self-check. This is very useful in case all traffic must be HTTP(S) trafic, eg. when using a HTTPS_PROXY. (see #5003)
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
Changes since v1.12.0
Feature
cluster-readeraggregated cluster role (#6241, @erikgb)enableServiceLinksconfigurable for all Deployments andstartupapicheckJob in Helm chart. (#6292, @ubergesundheit)Design
The DNS check method to be used is controlled through the command line flag:
--dns01-recursive-nameservers-only=truein combination with--dns01-recursive-nameservers=https://<DoH-endpoint>(e.g.https://8.8.8.8/dns-query). It keeps using DNS lookup as a default method. (#5003, @FlorianLiebhart)Bug or Regression
cmctl check api --wait 0exited without output and exit code 1; we now make sure we perform the API check at least once and return with the correct error code (#6109, @inteon)⚠️ ⚠️ BREAKING ⚠️ ⚠️ : If you deploy cert-manager using helm and have
.featureGatesvalue set, the features defined there will no longer be passed to cert-manager webhook, only to cert-manager controller. Usewebhook.featureGatesfield instead to define features to be enabled on webhook.⚠️Potentially breaking: If you were, for some reason, passing cert-manager controller's features to webhook's
--feature-gatesflag, this will now break (unless the webhook actually has a feature by that name). (#6093, @irbekrm)net.IP.String()function would have printed that address. (#6293, @SgtCoDFish)enableServiceLinksoption for our ACME http solver pods, because the option caused the pod to be in a crash loop in a cluster with lot of services. (#6143, @schrodit)Other (Cleanup or Flake)
cert-manager.io/common-name,cert-manager.io/alt-names, ... annotations on Secrets are kept at their correct value. (#6176, @inteon)v0.27.2. (#6077, @lucacome)v0.27.4. (#6227, @lucacome)v1.12.17Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release addresses several vulnerabilities reported by the Trivy security scanner. It is built with the latest version of Go 1.23 and includes various dependency updates.
Changes since
v1.12.16Bug or Regression
v1.23.8to fixCVE-2025-22871(#7709,@wallrj)golang.org/x/nettov0.38.0to fixCVE-2025-22872(#7709,@wallrj)github.com/golang-jwt/jwt/v4tov4.5.2to fixCVE-2025-30204(#7709,@wallrj)go-joseto addressCVE-2025-27144(#7597,@SgtCoDFish)golang.org/x/netto addressCVE-2025-22870reported by Trivy (#7624,@SgtCoDFish)golang.org/x/netto addressCVE-2025-22870reported by Trivy (#7623,@SgtCoDFish)v1.12.16Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release is primarily intended to address a breaking change in Cloudflare's API which impacted ACME DNS-01 challenges using Cloudflare.
Many thanks to the community members who reported this issue!
cert-manager v1.12.16 also bumps the version of Go used to build to 1.23.6 which is the latest at the time of release. This is to address a variety of reported vulnerabilities reported in cert-manager v1.12.15:
We don't expect that bumping Go will produce many noticeable changes, but there are some
GODEBUGchanges that could be applicable - specificallyx509negativeserialmay be of interest to users dealing with legacy certificates.There's more information on go.dev which may help if you suspect any changes in this version bump may have caused issues in your environment.
Changes by Kind
Bug or Regression
v1.12.15Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager
v1.12.15contains simple dependency bumps to address reported CVEs (CVE-2024-45337andCVE-2024-45338).We don't believe that cert-manager is actually vulnerable; this release is instead intended to satisfy vulnerability scanners.
It's important to note also that cert-manager v1.12 LTS has older base images which are no longer updated. These base images don't contain much, but they do contain time zone data which can get out of date.
To preserve original functionality, we don't intend to change the base images for cert-manager v1.12 LTS unless there's a very serious issue. As such, scanners may report issues with an out-of-date time zone database. If you require a newer base image, you should upgrade to a newer version of cert-manager.
