# cert-manager v1.21.0

- Product: cert-manager (https://whatsnew.fyi/product/cert-manager)
- Vendor: CNCF
- Date: 2026-07-08
- Version: v1.21.0
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.21.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — ACME Renewal Information (ARI) experimental support for RFC 9773 behind the ACMEUseARI feature gate to query the ACME server's renewalInfo endpoint for the recommended renewal window
- **added** — waitInsteadOfSelfCheck solver option to skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate
- **added** — AWS IAM authentication for Vault issuer supporting IRSA, EKS Pod Identity, and ambient EC2/ECS credentials
- **removed** — Default tokenrequest RBAC Role and RoleBinding from Helm chart that granted cert-manager controller permission to create tokens for its own ServiceAccount
- **changed** — cert-manager-edit aggregate ClusterRole no longer grants create for challenges.acme.cert-manager.io or create, patch, update for orders.acme.cert-manager.io
- **removed** — Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path
- **changed** — Controller Service metrics port renamed from tcp-prometheus-servicemonitor to http-metrics

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading.

##### Known Issues

- **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature (#8258) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` — `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See #9031 for details.
- **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring (#8407) causes `filteredEventHandler` type assertion failures (`"OnAdd missing Object"`, `"OnUpdate missing ObjectOld"`, `"OnDelete missing Object"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** — the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See #8994 for details.
- **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets (#8255) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation — the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See cert-manager/cert-manager#9036 for details and a fix proposal.

##### Major Themes

###### Default `tokenrequest` RBAC removed from Helm chart

> ⚠️ Breaking change

The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024.

If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation).

###### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole

> ⚠️ Potentially breaking change

The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because

_[Truncated at 4000 characters — full notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0]_