# cert-manager v1.21.1

- Product: cert-manager (https://whatsnew.fyi/product/cert-manager)
- Vendor: CNCF
- Date: 2026-07-29
- Version: v1.21.1
- Original notes: https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1
- Permalink: https://whatsnew.fyi/product/cert-manager/releases/v1.21.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled
- **fixed** — Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created
- **fixed** — Fix log spam and dropped Secret informer events for non-cert-manager Secrets caused by a generics regression introduced in 1.21.0
- **fixed** — Fix the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable
- **security** — Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability
- **security** — Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability
- **security** — Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability
- **security** — Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability
- **changed** — Update distroless base images

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

##### Changes by Kind

###### Bug or Regression

- Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @sklirg)
- Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @SebTardif)
- Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @wallrj-cyberark)
- Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. (#9012, @mateenali66)

###### Other (Cleanup or Flake)

- Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)
- Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability (#9063)
- Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability (#9072)
- Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability (#9073)
- Update distroless base images (#9000, #9025)