[dependabot]

Bumps github.com/cert-manager/cert-manager from 1.16.2 to 1.21.3.

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.21.3

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.3 removes trust in the compromised eMudhra CA (see eMudhra Compromise). The updated base images no longer include the "emSign ECC Root CA - G3" root certificate. Go 1.26.10 also makes crypto/x509 reject certificate chains that pass through the compromised intermediates (CVE-2026-111943).

It also fixes an ACME ARI renewal loop, stops the controller copying a private key from a Secret that the Certificate does not own, and quotes the proxy values in the Helm chart. It updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

• Added status.acme.ari.certID to track issuance of new certs and re-fetch ARI from CA. This fixes a renewal loop where a stale ARI window from the previous certificate triggered repeated re-issuance until the CA rate limit was hit. (#9292, @​hjoshi123)
• Helm chart: quote the http_proxy, https_proxy and no_proxy values when rendering the controller Deployment env vars, so values like *.example.com no longer break the manifest. (#9407, @​pujitha24)
• The requestmanager and issuing controllers now only consume the Secret named by status.nextPrivateKeySecretName when it carries the cert-manager.io/next-private-key label and is owned by the Certificate, matching the invariant the keymanager controller already enforces. Previously a principal able to write the certificates/status subresource, but not to read Secrets, could name any Secret in the namespace and have its private key copied into spec.secretName. The keymanager controller no longer creates the next private key Secret under the name in status.nextPrivateKeySecretName. It always uses a generated name, records a NotOwned Warning event when the field names a Secret it does not own, and repoints the field at the Secret it owns rather than deleting that Secret when the two disagree. The Secret named by spec.secretName is never treated as a next private key Secret, even if spec.secretTemplate labels it as one. (#9368, @​wallrj)

Other (Cleanup or Flake)

• Upgrade Go to 1.26.9, fixing CVEs in the crypto/tls, net/http, net/textproto and html/template packages. (#9444, @​wallrj-cyberark)
• Upgrade Go to 1.26.10, fixing a CVE in the crypto/x509 package. (#9501, @​wallrj-cyberark)
• Bump golang.org/x/net to v0.60.0 to fix reported security vulnerabilities (#9451)
• Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace and otlptracegrpc to v1.45.0 to fix a reported security vulnerability (#9374, #9375)
• Update distroless base images, removing the compromised "emSign ECC Root CA - G3" root certificate (#9351, #9414, #9493, #9495)

v1.21.2

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.2 fixes controller and webhook panics, data races, ACME renewal and HTTP-01 solver bugs, and a Gateway API dnsNames bug. It stops the ACME and Vault issuers copying untrusted HTTP response bodies into status conditions and Events, and tightens ambient AWS credential use for namespaced Vault Issuers. It also updates Go and several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

• ACME Issuer response bodies are no longer reflected into Issuer status conditions or Kubernetes Events. Only ACME problem documents are surfaced (bounded in length); other responses are reported by HTTP status code alone, with the full error available in the controller logs. (#9239, @​FelixPhipps)
• Cap ACME server response bodies at 16 MiB to guard against unbounded-body denial-of-service. (#9222, @​FelixPhipps)
• De-duplicate dnsNames when multiple Gateway/ListenerSet listeners share a Secret (#9234, @​speer)
• Fix certificate renewal windows using February 29 cron schedules across non-leap century years. (#9240, @​wieghx)
• Fix validating webhook panics when AdmissionReview requests omit optional fields, by routing identity, approval, and resource validation on the always-present Resource/SubResource fields and denying (rather than silently allowing) requests with an unset or mismatched resource. As a side effect, validation is now also enforced for equivalent-converted requests on non-v1 API versions, which previously could skip validation. (#9235, @​lunarwhite)
• Fixed HTTP-01 solver cleanup so that a solver ingress, pod or service that has already been deleted no longer fails the cleanup with a NotFound error. (#9278, @​arpitjain099)
• Fixed a bug where replaces field was being populated for the wrong issuer on issuer changes (#9236, @​hjoshi123)
• Fixed a data race in the ACME HTTP-01 self-check that could occur when custom DNS servers were configured. (#9313, @​shashankvarma499)
• Fixed a panic in the certificates-issuing controller when a CertificateRequest has a failure time set but no Ready condition. (#9238, @​thc1006)
• Fixed a race in pkg/scheduler where the cleanup of a fired timer could cancel a newer timer scheduled for the same object, silently dropping a rescheduled poll. (#9312, @​shashankvarma499)
• Fixed an issue where the body of a non-Vault HTTP response from spec.vault.server could be copied into the Vault Issuer's Ready condition and its Kubernetes Events. Such responses now report only the HTTP status code, and Vault's own error messages are truncated before being persisted. (#9262, @​FelixPhipps)
• Ingress-shim no longer removes the applyset label from cached Ingress and Gateway objects (#9314, @​KR-Ravindra)
• The ACME HTTP-01 self-check no longer reflects the fetched response body in Challenge.status.reason, preventing disclosure of internal response contents reachable via redirects. The response is still available in the controller's debug logs. (#9232, @​FelixPhipps)
• The vault issuer no longer authenticates to Vault using the cert-manager controller's ambient AWS credentials for AWS IAM auth on a namespaced Issuer, unless ambient credentials are explicitly enabled via --issuer-ambient-credentials. ClusterIssuer and explicit serviceAccountRef (IRSA) configurations are unaffected. (#9231, @​FelixPhipps)

... (truncated)

Commits

• 925c222 Merge pull request #9501 from wallrj-cyberark/release-1.21-go-1.26.10
• cfd6d18 Update vendored Go to 1.26.10
• c6746d7 Merge pull request #9495 from cert-manager/renovate/release-1.21-base-images
• a3ee670 chore(deps): update base images
• b3e26fb Merge pull request #9493 from cert-manager/renovate/release-1.21-base-images
• 6da0bf8 chore(deps): update base images
• 7c32f61 Merge pull request #9475 from cert-manager-bot/cherry-pick-9464-to-release-1.21
• 9d05ba7 Merge pull request #9474 from cert-manager-bot/cherry-pick-9467-to-release-1.21
• c7fef37 test(e2e): use local DNS zone for ACME webhook test
• 614e382 fixing ci tests with change in bind image
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)