What's Changed
Full Changelog: https://github.com/cert-manager/cert-manager/compare/v1.12.14...v1.12.15
v1.12.14Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release of cert-manager 1.12 makes several changes to how PEM input is validated, adding maximum sizes appropriate to the type of PEM data which is being parsed.
This is to prevent an unacceptable slow-down in parsing specially crafted PEM data. The issue was found by Google's OSS-Fuzz project.
The issue is low severity; to exploit the PEM issue would require privileged access which would likely allow Denial-of-Service through other methods.
Note also that since most PEM data parsed by cert-manager comes from
ConfigMaporSecretresources which have a max size limit of approximately 1MB, it's difficult to force cert-manager to parse large amounts of PEM data.Further information is available in https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4
This patch release also fix an issue reported by Trivy, although that issue is low severity and is not expected to be relevant to cert-manager.
Bug Fixes
github.com/golang-jwt/jwt/v4(#7407, @SgtCoDFish)v1.12.13Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.12.12
This patch release fixes the following vulnerabilities:
CVE-2024-6104,CVE-2024-24791,CVE-2024-25620,CVE-2024-26147, andCVE-2024-41110.Bugfixes
go-retryablehttpdependency to fixCVE-2024-6104(#7128, @SgtCoDFish)CVE-2024-25620andCVE-2024-26147and Docker dependency to resolveCVE-2024-41110(#7214, @ThatsMrTalbot)1.21.13to resolveCVE-2024-24791(#7216, @ThatsMrTalbot)v1.12.12Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.12.11
Bugfixes
Other (Cleanup or Flake)
v1.12.11Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.12.10
Other (Cleanup or Flake)
v1.12.10Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.10fixes a bug in the DigitalOcean DNS-01 provider which could cause incorrect DNS records to be deleted when using a domain with a CNAME. Special thanks to @BobyMCbobs for reporting this issue and testing the fix!It also patches CVE-2023-45288.
⚠️ Known Issues
ACME Issuer (Let's Encrypt): wrong certificate chain may be used if preferredChain is configured: see release docs for more info and mitigations
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see #6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
Changes
Bug or Regression
v1.12.9Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
⚠️ Known Issues
ACME Issuer (Let's Encrypt): wrong certificate chain may be used if preferredChain is configured: see release docs for more info and mitigations
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see #6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.12.0 release notes
📜 Changes since v1.12.8
Bug or Regression
cert-manager.io/allow-direct-injectionin annotations (#6811, @jetstack-bot)Other (Cleanup or Flake)
v1.12.8Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
⚠️ Known Issues
ACME Issuer (Let's Encrypt): wrong certificate chain may be used if preferredChain is configured: see release docs for more info and mitigations
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see #6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.12.0 release notes
📜 Changes since v1.12.7
Bug or Regression
Other (Cleanup or Flake)
github.com/containerd/containerd@v1.7.12(#6689, @wallrj)v1.12.7Compare Source
This patch release contains fixes for the following security vulnerabilities in the cert-manager-controller:
GO-2023-2382: Denial of service via chunk extensions innet/httpIf you use ArtifactHub Security report or trivy, this patch will also silence the following warning about a vulnerability in code which is imported but not used by the cert-manager-controller:
CVE-2023-47108: DoS vulnerability inotelgrpcdue to unbound cardinality metrics.An ongoing security audit of cert-manager suggested some changes to the webhook code to mitigate DoS attacks,
and these are included in this patch release.
