chore(deps): update helm release cert-manager to v1.20.2#1274
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update helm release cert-manager to v1.20.2#1274renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
Helm Diff
@@ -6,7 +6,7 @@
fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
apiVersion: v2
-appVersion: v1.19.2
+appVersion: v1.20.2
description: A Helm chart for cert-manager
home: https://cert-manager.io
icon: https://raw.githubusercontent.com/cert-manager/community/4d35a69437d21b76322157e6284be4cd64e6d2b7/logo/logo-small.png
@@ -23,4 +23,4 @@
name: cert-manager
sources:
- https://github.com/cert-manager/cert-manager
-version: v1.19.2
+version: v1.20.2
@@ -21,7 +21,7 @@
# If a component-specific nodeSelector is also set, it will be merged and take precedence.
# +docs:property
nodeSelector: {}
-
+
# Labels to apply to all resources.
# Please note that this does not add labels to the resources created dynamically by the controllers.
# For these resources, you have to add the labels in the template in the cert-manager custom resource:
@@ -153,6 +153,13 @@
# +docs:type=unknown
# maxUnavailable: 1
+ # This configures how to act with unhealthy pods during eviction
+ # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+ # the cluster to work.
+ # +docs:property
+ # +docs:type=string
+ # unhealthyPodEvictionPolicy: AlwaysAllow
+
# A comma-separated list of feature gates that should be enabled on the
# controller pod.
featureGates: ""
@@ -160,21 +167,47 @@
# The maximum number of challenges that can be scheduled as 'processing' at once.
maxConcurrentChallenges: 60
+# The container registry used for all cert-manager images by default.
+# This can include path prefixes (e.g. `artifactory.example.com/docker`).
+# +docs:property
+imageRegistry: quay.io
+
+# The repository namespace used for all cert-manager images by default.
+# Examples:
+# - jetstack
+# - cert-manager
+# +docs:property
+imageNamespace: jetstack
+
image:
- # The container registry to pull the manager image from.
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
# +docs:property
- # registry: quay.io
+ # registry: ""
- # The container image for the cert-manager controller.
+ # The image name for the cert-manager controller.
+ # This is used (together with `imageRegistry` and `imageNamespace`) to construct the full image reference.
# +docs:property
- repository: quay.io/jetstack/cert-manager-controller
+ name: cert-manager-controller
+
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `image.name`).
+ # Example: quay.io/jetstack/cert-manager-controller
+ # +docs:property
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion is used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag.
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
@@ -254,25 +287,21 @@
# kubernetesAPIBurst: 9000
# numberOfConcurrentWorkers: 200
# enableGatewayAPI: true
-# # Feature gates as of v1.18.1. Listed with their default values.
+# # Feature gates as of v1.20.0. Listed with their default values.
# # See https://cert-manager.io/docs/cli/controller/
# featureGates:
-# AdditionalCertificateOutputFormats: true # GA - default=true
# AllAlpha: false # ALPHA - default=false
# AllBeta: false # BETA - default=false
+# ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
# ExperimentalCertificateSigningRequestControllers: false # ALPHA - default=false
# ExperimentalGatewayAPISupport: true # BETA - default=true
# LiteralCertificateSubject: true # BETA - default=true
# NameConstraints: true # BETA - default=true
-# OtherNames: false # ALPHA - default=false
+# OtherNames: true # BETA - default=true
# SecretsFilteredCaching: true # BETA - default=true
# ServerSideApply: false # ALPHA - default=false
# StableCertificateRequestName: true # BETA - default=true
# UseCertificateRequestBasicConstraints: false # ALPHA - default=false
-# UseDomainQualifiedFinalizer: true # GA - default=true
-# ValidateCAA: false # ALPHA - default=false
-# DefaultPrivateKeyRotationPolicyAlways: true # BETA - default=true
-# ACMEHTTP01IngressPathTypeExact: true # BETA - default=true
# # Configure the metrics server for TLS
# # See https://cert-manager.io/docs/devops-tips/prometheus-metrics/#tls
# metricsTLSConfig:
@@ -281,6 +310,13 @@
# secretName: "cert-manager-metrics-ca"
# dnsNames:
# - cert-manager-metrics
+# # Configure PEM size limits for certificate validation
+# # Useful for certificates with many DNS names (e.g., Istio gateways with 100+ DNS names)
+# pemSizeLimitsConfig:
+# maxCertificateSize: 36500 # Maximum size in bytes for individual certificates (default: 36500)
+# maxPrivateKeySize: 13000 # Maximum size in bytes for private keys (default: 13000)
+# maxChainLength: 95000 # Maximum size in bytes for certificate chains (default: 95000)
+# maxBundleSize: 330000 # Maximum size in bytes for certificate bundles (default: 330000)
