cert-manager
v1.20.0Securitycert-manager v1.20.0 introduces Gateway API ListenerSet support, Azure Private DNS integration, and promotes OtherNames to Beta, while fixing several ACME and DNS-related bugs.
securityUpdate for DNS DoS vulnerability fix
A moderate security issue allowed attackers to cause controller denial-of-service through malformed DNS responses. Update immediately if your cert-manager controllers are exposed to untrusted DNS servers or networks where DNS traffic could be manipulated.
breakingContainer UID/GID changes affect security contexts
Default container user changed from UID 1000 to 65532, and group from GID 0 to 65532. Review your pod security policies, security contexts, and file permissions if you've hardcoded these values or rely on root group access.
enhancementEnable Azure Private DNS for internal certificate management
New Azure Private DNS support allows DNS-01 challenges for private zones. Configure your Azure DNS issuer with private zone settings to manage certificates for internal services without exposing DNS records publicly.
Key changes (5)
- Gateway API ListenerSet resource support with experimental feature gate
- Azure Private DNS zones support for DNS-01 challenges
- OtherNames feature promoted to Beta and enabled by default
- Network policy configuration flags across all containers
- Enhanced Venafi provider with custom fields annotation support