fix(container): update image quay.io/jetstack/charts/cert-manager (v1.21.1 ➔ v1.21.2) #2055

Merged

GiorgioAresu merged 1 commit from renovate/quay.io-jetstack-charts-cert-manager-1.x into main 2026-09-13 22:36:14 +02:00

Conversation 2 Commits 1 Files changed 1 +1 -1

renovate-bot commented 2026-09-13 18:04:08 +02:00

Collaborator

Copy link

This PR contains the following updates:

Package	Update	Change
quay.io/jetstack/charts/cert-manager (source)	patch	v1.21.1 → v1.21.2

---

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)

v1.21.2

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

• ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#​9239, @​FelixPhipps)
• Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#​9222, @​FelixPhipps)
• De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#​9234, @​speer)
• Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#​9240, @​wieghx)
• Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#​9235, @​lunarwhite)
• Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#​9278, @​arpitjain099)
• Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#​9236, @​hjoshi123)
• Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#​9313, @​shashankvarma499)
• Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#​9238, @​thc1006)
• Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#​9312, @​shashankvarma499)
• Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#​9262, @​FelixPhipps)
• Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#​9314, @​KR-Ravindra)
• The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#​9232, @​FelixPhipps)
• The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#​9231, @​FelixPhipps)

Other (Cleanup or Flake)

• Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. (#​9151, @​wallrj)
• Upgrade Go to 1.26.8. (#​9323, @​wallrj)
• Bump google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities (#​9255, #​9317)
• Bump golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities (#​9265)

v1.21.2

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

• ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#​9239, @​FelixPhipps)
• Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#​9222, @​FelixPhipps)
• De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#​9234, @​speer)
• Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#​9240, @​wieghx)
• Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#​9235, @​lunarwhite)
• Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#​9278, @​arpitjain099)
• Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#​9236, @​hjoshi123)
• Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#​9313, @​shashankvarma499)
• Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#​9238, @​thc1006)
• Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#​9312, @​shashankvarma499)
• Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#​9262, @​FelixPhipps)
• Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#​9314, @​KR-Ravindra)
• The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#​9232, @​FelixPhipps)
• The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#​9231, @​FelixPhipps)

Other (Cleanup or Flake)

• Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. (#​9151, @​wallrj)
• Upgrade Go to 1.26.8. (#​9323, @​wallrj)
• Bump google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities (#​9255, #​9317)
• Bump golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities (#​9265)

