# cert-manager v1.21.0-alpha.1

- Product: cert-manager (https://whatsnew.fyi/product/cert-manager)
- Vendor: CNCF
- Date: 2026-06-08
- Version: v1.21.0-alpha.1
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-alpha.1
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.21.0-alpha.1
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add Venafi OAuth token request observability and a new AuthFailed Issuer condition reason to distinguish bad credentials from transient infrastructure errors
- **added** — Add new controller flag --acme-http01-solver-extra-labels allowing Helm's global.commonLabels to propagate to all dynamically-created ACME HTTP01 solver resources
- **added** — Add opt-in startupapicheck.ttlSecondsAfterFinished Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller
- **added** — Add cert-manager.io/ignore-tls-listeners annotation for ignoring gwapi listeners
- **added** — Add option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates
- **added** — Extend the Venafi/CyberArk integration to also support PANW NGTS
- **changed** — Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate
- **fixed** — Add dns issuer secrets validation before marking it as ready
- **fixed** — Add missing issuer finalizer RBAC to the order controller to support owner references
- **fixed** — ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace
- **fixed** — Fix Venafi TPP issuer setup and signing regression: restore authentication of the vcert connector in the client constructor
- **fixed** — Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries; negative results are now cached for 30 seconds
- **fixed** — Fix infinite re-issuance loop when issuer returns an already expired certificate
- **fixed** — Fix local e2e-setup-samplewebhook installation to use the samplewebhook image repository and tag from the saved image tarball manifest
- **fixed** — Fix Helm chart to rename image helper to avoid umbrella chart conflicts
- **fixed** — Fix invalid YAML generated when both webhook.config and webhook.volumes are defined
- **fixed** — Remove issuer owner reference from challenges blocking challenge garbage collection
- **deprecated** — The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet

##### Changes since v1.21.0-alpha.0

> [!NOTE]
> ⚠️ This is a pre-release. For testing only!

###### Feature

- Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. (#8808, @FelixPhipps)
- Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). (#8761, @lunarwhite)
- Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. (#8523, @dap0am)
- Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. (#8727, @hjoshi123)
- Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. (#8683, @ThatsMrTalbot)
- Extend the Venafi/CyberArk integration to also support PANW NGTS. (#8779, @FelixPhipps)
- Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate (#8692, @erikgb)

###### Bug or Regression

- Add dns issuer secrets validation before marking it as ready (#8255, @Peac36)
- Add missing issuer finalizer RBAC to the order controller to support owner references (#8654, @erikgb)
- ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. (#8822, @lunarwhite)
- Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in #8808. (#8843, @wallrj-cyberark)
- Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. (#8651, @mateenali66)
- Fixed infinite re-issuance loop when issuer returns an already expired certificate (#8610, @onurmicoogullari)
- Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. (#8821, @wallrj)
- Helm chart bugfix: rename image helper to avoid umbrella chart conflicts (#8753, @FelixPhipps)
- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. (#8664, @jnohlgard)
- Remove issuer owner reference from challenges blocking challenge garbage collection (#8743, @erikgb)

###### Other (Cleanup or Flake)

- The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. (#8732, @ThatsMrTalbot)