fix(container): update quay.io/jetstack/charts/cert-manager ( v1.21.0 ➔ v1.21.1 ) #1924

Merged

GiorgioAresu merged 1 commit from renovate/quay.io-jetstack-charts-cert-manager-1.x into main 2026-07-30 07:50:39 +02:00

Conversation 2 Commits 1 Files changed 2 +2 -2

renovate-bot commented 2026-07-30 01:02:21 +02:00

Collaborator

Copy link

This PR contains the following updates:

Package	Update	Change
quay.io/jetstack/charts/cert-manager (source)	patch	v1.21.0 → v1.21.1

---

Release Notes

cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)

v1.21.1

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

• Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#​9038, @​sklirg)
• Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#​9083, @​SebTardif)
• Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#​9037, @​wallrj-cyberark)
• Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#​9012, @​mateenali66)

Other (Cleanup or Flake)

• Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#​9039, @​wallrj-cyberark)
• Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#​9063)
• Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#​9072)
• Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#​9073)
• Update distroless base images (#​9000, #​9025)

v1.21.1

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

• Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#​9038, @​sklirg)
• Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#​9083, @​SebTardif)
• Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#​9037, @​wallrj-cyberark)
• Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#​9012, @​mateenali66)

Other (Cleanup or Flake)

• Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#​9039, @​wallrj-cyberark)
• Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#​9063)
• Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#​9072)
• Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#​9073)
• Update distroless base images (#​9000, #​9025)

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | patch | `v1.21.0` → `v1.21.1` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#&#8203;9038](https://github.com/cert-manager/cert-manager/issues/9038), [@&#8203;sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#&#8203;9083](https://github.com/cert-manager/cert-manager/issues/9083), [@&#8203;SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#&#8203;9037](https://github.com/cert-manager/cert-manager/issues/9037), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#&#8203;9012](https://github.com/cert-manager/cert-manager/issues/9012), [@&#8203;mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#&#8203;9039](https://github.com/cert-manager/cert-manager/issues/9039), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#&#8203;9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#&#8203;9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#&#8203;9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#&#8203;9000](https://github.com/cert-manager/cert-manager/issues/9000), [#&#8203;9025](https://github.com/cert-manager/cert-manager/issues/9025)) ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#&#8203;9038](https://github.com/cert-manager/cert-manager/issues/9038), [@&#8203;sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#&#8203;9083](https://github.com/cert-manager/cert-manager/issues/9083), [@&#8203;SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#&#8203;9037](https://github.com/cert-manager/cert-manager/issues/9037), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#&#8203;9012](https://github.com/cert-manager/cert-manager/issues/9012), [@&#8203;mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#&#8203;9039](https://github.com/cert-manager/cert-manager/issues/9039), [@&#8203;wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#&#8203;9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#&#8203;9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#&#8203;9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#&#8203;9000](https://github.com/cert-manager/cert-manager/issues/9000), [#&#8203;9025](https://github.com/cert-manager/cert-manager/issues/9025)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yLjEiLCJ1cGRhdGVkSW5WZXIiOiI0NC4yLjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlL2NvbnRhaW5lciIsInR5cGUvcGF0Y2giXX0=-->

renovate-bot added the

renovate/container

type/patch

labels 2026-07-30 01:02:21 +02:00

renovate-bot added 1 commit 2026-07-30 01:02:21 +02:00

fix(container): update quay.io/jetstack/charts/cert-manager ( v1.21.0 ➔ v1.21.1 ) ... 1bc2438644

| datasource | package                              | from    | to      |
| ---------- | ------------------------------------ | ------- | ------- |
| docker     | quay.io/jetstack/charts/cert-manager | v1.21.0 | v1.21.1 |

forgejo-actions added the

area/bootstrap

area/kubernetes

labels 2026-07-30 01:03:01 +02:00

forgejo-actions commented 2026-07-30 01:03:35 +02:00

Copy link

✅ Automated recommendation: APPROVE

Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)

Approve — cert-manager v1.21.0 → v1.21.1 patch update.

Changed files (2):

• ocirepository.yaml: tag v1.21.0 → v1.21.1
• 01-apps.yaml: version v1.21.0 → v1.21.1

Fit: The version bump is consistent across the OCIRepository source ref and HelmRelease chart version. No other manifest files reference the old version.

Caveat: OCI artifact (Helm chart) pinned by tag rather than SHA — per AGENTS.md convention this is intentional and correct for OCI artifacts; not a concern.