Known bugs
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see #6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
Changes
Feature
1.20.12(#6543, @wallrj).Bug or Regression
>= 3MiB. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory (#6506, @inteon).ReadHeaderTimeoutin allhttp.Serverinstances (#6539, @wallrj).otelanddockerto fix:CVE-2023-47108andGHSA-jq35-85cj-fj4p(#6513, @inteon).Dependencies
Added
cloud.google.com/go/dataproc/v2:v2.0.1Changed
cloud.google.com/go/aiplatform:v1.45.0 → v1.48.0cloud.google.com/go/analytics:v0.21.2 → v0.21.3cloud.google.com/go/baremetalsolution:v0.5.0 → v1.1.1cloud.google.com/go/batch:v0.7.0 → v1.3.1cloud.google.com/go/beyondcorp:v0.6.1 → v1.0.0cloud.google.com/go/bigquery:v1.52.0 → v1.53.0cloud.google.com/go/cloudbuild:v1.10.1 → v1.13.0cloud.google.com/go/cloudtasks:v1.11.1 → v1.12.1cloud.google.com/go/compute:v1.21.0 → v1.23.0cloud.google.com/go/contactcenterinsights:v1.9.1 → v1.10.0cloud.google.com/go/container:v1.22.1 → v1.24.0cloud.google.com/go/datacatalog:v1.14.1 → v1.16.0cloud.google.com/go/dataplex:v1.8.1 → v1.9.0cloud.google.com/go/datastore:v1.12.1 → v1.13.0cloud.google.com/go/datastream:v1.9.1 → v1.10.0cloud.google.com/go/deploy:v1.11.0 → v1.13.0cloud.google.com/go/dialogflow:v1.38.0 → v1.40.0cloud.google.com/go/documentai:v1.20.0 → v1.22.0cloud.google.com/go/eventarc:v1.12.1 → v1.13.0cloud.google.com/go/firestore:v1.11.0 → v1.12.0cloud.google.com/go/gkebackup:v0.4.0 → v1.3.0cloud.google.com/go/gkemulticloud:v0.6.1 → v1.0.0cloud.google.com/go/kms:v1.12.1 → v1.15.0cloud.google.com/go/maps:v0.7.0 → v1.4.0cloud.google.com/go/metastore:v1.11.1 → v1.12.0cloud.google.com/go/policytroubleshooter:v1.7.1 → v1.8.0cloud.google.com/go/pubsub:v1.32.0 → v1.33.0cloud.google.com/go/run:v0.9.0 → v1.2.0cloud.google.com/go/servicedirectory:v1.10.1 → v1.11.0cloud.google.com/go/speech:v1.17.1 → v1.19.0cloud.google.com/go/translate:v1.8.1 → v1.8.2cloud.google.com/go/video:v1.17.1 → v1.19.0cloud.google.com/go/vmwareengine:v0.4.1 → v1.0.0cloud.google.com/go:v0.110.4 → v0.110.7github.com/felixge/httpsnoop:v1.0.3 → v1.0.4github.com/go-logr/logr:v1.2.4 → v1.3.0github.com/golang/glog:v1.1.0 → v1.1.2github.com/google/go-cmp:v0.5.9 → v0.6.0github.com/google/uuid:v1.3.0 → v1.3.1go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc:v0.45.0 → v0.46.0go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp:v0.44.0 → v0.46.0go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc:v1.19.0 → v1.20.0go.opentelemetry.io/otel/exporters/otlp/otlptrace:v1.19.0 → v1.20.0go.opentelemetry.io/otel/metric:v1.19.0 → v1.20.0go.opentelemetry.io/otel/sdk:v1.19.0 → v1.20.0go.opentelemetry.io/otel/trace:v1.19.0 → v1.20.0go.opentelemetry.io/otel:v1.19.0 → v1.20.0go.uber.org/goleak:v1.2.1 → v1.3.0golang.org/x/oauth2:v0.10.0 → v0.11.0golang.org/x/sys:v0.13.0 → v0.14.0google.golang.org/genproto/googleapis/api:782d3b1 → b8732ecgoogle.golang.org/genproto/googleapis/rpc:782d3b1 → b8732ecgoogle.golang.org/genproto:782d3b1 → b8732ecgoogle.golang.org/grpc:v1.58.3 → v1.59.0Removed
cloud.google.com/go/dataproc:v1.12.0v1.12.6Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.6 fixes some CVE alerts and a Venafi issuer bug.