config: {}
# Setting Nameservers for DNS01 Self Check.
@@ -320,6 +356,38 @@
# - --controllers=*,-certificaterequests-approver
extraArgs: []
+# Extra containers to add to the pod spec in the deployment of the cert-manager controller.
+# For example, to deploy the [aws_signing_helper](https://github.com/aws/rolesanywhere-credential-helper) (replacing the ARNs as relevant):
+#
+# extraEnv:
+# - name: AWS_EC2_METADATA_SERVICE_ENDPOINT
+# - value: http://127.0.0.1:9911
+# extraContainers:
+# - name: rolesanywhere-credential-helper
+# image: public.ecr.aws/rolesanywhere/credential-helper:latest
+# command: [aws_signing_helper]
+# args:
+# - serve
+# - --private-key
+# - /etc/cert/tls.key
+# - --certificate
+# - /etc/cert/tls.crt
+# - --role-arn
+# - $ROLE_ARN
+# - --profile-arn
+# - $PROFILE_ARN
+# - --trust-anchor-arn
+# - $TRUST_ANCHOR_ARN
+# volumeMounts:
+# - name: cert
+# mountPath: /etc/cert/
+# readOnly: true
+# volumes:
+# - name: cert
+# secret:
+# secretName: cert
+extraContainers: []
+
# Additional environment variables to pass to cert-manager controller binary.
# For example:
# extraEnv:
@@ -429,6 +497,45 @@
nodeSelector:
kubernetes.io/os: linux
+# Enables default network policies for cert-manager.
+# This provides a way for you to restrict network traffic
+# between cert-manager components and other pods.
+# For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+# NOTE: an incorrect networkPolicy will cause traffic to be dropped
+networkPolicy:
+ # Create network policies for cert-manager.
+ enabled: false
+
+ # Ingress rule for the cert-manager network policy.
+ # By default all pods are allowed access to:
+ # http-metrics and http-healthz ports
+ # +docs:property
+ ingress:
+ - ports:
+ - port: http-metrics
+ protocol: TCP
+ - port: http-healthz
+ protocol: TCP
+
+
+ # Egress rule for the cert-manager network policy. By default, it allows all
+ # outbound traffic to ports 80 and 443, as well as DNS ports.
+ # +docs:property
+ egress:
+ - ports:
+ - port: 80
+ protocol: TCP
+ - port: 443
+ protocol: TCP
+ - port: 53
+ protocol: TCP
+ - port: 53
+ protocol: UDP
+ # On OpenShift and OKD, the Kubernetes API server listens on.
+ # port 6443.
+ - port: 6443
+ protocol: TCP
+
# +docs:ignore
ingressShim: {}
@@ -744,6 +851,13 @@
# +docs:type=unknown
# maxUnavailable: 1
+ # This configures how to act with unhealthy pods during eviction
+ # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+ # the cluster to work.
+ # +docs:property
+ # +docs:type=string
+ # unhealthyPodEvictionPolicy: AlwaysAllow
+
# Optional additional annotations to add to the webhook Deployment.
# +docs:property
# deploymentAnnotations: {}
@@ -896,20 +1010,32 @@
serviceIPFamilies: []
image:
- # The container registry to pull the webhook image from.
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `webhook.image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `webhook.image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
# +docs:property
- # registry: quay.io
+ # registry: ""
- # The container image for the cert-manager webhook
+ # The image name for the cert-manager webhook.
# +docs:property
- repository: quay.io/jetstack/cert-manager-webhook
+ name: cert-manager-webhook
+
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `webhook.image.name`).
