Releases — RATATOSK

cert-managerv1.21.1SecurityJul 29, 2026

cert-manager v1.21.1 is a maintenance release with fixes for regressions and updates to dependencies affected by reported security vulnerabilities. The dependency updates concern all installations, while the regression fixes address controller behavior and require no setup change.

Action needed (4)

securityThe golang.org/x/text dependency, updated to v0.40.0
The golang.org/x/text dependency is updated to v0.40.0 to fix a reported security vulnerability.
securityThe google.golang.org/grpc dependency, updated to v1.82.1
The google.golang.org/grpc dependency is updated to v1.82.1 to fix a reported security vulnerability.
securityThe github.com/google/cel-go dependency, updated to v0.29.0
The github.com/google/cel-go dependency is updated to v0.29.0 to fix a reported security vulnerability.
securityThe go.opentelemetry.io/otel dependency, updated to v1.44.0
The go.opentelemetry.io/otel dependency is updated to v1.44.0 to fix a reported security vulnerability.

Source ↗

cert-managerv1.21.0SecurityJul 8, 2026

CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258
Applies if you use the cert-manager-edit aggregate ClusterRole.
The cert-manager-edit aggregate ClusterRole no longer grants create on ACME Challenge resources or create, patch, and update on Order resources. This prevents direct manipulation of these internal resources and addresses GHSA-8rvj-mm4h-c258.
breakingObjectReference API removal
Applies if you use ObjectReference in an API.
The deprecated ObjectReference API is removed in this release.
breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.
The Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path are removed.
+ 2 more on the release page

Plan ahead (2)

deprecatedGateway API controller configuration fields
Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.
The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet.
deprecatedServerSideApply feature gate deprecation
cainjector now uses server-side apply unconditionally, and the ServerSideApply feature gate is deprecated.

Source ↗