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/jetstack/charts/cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | patch | `v1.21.1` → `v1.21.2` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/6) for more information. --- ### Release Notes <details> <summary>cert-manager/cert-manager (quay.io/jetstack/charts/cert-manager)</summary> ### [`v1.21.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.2) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.2...v1.21.2) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. ([#&#8203;9239](https://github.com/cert-manager/cert-manager/issues/9239), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. ([#&#8203;9222](https://github.com/cert-manager/cert-manager/issues/9222), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret ([#&#8203;9234](https://github.com/cert-manager/cert-manager/issues/9234), [@&#8203;speer](https://github.com/speer)) - Fix certificate renewal windows using February 29 cron schedules across non-leap century years. ([#&#8203;9240](https://github.com/cert-manager/cert-manager/issues/9240), [@&#8203;wieghx](https://github.com/wieghx)) - Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. ([#&#8203;9235](https://github.com/cert-manager/cert-manager/issues/9235), [@&#8203;lunarwhite](https://github.com/lunarwhite)) - Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. ([#&#8203;9278](https://github.com/cert-manager/cert-manager/issues/9278), [@&#8203;arpitjain099](https://github.com/arpitjain099)) - Fixed a bug where `replaces` field was being populated for the wrong issuer on issuer changes ([#&#8203;9236](https://github.com/cert-manager/cert-manager/issues/9236), [@&#8203;hjoshi123](https://github.com/hjoshi123)) - Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. ([#&#8203;9313](https://github.com/cert-manager/cert-manager/issues/9313), [@&#8203;shashankvarma499](https://github.com/shashankvarma499)) - Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. ([#&#8203;9238](https://github.com/cert-manager/cert-manager/issues/9238), [@&#8203;thc1006](https://github.com/thc1006)) - Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. ([#&#8203;9312](https://github.com/cert-manager/cert-manager/issues/9312), [@&#8203;shashankvarma499](https://github.com/shashankvarma499)) - Fixed an issue where the body of a non-Vault HTTP response from `spec.vault.server` could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. ([#&#8203;9262](https://github.com/cert-manager/cert-manager/issues/9262), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects ([#&#8203;9314](https://github.com/cert-manager/cert-manager/issues/9314), [@&#8203;KR-Ravindra](https://github.com/KR-Ravindra)) - The ACME HTTP-01 self-check no longer reflects the fetched response body in `Challenge.status.reason`, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. ([#&#8203;9232](https://github.com/cert-manager/cert-manager/issues/9232), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - The `vault` issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced `Issuer`, unless ambient credentials are explicitly enabled via `--issuer-ambient-credentials`. `ClusterIssuer` and explicit `serviceAccountRef` (IRSA) configurations are unaffected. ([#&#8203;9231](https://github.com/cert-manager/cert-manager/issues/9231), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) ##### Other (Cleanup or Flake) - Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. ([#&#8203;9151](https://github.com/cert-manager/cert-manager/issues/9151), [@&#8203;wallrj](https://github.com/wallrj)) - Upgrade Go to 1.26.8. ([#&#8203;9323](https://github.com/cert-manager/cert-manager/issues/9323), [@&#8203;wallrj](https://github.com/wallrj)) - Bump `google.golang.org/grpc` to v1.83.2 to fix reported security vulnerabilities ([#&#8203;9255](https://github.com/cert-manager/cert-manager/issues/9255), [#&#8203;9317](https://github.com/cert-manager/cert-manager/issues/9317)) - Bump `golang.org/x/crypto` to v0.56.0 to fix reported security vulnerabilities ([#&#8203;9265](https://github.com/cert-manager/cert-manager/issues/9265)) ### [`v1.21.2`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.2) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.1...v1.21.2) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities. All users should upgrade. ##### Changes by Kind ##### Bug or Regression - ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. ([#&#8203;9239](https://github.com/cert-manager/cert-manager/issues/9239), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. ([#&#8203;9222](https://github.com/cert-manager/cert-manager/issues/9222), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret ([#&#8203;9234](https://github.com/cert-manager/cert-manager/issues/9234), [@&#8203;speer](https://github.com/speer)) - Fix certificate renewal windows using February 29 cron schedules across non-leap century years. ([#&#8203;9240](https://github.com/cert-manager/cert-manager/issues/9240), [@&#8203;wieghx](https://github.com/wieghx)) - Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. ([#&#8203;9235](https://github.com/cert-manager/cert-manager/issues/9235), [@&#8203;lunarwhite](https://github.com/lunarwhite)) - Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. ([#&#8203;9278](https://github.com/cert-manager/cert-manager/issues/9278), [@&#8203;arpitjain099](https://github.com/arpitjain099)) - Fixed a bug where `replaces` field was being populated for the wrong issuer on issuer changes ([#&#8203;9236](https://github.com/cert-manager/cert-manager/issues/9236), [@&#8203;hjoshi123](https://github.com/hjoshi123)) - Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. ([#&#8203;9313](https://github.com/cert-manager/cert-manager/issues/9313), [@&#8203;shashankvarma499](https://github.com/shashankvarma499)) - Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. ([#&#8203;9238](https://github.com/cert-manager/cert-manager/issues/9238), [@&#8203;thc1006](https://github.com/thc1006)) - Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. ([#&#8203;9312](https://github.com/cert-manager/cert-manager/issues/9312), [@&#8203;shashankvarma499](https://github.com/shashankvarma499)) - Fixed an issue where the body of a non-Vault HTTP response from `spec.vault.server` could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. ([#&#8203;9262](https://github.com/cert-manager/cert-manager/issues/9262), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects ([#&#8203;9314](https://github.com/cert-manager/cert-manager/issues/9314), [@&#8203;KR-Ravindra](https://github.com/KR-Ravindra)) - The ACME HTTP-01 self-check no longer reflects the fetched response body in `Challenge.status.reason`, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. ([#&#8203;9232](https://github.com/cert-manager/cert-manager/issues/9232), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) - The `vault` issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced `Issuer`, unless ambient credentials are explicitly enabled via `--issuer-ambient-credentials`. `ClusterIssuer` and explicit `serviceAccountRef` (IRSA) configurations are unaffected. ([#&#8203;9231](https://github.com/cert-manager/cert-manager/issues/9231), [@&#8203;FelixPhipps](https://github.com/FelixPhipps)) ##### Other (Cleanup or Flake) - Upgrade Go to 1.26.6, which includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages. ([#&#8203;9151](https://github.com/cert-manager/cert-manager/issues/9151), [@&#8203;wallrj](https://github.com/wallrj)) - Upgrade Go to 1.26.8. ([#&#8203;9323](https://github.com/cert-manager/cert-manager/issues/9323), [@&#8203;wallrj](https://github.com/wallrj)) - Bump `google.golang.org/grpc` to v1.83.2 to fix reported security vulnerabilities ([#&#8203;9255](https://github.com/cert-manager/cert-manager/issues/9255), [#&#8203;9317](https://github.com/cert-manager/cert-manager/issues/9317)) - Bump `golang.org/x/crypto` to v0.56.0 to fix reported security vulnerabilities ([#&#8203;9265](https://github.com/cert-manager/cert-manager/issues/9265)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNy4xIiwidXBkYXRlZEluVmVyIjoiNDQuMTcuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvY29udGFpbmVyIiwidHlwZS9wYXRjaCJdfQ==-->