+ # +docs:property
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion will be used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
@@ -973,19 +1099,26 @@
# host:
# Enables default network policies for webhooks.
+ # This provides a way for you to restrict network traffic
+ # between cert-manager components and other pods.
+ # For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+ # NOTE: an incorrect networkPolicy will cause traffic to be dropped
networkPolicy:
# Create network policies for the webhooks.
enabled: false
- # Ingress rule for the webhook network policy. By default, it allows all
- # inbound traffic.
+ # Ingress rule for the webhook network policy.
+ # By default all pods are allowed access to:
+ # https, http-metrics, and http-healthz ports
# +docs:property
ingress:
- - from:
- - ipBlock:
- cidr: 0.0.0.0/0
- - ipBlock:
- cidr: "::/0"
+ - ports:
+ - port: https
+ protocol: TCP
+ - port: healthcheck
+ protocol: TCP
+ - port: http-metrics
+ protocol: TCP
# Egress rule for the webhook network policy. By default, it allows all
# outbound traffic to ports 80 and 443, as well as DNS ports.
@@ -1004,11 +1137,6 @@
# port 6443.
- port: 6443
protocol: TCP
- to:
- - ipBlock:
- cidr: 0.0.0.0/0
- - ipBlock:
- cidr: "::/0"
# Additional volumes to add to the cert-manager controller pod.
volumes: []
@@ -1021,6 +1149,15 @@
# links.
enableServiceLinks: false
+ # enableClientVerification turns on client verification of requests
+ # made to the webhook server
+ enableClientVerification: false
+ # the client CA file to be used for verification
+ clientCAFile: ""
+ # Subject names to verify for the client certificate.
+ # Multiple values may be supplied as a comma-separated list.
+ apiserverClientCertSubjects: ""
+
# +docs:section=CA Injector
cainjector:
@@ -1092,6 +1229,42 @@
- ALL
readOnlyRootFilesystem: true
+ # Enables default network policies for cainjector.
+ # This provides a way for you to restrict network traffic
+ # between cert-manager components and other pods.
+ # For more information, see [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+ # NOTE: an incorrect networkPolicy will cause traffic to be dropped
+ networkPolicy:
+ # Create network policies for the cainjector.
+ enabled: false
+
+ # Ingress rule for the webhook cainjector policy.
+ # By default all pods are allowed access to:
+ # http-metrics port
+ # +docs:property
+ ingress:
+ - ports:
+ - port: http-metrics
+ protocol: TCP
+
+ # Egress rule for the cainjector network policy. By default, it allows all
+ # outbound traffic to ports 80 and 443, as well as DNS ports.
+ # +docs:property
+ egress:
+ - ports:
+ - port: 80
+ protocol: TCP
+ - port: 443
+ protocol: TCP
+ - port: 53
+ protocol: TCP
+ - port: 53
+ protocol: UDP
+ # On OpenShift and OKD, the Kubernetes API server listens on.
+ # port 6443.
+ - port: 6443
+ protocol: TCP
+
podDisruptionBudget:
# Enable or disable the PodDisruptionBudget resource.
#
@@ -1115,6 +1288,13 @@
# +docs:type=unknown
# maxUnavailable: 1
+ # This configures how to act with unhealthy pods during eviction
+ # Note that this requires Kubernetes 1.31 or `PDBUnhealthyPodEvictionPolicy` feature gate enabled for
+ # the cluster to work.
+ # +docs:property
+ # +docs:type=string
+ # unhealthyPodEvictionPolicy: AlwaysAllow
+
# Optional additional annotations to add to the cainjector Deployment.
# +docs:property
# deploymentAnnotations: {}
@@ -1209,20 +1389,32 @@
serviceLabels: {}
image:
- # The container registry to pull the cainjector image from.
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `cainjector.image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `cainjector.image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
+ # +docs:property
+ # registry: ""
+
+ # The image name for the cert-manager cainjector.
# +docs:property
- # registry: quay.io
+ name: cert-manager-cainjector
- # The container image for the cert-manager cainjector
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `cainjector.image.name`).
# +docs:property
- repository: quay.io/jetstack/cert-manager-cainjector
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion will be used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag.
