chore(deps): update all minor dependencies#2650
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
Conversation
renovate
bot
force-pushed
the
renovate/all-minor
branch
from
a0a43a1 to
d187cb7
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-minor
branch
from
d187cb7 to
b4336d0
Compare
ingress nginx 244 2025-02-11 21:47:34.526546811 +0000 UTC deployed nginx-ingress-1.1.2 3.4.2
xray-daemon xray 243 2025-02-11 21:47:33.731794842 +0000 UTC deployed aws-xray-4.0.8 3.3.12
Comparing release=notify-documentation, chart=charts/notify-documentation
Comparing release=notify-api, chart=charts/notify-api
Comparing release=notify-admin, chart=charts/notify-admin
Comparing release=notify-document-download, chart=charts/notify-document-download
Comparing release=notify-celery, chart=charts/notify-celery
Comparing release=k8s-event-logger, chart=/tmp/helmfile2033525995/amazon-cloudwatch/staging/k8s-event-logger/k8s-event-logger/1.1.8/k8s-event-logger
Comparing release=karpenter-crd, chart=/tmp/helmfile2033525995/karpenter/staging/karpenter-crd/karpenter-crd/0.36.1/karpenter-crd
Comparing release=karpenter, chart=/tmp/helmfile2033525995/karpenter/staging/karpenter/karpenter/0.37.7/karpenter
karpenter, karpenter, ClusterRole (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: karpenter
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
rules:
# Read
- apiGroups: ["karpenter.k8s.aws"]
resources: ["ec2nodeclasses"]
verbs: ["get", "list", "watch"]
# Write
- apiGroups: ["karpenter.k8s.aws"]
resources: ["ec2nodeclasses", "ec2nodeclasses/status"]
verbs: ["patch", "update"]
+ - apiGroups: ["admissionregistration.k8s.io"]
+ resources: ["validatingwebhookconfigurations"]
+ verbs: ["update"]
+ resourceNames: ["validation.webhook.karpenter.k8s.aws"]
+ - apiGroups: ["admissionregistration.k8s.io"]
+ resources: ["mutatingwebhookconfigurations"]
+ verbs: ["update"]
+ resourceNames: ["defaulting.webhook.karpenter.k8s.aws"]
karpenter, karpenter, ClusterRoleBinding (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: karpenter
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: karpenter
subjects:
- kind: ServiceAccount
name: karpenter
namespace: karpenter
karpenter, karpenter, Deployment (apps) has changed:
# Source: karpenter/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: karpenter
namespace: karpenter
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
spec:
replicas: 2
revisionHistoryLimit: 10
strategy:
rollingUpdate:
maxUnavailable: 1
selector:
matchLabels:
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
template:
metadata:
labels:
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
annotations:
spec:
serviceAccountName: karpenter
securityContext:
fsGroup: 65532
priorityClassName: "system-cluster-critical"
dnsPolicy: ClusterFirst
containers:
- name: controller
securityContext:
runAsUser: 65532
runAsGroup: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
- image: public.ecr.aws/karpenter/controller:0.36.1@sha256:5b245674ae0ac97558cd335ebae19c0c80e911daac2352cb74ee0ccdba7f5e2b
+ image: public.ecr.aws/karpenter/controller:0.37.7@sha256:3283e20580d6a01a39b881fa354c674e2f8771aa9c831073119577c921c9735d
imagePullPolicy: IfNotPresent
env:
- name: KUBERNETES_MIN_VERSION
value: "1.19.0-0"
- name: KARPENTER_SERVICE
value: karpenter
+ - name: WEBHOOK_PORT
+ value: "8443"
+ - name: WEBHOOK_METRICS_PORT
+ value: "8001"
+ - name: DISABLE_WEBHOOK
+ value: "false"
- name: LOG_LEVEL
value: "info"
- name: METRICS_PORT
value: "8000"
- name: HEALTH_PROBE_PORT
value: "8081"
- name: SYSTEM_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: MEMORY_LIMIT
valueFrom:
resourceFieldRef:
containerName: controller
divisor: "0"
resource: limits.memory
- name: FEATURE_GATES
value: "Drift=true,SpotToSpotConsolidation=false"
- name: BATCH_MAX_DURATION
value: "10s"
- name: BATCH_IDLE_DURATION
value: "1s"
- name: ASSUME_ROLE_DURATION
value: "15m"
- name: CLUSTER_NAME
value: "notification-canada-ca-staging-eks-cluster"
- name: VM_MEMORY_OVERHEAD_PERCENT
value: "0.075"
- name: RESERVED_ENIS
value: "0"
ports:
- name: http-metrics
containerPort: 8000
+ protocol: TCP
+ - name: webhook-metrics
+ containerPort: 8001
+ protocol: TCP
+ - name: https-webhook
+ containerPort: 8443
protocol: TCP
- name: http
containerPort: 8081
protocol: TCP
livenessProbe:
initialDelaySeconds: 30
timeoutSeconds: 30