Known bugs
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see #6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
Changes since v1.12.5
Bug or Regression
WebSDK CertRequest Module Requested CertificateorThis certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.. (#6401, @maelvls)Other (Cleanup or Flake)
v1.12.5Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.5 contains a backport for a name collision bug that was found in v1.13.0
Changes since v1.12.4
Bug or Regression
Other (Cleanup or Flake)
v1.12.4Compare Source
v1.12.4 contains an important security fix that addresses CVE-2023-29409.
Changes since v1.12.3
net.IP.String()function would have printed that address. (#6297, @SgtCoDFish)crypto/tlslibrary. (#6318, @maelvls)v1.12.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.3 contains a bug fix for the cainjector which addresses a memory leak!
Changes since v1.12.2
Bugfixes
v1.12.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.2 is a bugfix release, but includes a known issue and you should prefer the latest patch release!
Known issues
⚠️ cert-manager v1.12.0, v1.12.1 and v1.12.2 all have known issues. You should install the latest patch release of v1.12 and skip over the affected versions.
Changes since v1.12.1
Bugfixes
cmctl check api --wait 0exited without output; we now make sure we perform the API check at least once (#6116, @jetstack-bot)v1.12.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.1 release contains a couple dependency bumps and changes to ACME external webhook library.
Known issues
⚠️ cert-manager v1.12.0, v1.12.1 and v1.12.2 all have known issues. You should install the latest patch release of v1.12 and skip over the affected versions.
cmctlAPI check is broken in v1.12.0 and v1.12.1. We suggest that you do not upgradecmctlto this version. The fix was released in v1.12.2 (which has an additional issue, see below). See #6116 for context.Changes since v1.12.0
Other (Cleanup or Flake)
Uncategorized
v0.27.2. (#6077, @lucacome)v0.15.0(#6098, @lucacome)v1.12.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager v1.12 brings support for JSON logging, a lower memory footprint, support for ephemeral service account tokens with Vault, improved dependency management and support for the ingressClassName field.
The full release notes are available at https://cert-manager.io/docs/release-notes/release-notes-1.12.
Known issues
⚠️ cert-manager v1.12.0, v1.12.1 and v1.12.2 all have known issues. You should install the latest patch release of v1.12 and skip over the affected versions.
cmctlAPI check is broken in v1.12.0 and v1.12.1. We suggest that you do not upgradecmctlto this version. The fix was released in v1.12.2 (which has an additional issue, see below). See #6116 for context.Community
Thanks again to all open-source contributors with commits in this release, including:
Thanks also to the following cert-manager maintainers for their contributions during this release:
Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack, joined our meetings and talked to us at Kubecon!
Special thanks to @erikgb for continuously great input and feedback and to @lucacome for always ensuring that our kube deps are up to date!
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Jetstack (by Venafi) for contributing developer time and resources towards the continued maintenance of cert-manager projects.
Changes by Kind
Feature
--concurrent-workersflag that lets you control the number of concurrent workers for each of our controllers. (#5936, @inteon)acme.solvers.http01.ingress.podTemplate.spec.imagePullSecretsfield to issuer spec to allow to specify image pull secrets for the ACME HTTP01 solver pod. (#5801, @malovme)--watch-certsflag was renamed to--enable-certificates-data-source. (#5766, @irbekrm)--dns01-recursive-nameservers,--enable-certificate-owner-ref, and--dns01-recursive-nameservers-onlythrough Helm values. (#5614, @jkroepke)ingressClassName. The credit goes to @dsonck92 for implementing the initial PR. (#5849, @maelvls)serviceAccountReffield, cert-manager generates a short-lived token associated to the service account to authenticate to Vault. Along with this new feature, we have added validation logic in the webhook in order to check thevault.authfield when creating an Issuer or ClusterIssuer. Previously, it was possible to create an Issuer or ClusterIssuer with an invalid value forvault.auth. (#5502, @maelvls)/livezendpoint and a default liveness probe, which fails if leader election has been lost and for some reason the process has not exited. The liveness probe is disabled by default. (#5962, @wallrj)--v=5flag) (#5975, @tobotg)Design