renovate-bot added the

renovate/container

type/patch

labels 2026-09-13 18:04:08 +02:00

renovate-bot added 1 commit 2026-09-13 18:04:08 +02:00

fix(container): update image quay.io/jetstack/charts/cert-manager (v1.21.1 ➔ v1.21.2) 1e4d8ec256

lab-assistant-bot commented 2026-09-13 18:04:20 +02:00

Collaborator

Copy link

⚠ Caution

• Job cert-manager/cert-manager-startupapicheck: spec.template changed; immutable on Job; the apply fails until the resource is recreated (or Flux force is enabled)

5 resources changed across 2 apps

Blast radius

• Kustomization cert-manager/cert-manager: 1 dependent (kube-system/k8tz)

image	from	to	upstream
quay.io/jetstack/cert-manager-cainjector	v1.21.1	v1.21.2	❔
quay.io/jetstack/cert-manager-controller	v1.21.1	v1.21.2	❔
quay.io/jetstack/cert-manager-startupapicheck	v1.21.1	v1.21.2	❔
quay.io/jetstack/cert-manager-webhook	v1.21.1	v1.21.2	❔

_{konflate 0.6.4 · rendered 1e4d8ec · full diff →}

<!-- konflate:pr-2055 --> **⚠ Caution** - `Job cert-manager/cert-manager-startupapicheck`: `spec.template` changed; immutable on Job; the apply fails until the resource is recreated (or Flux force is enabled) **5 resources changed** across 2 apps **Blast radius** - `Kustomization cert-manager/cert-manager`: 1 dependent (kube-system/k8tz) | image | from | to | upstream | |---|---|---|---| | `quay.io/jetstack/cert-manager-cainjector` | `v1.21.1` | `v1.21.2` | ❔ | | `quay.io/jetstack/cert-manager-controller` | `v1.21.1` | `v1.21.2` | ❔ | | `quay.io/jetstack/cert-manager-startupapicheck` | `v1.21.1` | `v1.21.2` | ❔ | | `quay.io/jetstack/cert-manager-webhook` | `v1.21.1` | `v1.21.2` | ❔ | _{konflate 0.6.4 · rendered `1e4d8ec` · [full diff →](https://konflate.aresu.eu/#/pr/2055)}

forgejo-actions added the

area/kubernetes

label 2026-09-13 18:09:22 +02:00

lab-assistant-bot commented 2026-09-13 18:10:12 +02:00

Collaborator

Copy link

✅ Automated recommendation: APPROVE

Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)

Review: cert-manager v1.21.1 → v1.21.2 patch update

Recommendation: Approve

This is a straightforward Renovate-generated patch update for the cert-manager Helm chart. The single-line OCI repository tag change (v1.21.1 → v1.21.2) correctly propagates to all four cert-manager container images via the Helm chart's values.

