fix(container): update quay.io/jetstack/charts/cert-manager ( v1.21.0 ➔ v1.21.1 )

renovate-bot commented

2026-07-29 18:04:10 +02:00

Collaborator

This PR contains the following updates:

Package	Update	Change
quay.io/jetstack/charts/cert-manager (source)	patch	`v1.21.0` → `v1.21.1`

Release Notes

cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)

`v1.21.1`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @sklirg)
Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @SebTardif)
Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @wallrj-cyberark)
Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#9012, @mateenali66)

Other (Cleanup or Flake)

Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)
Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#9063)
Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#9072)
Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#9073)
Update distroless base images (#9000, #9025)

`v1.21.1`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @sklirg)
Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @SebTardif)
Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @wallrj-cyberark)
Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#9012, @mateenali66)

Other (Cleanup or Flake)

Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)
Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#9063)
Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#9072)
Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#9073)
Update distroless base images (#9000, #9025)

Configuration

📅 Schedule: (in timezone Europe/Rome)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | patch | `v1.21.0` → `v1.21.1` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added the

renovate/container

type/patch

labels

2026-07-29 18:04:10 +02:00

renovate-bot added 1 commit

2026-07-29 18:04:10 +02:00

fix(container): update quay.io/jetstack/charts/cert-manager ( v1.21.0 ➔ v1.21.1 )

Labeler / Labeler (pull_request) Successful in 4s

Details

Lint / actionlint (pull_request) Successful in 6s

Details

Lint / yamllint (pull_request) Successful in 13s

Details

AI PR Review / AI PR Review (pull_request) Successful in 36s

Details

Konflate 5 resources changed, 1 caution

Details

5399976211

| datasource | package                              | from    | to      |
| ---------- | ------------------------------------ | ------- | ------- |
| docker     | quay.io/jetstack/charts/cert-manager | v1.21.0 | v1.21.1 |

forgejo-actions added the

area/bootstrap

area/kubernetes

labels

2026-07-29 18:04:16 +02:00

forgejo-actions commented

2026-07-29 18:04:46 +02:00

✅ Automated recommendation: APPROVE

Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)

Recommendation: Approve

cert-manager patch update v1.21.0 → v1.21.1

This is a straightforward patch update that bumps the cert-manager Helm chart across two files (ocirepository.yaml and helmfile.d/01-apps.yaml) from v1.21.0 to v1.21.1.

Changed Files

File	Change
`kubernetes/apps/cert-manager/cert-manager/app/ocirepository.yaml`	`tag: v1.21.0` → `v1.21.1`
`kubernetes/bootstrap/helmfile.d/01-apps.yaml`	`version: v1.21.0` → `v1.21.1`

Caveat

The PR title uses fix(container): which is imprecise for a Helm chart OCI artifact update. This is a cosmetic inconsistency and not a blocker.

Non-blocking Notes

Security fixes included: The release notes indicate this patch addresses multiple reported security vulnerabilities in dependencies (golang.org/x/text, google.golang.org/grpc, github.com/google/cel-go, go.opentelemetry.io/otel) and updates distroless base images. This is a security-positive change.
Bug fixes included: Controller panic on spec.renewal.policy: Disabled, log spam regression, and Issuer stuck states — all fixed in this patch.
OCI artifact pinning: Per repository convention, OCI artifacts are pinned by tag/version rather than @sha256: digest. The change is consistent across both files.
Konflate rendered diff: Clean — no blast radius or lint cautions.
No image digest changes: This PR only touches Helm chart version references.

✅ **Automated recommendation: APPROVE** _Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)_ ## Recommendation: Approve **cert-manager patch update v1.21.0 → v1.21.1** This is a straightforward patch update that bumps the cert-manager Helm chart across two files (`ocirepository.yaml` and `helmfile.d/01-apps.yaml`) from `v1.21.0` to `v1.21.1`. ### Changed Files | File | Change | |------|--------| | `kubernetes/apps/cert-manager/cert-manager/app/ocirepository.yaml` | `tag: v1.21.0` → `v1.21.1` | | `kubernetes/bootstrap/helmfile.d/01-apps.yaml` | `version: v1.21.0` → `v1.21.1` | ### Caveat - The PR title uses `fix(container):` which is imprecise for a Helm chart OCI artifact update. This is a cosmetic inconsistency and not a blocker. ### Non-blocking Notes - **Security fixes included**: The release notes indicate this patch addresses multiple reported security vulnerabilities in dependencies (`golang.org/x/text`, `google.golang.org/grpc`, `github.com/google/cel-go`, `go.opentelemetry.io/otel`) and updates distroless base images. This is a security-positive change. - **Bug fixes included**: Controller panic on `spec.renewal.policy: Disabled`, log spam regression, and Issuer stuck states — all fixed in this patch. - **OCI artifact pinning**: Per repository convention, OCI artifacts are pinned by tag/version rather than `@sha256:` digest. The change is consistent across both files. - **Konflate rendered diff**: Clean — no blast radius or lint cautions. - **No image digest changes**: This PR only touches Helm chart version references.

lab-assistant-bot commented

2026-07-29 18:24:12 +02:00

Collaborator

konflate — summary

+0 added · 5 changed · −0 removed — 5 resources · 2 apps

Blast radius

Kustomization cert-manager/cert-manager — 1 dependent (Kustomization kube-system/k8tz)

⚠ Caution

Job cert-manager/cert-manager-startupapicheck — spec.template changed — immutable on Job; the apply fails until the resource is recreated (or Flux force is enabled)

Image changes

image	from	to
`quay.io/jetstack/cert-manager-cainjector`	`v1.21.0`	`v1.21.1`
`quay.io/jetstack/cert-manager-controller`	`v1.21.0`	`v1.21.1`
`quay.io/jetstack/cert-manager-startupapicheck`	`v1.21.0`	`v1.21.1`
`quay.io/jetstack/cert-manager-webhook`	`v1.21.0`	`v1.21.1`

View the full rendered diff →

_{konflate · rendered 5399976 · advisory, not a gate}

### konflate — summary **+0 added · 5 changed · −0 removed** — 5 resources · 2 apps **Blast radius** - `Kustomization cert-manager/cert-manager` — 1 dependent (`Kustomization kube-system/k8tz`) **⚠ Caution** - `Job cert-manager/cert-manager-startupapicheck` — spec.template changed — immutable on Job; the apply fails until the resource is recreated (or Flux force is enabled) **Image changes** | image | from | to | |---|---|---| | `quay.io/jetstack/cert-manager-cainjector` | `v1.21.0` | `v1.21.1` | | `quay.io/jetstack/cert-manager-controller` | `v1.21.0` | `v1.21.1` | | `quay.io/jetstack/cert-manager-startupapicheck` | `v1.21.0` | `v1.21.1` | | `quay.io/jetstack/cert-manager-webhook` | `v1.21.0` | `v1.21.1` | [View the full rendered diff →](https://konflate.aresu.eu/#/pr/1909) <sub>konflate · rendered `5399976` · advisory, not a gate</sub>