This is not necessarily a breaking change as due to a race condition this may already have been the case. (#5887, @irbekrm)
Documentation
values.yamlare now working (#5999, @SgtCoDFish)Bug or Regression
cmctl x install. (#5720, @irbekrm)--acme-http01-solver-imagegiven to the variableacmesolver.extraArgsnow has precedence over the variableacmesolver.image. (#5693, @SgtCoDFish)jksandpkcs12fields on a Certificate resource with a CA issuer that doesn't set theca.crtin the Secret resource, cert-manager no longer loop trying to copyca.crtintotruststore.jksortruststore.p12. (#5972, @vinzent)literalSubjectfield on a Certificate resource, the IPs, URIs, DNS names, and email addresses segments are now properly compared. (#5747, @inteon)Other (Cleanup or Flake)
make go-workspacetarget for generating a go.work file for local development (#5935, @SgtCoDFish)**BREAKING:*- users who are relying on cainjector to work when
certificates.cert-manager.ioCRD is not installed in the cluster, now need to pass--watch-certificates=falseflag to cainjector else it will not start.Users who only use cainjector as cert-manager's internal component and have a large number of
Certificateresources in cluster can pass--watch-certificates=falseto avoid cainjector from cachingCertificateresources and save some memory. (#5746, @irbekrm)automountServiceAccountTokenturned off. (#5754, @wallrj)SecretsFilteredCachingfeature flag. The filtering mechanism might, in some cases, slightly slow down issuance or cause additional requests to kube-apiserver because unlabelled Secret resources that cert-manager controller needs will now be retrieved from kube-apiserver instead of being cached locally. To prevent this from happening, users can label all issuer Secret resources with thecontroller.cert-manager.io/fao: truelabel. (#5824, @irbekrm)POTENTIALLY BREAKING: this PR slightly changes how the name of the Challenge resources are calculated. To avoid duplicate issuances due to the Challenge resource being recreated, ensure that there is no in-progress ACME certificate issuance when you upgrade to this version of cert-manager. (#5901, @irbekrm)
v0.26.2. (#5820, @lucacome)v0.26.3. (#5907, @lucacome)v0.27.1. (#5961, @lucacome)certificate.spec.secretNameis a validSecretname (#5967, @avi-08)certificate.spec.secretNameSecrets will now be labelled withcontroller.cert-manager.io/faolabel (#5660, @irbekrm)Uncategorized
v1.11.5Compare Source
v1.11.5 contains an important security fix that addresses CVE-2023-29409.
Changes since v1.11.4
crypto/tlslibrary. (#6317, @maelvls)v1.11.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager v1.11.4 contains some version bumps to address reported CVEs (although we don't expect that cert-manager was actually vulnerable to anything!)
Changes by Kind
Other (Cleanup or Flake)
Dependencies
Changed
v1.11.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.11.3 mostly contains ACME library changes. API Priority and Fairness feature is now disabled in the external webhook's extension apiserver.
Changes by Kind
Other (Cleanup or Flake)
v1.11.2Compare Source
Changelog since v1.11.1
Changes by Kind
Bug or Regression
Other (Cleanup or Flake)
Bump the distroless base images (#5930, @maelvls)
Bumps Docker libraries to fix vulnerability scan alert for CVE-2023-28840, CVE-2023-28841, CVE-2023-28842 (#6037, @irbekrm)
Cert-manager was not actually affected by these CVEs which are all to do with Docker daemon's overlay network.
Bumps Kube libraries v0.26.0 -> v0.26.4 (#6038, @irbekrm)
This might help with running cert-manager v1.11 on Kubernetes v1.27, see #6038
v1.11.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
In v1.11.1, we updated the base images used for cert-manager containers. In addition, the users of the Venafi issuer will see less certificates repeatedly failing.
If you are a user of Venafi TPP and have been having issues with the error message
This certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry, please use this version.Changes since v1.11.0
Bug or Regression
cmctl x install, to work around a hardcoded Kubernetes version in Helm. (#5726, @SgtCoDFish)Other (Cleanup or Flake)
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.