Changed Files

File	Change
kubernetes/apps/cert-manager/cert-manager/app/ocirepository.yaml	tag: v1.21.1 → v1.21.2

Non-Blocking Caveats

• Immutable Job warning (konflate): The cert-manager-startupapicheck Job's spec.template changes as a side effect of the chart update. Kubernetes Jobs are immutable — Flux will need to delete and recreate the Job on apply. This is expected behavior for cert-manager startup checks and typically causes no disruption; the Job is a one-shot validation run.

• OCI artifact pinning: Per AGENTS.md conventions, OCI artifacts pulled via OCIRepository are correctly pinned by tag/version rather than SHA digest. No action needed.

Why Approve

The v1.21.2 release contains multiple bug fixes and security patches (ACME response body handling, webhook panics, data races, Go dependency updates) that are important for a critical cluster component managing TLS certificates. No issues identified in the diff or konflate render output that would preclude merge.

<!-- ai-pr-reviewer --> <!-- ai-pr-reviewer:{"version":1,"head_sha":"1e4d8ec2560f83f53f0b15211069b33812e812d9","base_sha":"1d731e5535cf6f56d7069b11de61355091bd68cf","review_scope":"full","review_result":"clean"} --> <!-- ai-pr-review-sha:1e4d8ec2560f83f53f0b15211069b33812e812d9 --> <!-- ai-pr-review-fingerprint:3f84dc08687bfa39d563db503748a7569eb6a87b633914712fafe3d0085b99d5|cfg:dc135bf6cf5118396b5a28eab4176beec455d4933ca0275a673e572fa47f54cf --> ✅ **Automated recommendation: APPROVE** _Analysis engine: minimax/MiniMax-M2-7-anthropic@http://litellm.ai.svc.cluster.local:4000/v1 (anthropic)_ ## Review: cert-manager v1.21.1 → v1.21.2 patch update **Recommendation: Approve** This is a straightforward Renovate-generated patch update for the cert-manager Helm chart. The single-line OCI repository tag change (`v1.21.1` → `v1.21.2`) correctly propagates to all four cert-manager container images via the Helm chart's values. ### Changed Files | File | Change | |---|---| | `kubernetes/apps/cert-manager/cert-manager/app/ocirepository.yaml` | tag: `v1.21.1` → `v1.21.2` | ### Non-Blocking Caveats - **Immutable Job warning (konflate):** The `cert-manager-startupapicheck` Job's `spec.template` changes as a side effect of the chart update. Kubernetes Jobs are immutable — Flux will need to delete and recreate the Job on apply. This is expected behavior for cert-manager startup checks and typically causes no disruption; the Job is a one-shot validation run. - **OCI artifact pinning:** Per AGENTS.md conventions, OCI artifacts pulled via `OCIRepository` are correctly pinned by tag/version rather than SHA digest. No action needed. ### Why Approve The v1.21.2 release contains multiple bug fixes and security patches (ACME response body handling, webhook panics, data races, Go dependency updates) that are important for a critical cluster component managing TLS certificates. No issues identified in the diff or konflate render output that would preclude merge.

GiorgioAresu merged commit 05825e9fbc into main 2026-09-13 22:36:14 +02:00

GiorgioAresu deleted branch renovate/quay.io-jetstack-charts-cert-manager-1.x 2026-09-13 22:36:14 +02:00

GiorgioAresu referenced this pull request from a commit 2026-09-13 22:36:16 +02:00

fix(container): update image quay.io/jetstack/charts/cert-manager (v1.21.1 ➔ v1.21.2) (#2055)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/bootstrap

  

area/ci

  

area/kubernetes

  

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

renovate/container

  

renovate/github-action

  

renovate/github-release

  

renovate/grafana-dashboard

  

renovate/helm

  

renovate/terraform

  

type/digest

  

type/major

  

type/minor

  

type/patch

  

wontfix

This will not be worked on

No labels

area/bootstrap

area/ci

area/kubernetes

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

renovate/container

renovate/github-action

renovate/github-release

renovate/grafana-dashboard

renovate/helm

renovate/terraform

type/digest

type/major

type/minor

type/patch

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GiorgioAresu/home-ops!2055

No description provided.