fix(container): update quay.io/jetstack/charts/cert-manager ( v1.21.0 ➔ v1.21.1 )

renovate-bot commented

2026-07-29 23:27:53 +02:00

Collaborator

This PR contains the following updates:

Package	Update	Change
quay.io/jetstack/charts/cert-manager (source)	patch	`v1.21.0` → `v1.21.1`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)

`v1.21.1`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @sklirg)
Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @SebTardif)
Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @wallrj-cyberark)
Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#9012, @mateenali66)

Other (Cleanup or Flake)

Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)
Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#9063)
Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#9072)
Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#9073)
Update distroless base images (#9000, #9025)

`v1.21.1`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @sklirg)
Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @SebTardif)
Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @wallrj-cyberark)
Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#9012, @mateenali66)

Other (Cleanup or Flake)

Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)
Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#9063)
Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#9072)
Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#9073)
Update distroless base images (#9000, #9025)

Configuration

📅 Schedule: (in timezone Europe/Rome)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | patch | `v1.21.0` → `v1.21.1` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/6) for more information. --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added the

renovate/container

type/patch

labels

2026-07-29 23:27:53 +02:00

renovate-bot added 1 commit

2026-07-29 23:27:53 +02:00

fix(container): update quay.io/jetstack/charts/cert-manager ( v1.21.0 ➔ v1.21.1 )

Labeler / Labeler (pull_request) Successful in 38s

Details

Lint / actionlint (pull_request) Successful in 1m1s

Details

AI PR Review / AI PR Review (pull_request) Successful in 41s

Details

Lint / yamllint (pull_request) Successful in 2m7s

Details

Konflate 5 resources changed, 1 caution

Details

1bc2438644

| datasource | package                              | from    | to      |
| ---------- | ------------------------------------ | ------- | ------- |
| docker     | quay.io/jetstack/charts/cert-manager | v1.21.0 | v1.21.1 |

lab-assistant-bot commented

2026-07-29 23:28:00 +02:00

Collaborator

konflate — summary

+0 added · 5 changed · −0 removed — 5 resources · 2 apps

Blast radius

Kustomization cert-manager/cert-manager — 1 dependent (Kustomization kube-system/k8tz)

⚠ Caution

Job cert-manager/cert-manager-startupapicheck — spec.template changed — immutable on Job; the apply fails until the resource is recreated (or Flux force is enabled)

Image changes

image	from	to
`quay.io/jetstack/cert-manager-cainjector`	`v1.21.0`	`v1.21.1`
`quay.io/jetstack/cert-manager-controller`	`v1.21.0`	`v1.21.1`
`quay.io/jetstack/cert-manager-startupapicheck`	`v1.21.0`	`v1.21.1`
`quay.io/jetstack/cert-manager-webhook`	`v1.21.0`	`v1.21.1`

View the full rendered diff →

_{konflate · rendered 1bc2438 · advisory, not a gate}

### konflate — summary **+0 added · 5 changed · −0 removed** — 5 resources · 2 apps **Blast radius** - `Kustomization cert-manager/cert-manager` — 1 dependent (`Kustomization kube-system/k8tz`) **⚠ Caution** - `Job cert-manager/cert-manager-startupapicheck` — spec.template changed — immutable on Job; the apply fails until the resource is recreated (or Flux force is enabled) **Image changes** | image | from | to | |---|---|---| | `quay.io/jetstack/cert-manager-cainjector` | `v1.21.0` | `v1.21.1` | | `quay.io/jetstack/cert-manager-controller` | `v1.21.0` | `v1.21.1` | | `quay.io/jetstack/cert-manager-startupapicheck` | `v1.21.0` | `v1.21.1` | | `quay.io/jetstack/cert-manager-webhook` | `v1.21.0` | `v1.21.1` | [View the full rendered diff →](https://konflate.aresu.eu/#/pr/1916) <sub>konflate · rendered `1bc2438` · advisory, not a gate</sub>

forgejo-actions added the

area/bootstrap

area/kubernetes

labels

2026-07-29 23:31:25 +02:00

forgejo-actions commented

2026-07-29 23:32:57 +02:00

✅ Automated recommendation: APPROVE

Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)

Approve — cert-manager patch update v1.21.0 → v1.21.1.

Changed files (2)

kubernetes/apps/cert-manager/cert-manager/app/ocirepository.yaml — tag v1.21.0 → v1.21.1
kubernetes/bootstrap/helmfile.d/01-apps.yaml — chart version v1.21.0 → v1.21.1

Konflate rendered diff — 5 resources updated (cert-manager controller, cainjector, webhook, startupapicheck, OCIRepository). All 4 container images (cert-manager-controller, cert-manager-cainjector, cert-manager-webhook, cert-manager-startupapicheck) correctly bump to v1.21.1. No render failures.

Caveat (non-blocking)

cert-manager-startupapicheck Job spec.template changes — Jobs are immutable in Kubernetes, so the upgrade will require the Job to be recreated. This is inherent to any cert-manager version bump and not a PR defect.

Standards compliance

OCI artifact pinned by tag (v1.21.1) per documented convention; SHA digest not applicable to OCI artifacts.
metadata.namespace absent on HelmRelease/OCIRepository — intentional, injected at build time.

Release quality

v1.21.1 is a security + regression fix release (controller panic, log spam, DNS-01 solver regression, security CVEs in golang.org/x/text, grpc, cel-go, opentelemetry). Upgrading is recommended.

✅ **Automated recommendation: APPROVE** _Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)_ **Approve** — cert-manager patch update v1.21.0 → v1.21.1. **Changed files (2)** - `kubernetes/apps/cert-manager/cert-manager/app/ocirepository.yaml` — tag `v1.21.0` → `v1.21.1` - `kubernetes/bootstrap/helmfile.d/01-apps.yaml` — chart version `v1.21.0` → `v1.21.1` **Konflate rendered diff** — 5 resources updated (cert-manager controller, cainjector, webhook, startupapicheck, OCIRepository). All 4 container images (`cert-manager-controller`, `cert-manager-cainjector`, `cert-manager-webhook`, `cert-manager-startupapicheck`) correctly bump to `v1.21.1`. No render failures. **Caveat (non-blocking)** - `cert-manager-startupapicheck` Job `spec.template` changes — Jobs are immutable in Kubernetes, so the upgrade will require the Job to be recreated. This is inherent to any cert-manager version bump and not a PR defect. **Standards compliance** - OCI artifact pinned by tag (`v1.21.1`) per documented convention; SHA digest not applicable to OCI artifacts. - `metadata.namespace` absent on `HelmRelease`/`OCIRepository` — intentional, injected at build time. **Release quality** - v1.21.1 is a security + regression fix release (controller panic, log spam, DNS-01 solver regression, security CVEs in golang.org/x/text, grpc, cel-go, opentelemetry). Upgrading is recommended.