Releases — RATATOSK

cert-managerv1.21.0SecurityJul 8, 2026

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258
Applies if you use the cert-manager-edit aggregate ClusterRole.
The cert-manager-edit aggregate ClusterRole no longer grants create on ACME Challenge resources or create, patch, and update on Order resources. This prevents direct manipulation of these internal resources and addresses GHSA-8rvj-mm4h-c258.
breakingObjectReference API removal
Applies if you use ObjectReference in an API.
The deprecated ObjectReference API is removed in this release.
breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.
The Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path are removed.
+ 2 more on the release page

Plan ahead (2)

deprecatedGateway API controller configuration fields
Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.
The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet.
deprecatedServerSideApply feature gate deprecation
cainjector now uses server-side apply unconditionally, and the ServerSideApply feature gate is deprecated.

Source ↗