jaskaran/homelab
Watch
1
0
Fork
You've already forked homelab
 0
Code Issues 1 Pull requests 4 Projects Releases Packages Wiki Activity Actions

chore(deps): update dependency cert-manager/cert-manager to v1.21.2 #138

Open
jaskaran wants to merge 1 commit from renovate/cert-manager-cert-manager-1.x into main
pull from: renovate/cert-manager-cert-manager-1.x
merge into: jaskaran:main
Conversation 0 Commits 1 Files changed 1 +1 -1
jaskaran commented 2026-09-11 20:13:12 +00:00
Owner
Copy link

This PR contains the following updates:

Package Update Change
cert-manager/cert-manager patch 1.21.1 → 1.21.2

Release Notes

cert-manager/cert-manager (cert-manager/cert-manager)

v1.21.2

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression
  • ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#​9239, @​FelixPhipps)
  • Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#​9222, @​FelixPhipps)
  • De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#​9234, @​speer)
  • Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#​9240, @​wieghx)
  • Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#​9235, @​lunarwhite)
  • Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#​9278, @​arpitjain099)
  • Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#​9236, @​hjoshi123)
  • Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#​9313, @​shashankvarma499)
  • Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#​9238, @​thc1006)
  • Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#​9312, @​shashankvarma499)
  • Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#​9262, @​FelixPhipps)
  • Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#​9314, @​KR-Ravindra)
  • The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#​9232, @​FelixPhipps)
  • The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#​9231, @​FelixPhipps)
Other (Cleanup or Flake)
  • Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. (#​9151, @​wallrj)
  • Upgrade Go to 1.26.8. (#​9323, @​wallrj)
  • Bump google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities (#​9255, #​9317)
  • Bump golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities (#​9265)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | patch | `1.21.1` → `1.21.2` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager/cert-manager)</summary> ### [`v1.21.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.2) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.2) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities. All users should upgrade. #### Changes by Kind ##### Bug or Regression - ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. ([#&#8203;9239](https://github.com/cert-manager/cert-manager/issues/9239), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. ([#&#8203;9222](https://github.com/cert-manager/cert-manager/issues/9222), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret ([#&#8203;9234](https://github.com/cert-manager/cert-manager/issues/9234), [@&#8203;speer](https://github.com/speer)) - Fix certificate renewal windows using February 29 cron schedules across non-leap century years. ([#&#8203;9240](https://github.com/cert-manager/cert-manager/issues/9240), [@&#8203;wieghx](https://github.com/wieghx)) - Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. ([#&#8203;9235](https://github.com/cert-manager/cert-manager/issues/9235), [@&#8203;lunarwhite](https://github.com/lunarwhite)) - Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. ([#&#8203;9278](https://github.com/cert-manager/cert-manager/issues/9278), [@&#8203;arpitjain099](https://github.com/arpitjain099)) - Fixed a bug where `replaces` field was being populated for the wrong issuer on issuer changes ([#&#8203;9236](https://github.com/cert-manager/cert-manager/issues/9236), [@&#8203;hjoshi123](https://github.com/hjoshi123)) - Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. ([#&#8203;9313](https://github.com/cert-manager/cert-manager/issues/9313), [@&#8203;shashankvarma499](https://github.com/shashankvarma499)) - Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. ([#&#8203;9238](https://github.com/cert-manager/cert-manager/issues/9238), [@&#8203;thc1006](https://github.com/thc1006)) - Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. ([#&#8203;9312](https://github.com/cert-manager/cert-manager/issues/9312), [@&#8203;shashankvarma499](https://github.com/shashankvarma499)) - Fixed an issue where the body of a non-Vault HTTP response from `spec.vault.server` could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. ([#&#8203;9262](https://github.com/cert-manager/cert-manager/issues/9262), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects ([#&#8203;9314](https://github.com/cert-manager/cert-manager/issues/9314), [@&#8203;KR-Ravindra](https://github.com/KR-Ravindra)) - The ACME HTTP-01 self-check no longer reflects the fetched response body in `Challenge.status.reason`, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. ([#&#8203;9232](https://github.com/cert-manager/cert-manager/issues/9232), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - The `vault` issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced `Issuer`, unless ambient credentials are explicitly enabled via `--issuer-ambient-credentials`. `ClusterIssuer` and explicit `serviceAccountRef` (IRSA) configurations are unaffected. ([#&#8203;9231](https://github.com/cert-manager/cert-manager/issues/9231), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) ##### Other (Cleanup or Flake) - Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. ([#&#8203;9151](https://github.com/cert-manager/cert-manager/issues/9151), [@&#8203;wallrj](https://github.com/wallrj)) - Upgrade Go to 1.26.8. ([#&#8203;9323](https://github.com/cert-manager/cert-manager/issues/9323), [@&#8203;wallrj](https://github.com/wallrj)) - Bump `google.golang.org/grpc` to v1.83.2 to fix reported security vulnerabilities ([#&#8203;9255](https://github.com/cert-manager/cert-manager/issues/9255), [#&#8203;9317](https://github.com/cert-manager/cert-manager/issues/9317)) - Bump `golang.org/x/crypto` to v0.56.0 to fix reported security vulnerabilities ([#&#8203;9265](https://github.com/cert-manager/cert-manager/issues/9265)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43NC4wIiwidXBkYXRlZEluVmVyIjoiNDQuNzQuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwicmVub3ZhdGUiXX0=-->
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/cert-manager-cert-manager-1.x:renovate/cert-manager-cert-manager-1.x
git switch renovate/cert-manager-cert-manager-1.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/cert-manager-cert-manager-1.x
git switch renovate/cert-manager-cert-manager-1.x
git rebase main
git switch main
git merge --ff-only renovate/cert-manager-cert-manager-1.x
git switch renovate/cert-manager-cert-manager-1.x
git rebase main
git switch main
git merge --no-ff renovate/cert-manager-cert-manager-1.x
git switch main
git merge --squash renovate/cert-manager-cert-manager-1.x
git switch main
git merge --ff-only renovate/cert-manager-cert-manager-1.x
git switch main
git merge renovate/cert-manager-cert-manager-1.x
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jaskaran/homelab!138
No description provided.