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
@@ -1268,20 +1460,32 @@
acmesolver:
image:
- # The container registry to pull the acmesolver image from.
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `acmesolver.image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `acmesolver.image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
+ # +docs:property
+ # registry: ""
+
+ # The image name for the cert-manager acmesolver.
# +docs:property
- # registry: quay.io
+ name: cert-manager-acmesolver
- # The container image for the cert-manager acmesolver.
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `acmesolver.image.name`).
# +docs:property
- repository: quay.io/jetstack/cert-manager-acmesolver
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion is used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag.
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
@@ -1401,20 +1605,32 @@
podLabels: {}
image:
- # The container registry to pull the startupapicheck image from.
+ # Deprecated: per-component registry prefix.
+ #
+ # If set, this value is *prepended* to the image repository that the chart would otherwise render.
+ # This applies both when `startupapicheck.image.repository` is set and when the repository is computed from
+ # `imageRegistry` + `imageNamespace` + `startupapicheck.image.name`.
+ #
+ # This can produce "double registry" style references such as `legacy.example.io/quay.io/jetstack/...`.
+ # Prefer using the global `imageRegistry`/`imageNamespace` values.
+ # +docs:property
+ # registry: ""
+
+ # The image name for the cert-manager startupapicheck.
# +docs:property
- # registry: quay.io
+ name: cert-manager-startupapicheck
- # The container image for the cert-manager startupapicheck.
+ # Full repository override (takes precedence over `imageRegistry`, `imageNamespace`, and `startupapicheck.image.name`).
# +docs:property
- repository: quay.io/jetstack/cert-manager-startupapicheck
+ repository: ""
# Override the image tag to deploy by setting this variable.
# If no value is set, the chart's appVersion is used.
# +docs:property
# tag: vX.Y.Z
- # Setting a digest will override any tag.
+ # Setting a digest pins the image. If a tag is also set, the rendered reference will include
+ # both ("image:tag@digest"), though only the digest will be used for pulling.
# +docs:property
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
renovate
bot
force-pushed
the
renovate/cert-manager-1.x
branch
14 times, most recently
from
0b0421a to
9021c39
Compare
renovate
bot
force-pushed
the
renovate/cert-manager-1.x
branch
2 times, most recently
from
e927b98 to
6ad2b41
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/cert-manager-1.x
branch
from
6ad2b41 to
940e770
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/cert-manager-1.x
branch
from
940e770 to
25799ca
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.19.2→v1.20.2Release Notes
cert-manager/cert-manager (cert-manager)
v1.20.2Compare Source
v1.20.2 fixes invalid YAML generated in the Helm chart when both
webhook.configand
webhook.volumesare defined, and bumps Go to 1.26.2 along with dependenciesto address reported vulnerabilities.
Changes by Kind
Bug or Regression
webhook.configandwebhook.volumesare defined. (#8665, @cert-manager-bot)Other (Cleanup or Flake)
v1.20.1Compare Source
v1.20.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta.
Changes by Kind
Feature
imagePullSecretsin thestartupapicheck-jobHelm template to enable pulling images from private registries. (#8186, @mathieu-clnk)parentRefoverride annotations on the Certificate resource. (#8518, @hjoshi123)venafi.cert-manager.io/custom-fieldsannotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. (#8301, @k0da)acme.cert-manager.io/http01-ingress-ingressclassnameto overridehttp01.ingress.ingressClassNamefield in HTTP-01 challenge solvers. (#8244, @lunarwhite)global.nodeSelectorto helm chart to perform amergeand allow for a singlenodeSelectorto be set across all services. (#8195, @StingRayZA)XListenerSetsfeature gate (#8394, @hjoshi123)Documentation
Bug or Regression
Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging (#8221, @wallrj-cyberark)
v1.25.5to fixCVE-2025-61727andCVE-2025-61729(#8290, @octo-sts[bot])cert-manager. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). (#8162, @LiquidPL)Other (Cleanup or Flake)
XListenerSetsfeature gate toListenerSets(#8501, @hjoshi123)v1.19.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.
Changes by Kind
Bug or Regression
v1.19.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.
Changes by Kind
Bug or Regression
Other (Cleanup or Flake)
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.