cert-manager v1.21.0-alpha.1

Changes since v1.21.0-alpha.0

[!NOTE] ⚠️ This is a pre-release. For testing only!

Feature

• Add Venafi OAuth token request observability and a new AuthFailed Issuer condition reason to distinguish bad credentials from transient infrastructure errors. (#8808, @FelixPhipps)
• Add new controller flag --acme-http01-solver-extra-labels, allowing Helm's global.commonLabels to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). (#8761, @lunarwhite)
• Add opt-in startupapicheck.ttlSecondsAfterFinished Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. (#8523, @dap0am)
• Added cert-manager.io/ignore-tls-listeners annotation for ignoring gwapi listeners. (#8727, @hjoshi123)
• Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. (#8683, @ThatsMrTalbot)
• Extend the Venafi/CyberArk integration to also support PANW NGTS. (#8779, @FelixPhipps)
• Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate (#8692, @erikgb)

Bug or Regression

• Add dns issuer secrets validation before marking it as ready (#8255, @Peac36)
• Add missing issuer finalizer RBAC to the order controller to support owner references (#8654, @erikgb)
• ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. (#8822, @lunarwhite)
• Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in #8808. (#8843, @wallrj-cyberark)
• Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. (#8651, @mateenali66)
• Fixed infinite re-issuance loop when issuer returns an already expired certificate (#8610, @onurmicoogullari)
• Fixed local e2e-setup-samplewebhook installation to use the samplewebhook image repository and tag from the saved image tarball manifest. (#8821, @wallrj)
• Helm chart bugfix: rename image helper to avoid umbrella chart conflicts (#8753, @FelixPhipps)
• Helm: Fix invalid YAML generated when both webhook.config and webhook.volumes are defined. (#8664, @jnohlgard)
• Remove issuer owner reference from challenges blocking challenge garbage collection (#8743, @erikgb)

Other (Cleanup or Flake)

• The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet. The old fields continue to work. (#8732, @ThatsMrTalbot)