Konflate: Rendered-diff shows no findings; manifests apply cleanly.

<!-- ai-pr-reviewer --> <!-- ai-pr-reviewer:{"version":1,"head_sha":"1bc24386443e491d0aa69b113a806080f6543ecb","base_sha":"c3abcc7d343f7223b15c288a282926a57838575a","review_scope":"full","review_result":"clean"} --> <!-- ai-pr-review-sha:1bc24386443e491d0aa69b113a806080f6543ecb --> <!-- ai-pr-review-fingerprint:4d98124ae996a64a22f1e9a8c6cfa664f1a864f6|cfg:683895cf40596a7cfe018951214a87b44e8e2c1efbd93080cde4ce109f3649e9 --> ✅ **Automated recommendation: APPROVE** _Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)_ **Approve** — cert-manager v1.21.0 → v1.21.1 patch update. **Changed files (2):** - `ocirepository.yaml`: tag `v1.21.0` → `v1.21.1` - `01-apps.yaml`: version `v1.21.0` → `v1.21.1` **Fit:** The version bump is consistent across the OCIRepository source ref and HelmRelease chart version. No other manifest files reference the old version. **Caveat:** OCI artifact (Helm chart) pinned by tag rather than SHA — per AGENTS.md convention this is intentional and correct for OCI artifacts; not a concern. **Konflate:** Rendered-diff shows no findings; manifests apply cleanly.

lab-assistant-bot commented 2026-07-30 01:10:13 +02:00

Collaborator

Copy link

konflate — summary

+0 added · 5 changed · −0 removed — 5 resources · 2 apps

Blast radius

• Kustomization cert-manager/cert-manager — 1 dependent (Kustomization kube-system/k8tz)

⚠ Caution

• Job cert-manager/cert-manager-startupapicheck — spec.template changed — immutable on Job; the apply fails until the resource is recreated (or Flux force is enabled)

Image changes

image	from	to
quay.io/jetstack/cert-manager-cainjector	v1.21.0	v1.21.1
quay.io/jetstack/cert-manager-controller	v1.21.0	v1.21.1
quay.io/jetstack/cert-manager-startupapicheck	v1.21.0	v1.21.1
quay.io/jetstack/cert-manager-webhook	v1.21.0	v1.21.1

View the full rendered diff →

_{konflate · rendered 1bc2438 · advisory, not a gate}

<!-- konflate:pr-1924 --> ### konflate — summary **+0 added · 5 changed · −0 removed** — 5 resources · 2 apps **Blast radius** - `Kustomization cert-manager/cert-manager` — 1 dependent (`Kustomization kube-system/k8tz`) **⚠ Caution** - `Job cert-manager/cert-manager-startupapicheck` — spec.template changed — immutable on Job; the apply fails until the resource is recreated (or Flux force is enabled) **Image changes** | image | from | to | |---|---|---| | `quay.io/jetstack/cert-manager-cainjector` | `v1.21.0` | `v1.21.1` | | `quay.io/jetstack/cert-manager-controller` | `v1.21.0` | `v1.21.1` | | `quay.io/jetstack/cert-manager-startupapicheck` | `v1.21.0` | `v1.21.1` | | `quay.io/jetstack/cert-manager-webhook` | `v1.21.0` | `v1.21.1` | [View the full rendered diff →](https://konflate.aresu.eu/#/pr/1924) _{konflate · rendered `1bc2438` · advisory, not a gate}

GiorgioAresu merged commit 7b10f99bb5 into main 2026-07-30 07:50:39 +02:00

GiorgioAresu referenced this pull request from a commit 2026-07-30 07:50:41 +02:00

Merge pull request 'fix(container): update quay.io/jetstack/charts/cert-manager ( v1.21.0 ➔ v1.21.1 )' (#1924) from renovate/quay.io-jetstack-charts-cert-manager-1.x into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/bootstrap

  

area/ci

  

area/kubernetes

  

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

renovate/container

  

renovate/github-action

  

renovate/github-release

  

renovate/grafana-dashboard

  

renovate/helm

  

renovate/terraform

  

type/digest

  

type/major

  

type/minor

  

type/patch

  

wontfix

This will not be worked on

No labels

area/bootstrap

area/ci

area/kubernetes

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

renovate/container

renovate/github-action

renovate/github-release

renovate/grafana-dashboard

renovate/helm

renovate/terraform

type/digest

type/major

type/minor

type/patch

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GiorgioAresu/home-ops!1924

No description provided.