httpGet:
path: /healthz
port: http
readinessProbe:
initialDelaySeconds: 5
timeoutSeconds: 30
httpGet:
path: /readyz
port: http
nodeSelector:
kubernetes.io/os: linux
# The template below patches the .Values.affinity to add a default label selector where not specificed
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: karpenter.sh/nodepool
operator: DoesNotExist
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/instance: karpenter
app.kubernetes.io/name: karpenter
topologyKey: kubernetes.io/hostname
# The template below patches the .Values.topologySpreadConstraints to add a default label selector where not specificed
topologySpreadConstraints:
- labelSelector:
matchLabels:
app.kubernetes.io/instance: karpenter
app.kubernetes.io/name: karpenter
maxSkew: 1
topologyKey: topology.kubernetes.io/zone
whenUnsatisfiable: ScheduleAnyway
tolerations:
- key: CriticalAddonsOnly
operator: Exists
karpenter, karpenter, PodDisruptionBudget (policy) has changed:
# Source: karpenter/templates/poddisruptionbudget.yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: karpenter
namespace: karpenter
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
spec:
maxUnavailable: 1
selector:
matchLabels:
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
karpenter, karpenter, Role (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: karpenter
namespace: karpenter
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
rules:
# Read
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "watch"]
+ - apiGroups: [""]
+ resources: ["configmaps", "secrets"]
+ verbs: ["get", "list", "watch"]
# Write
+ - apiGroups: [""]
+ resources: ["secrets"]
+ verbs: ["update"]
+ resourceNames:
+ - "karpenter-cert"
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["patch", "update"]
resourceNames:
- "karpenter-leader-election"
# Cannot specify resourceNames on create
# https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["create"]
karpenter, karpenter, RoleBinding (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: karpenter
namespace: karpenter
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: karpenter
subjects:
- kind: ServiceAccount
name: karpenter
namespace: karpenter
karpenter, karpenter, Service (v1) has changed:
# Source: karpenter/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: karpenter
namespace: karpenter
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:
- name: http-metrics
port: 8000
targetPort: http-metrics
+ protocol: TCP
+ - name: webhook-metrics
+ port: 8001
+ targetPort: webhook-metrics
+ protocol: TCP
+ - name: https-webhook
+ port: 8443
+ targetPort: https-webhook
protocol: TCP
selector:
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
karpenter, karpenter, ServiceAccount (v1) has changed:
# Source: karpenter/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: karpenter
namespace: karpenter
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
annotations:
eks.amazonaws.com/role-arn: arn:aws:iam::239043911459:role/karpenter-controller-eks
karpenter, karpenter-admin, ClusterRole (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/aggregate-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: karpenter-admin
labels:
rbac.authorization.k8s.io/aggregate-to-admin: "true"
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
rules:
- apiGroups: ["karpenter.sh"]
resources: ["nodepools", "nodepools/status", "nodeclaims", "nodeclaims/status"]
verbs: ["get", "list", "watch", "create", "delete", "patch"]
- apiGroups: ["karpenter.k8s.aws"]
resources: ["ec2nodeclasses"]
verbs: ["get", "list", "watch", "create", "delete", "patch"]
karpenter, karpenter-core, ClusterRole (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/clusterrole-core.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: karpenter-core
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
rules:
# Read
- apiGroups: ["karpenter.sh"]
resources: ["nodepools", "nodepools/status", "nodeclaims", "nodeclaims/status"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["pods", "nodes", "persistentvolumes", "persistentvolumeclaims", "replicationcontrollers", "namespaces"]
verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses", "csinodes"]
verbs: ["get", "watch", "list"]
- apiGroups: ["apps"]
resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
verbs: ["list", "watch"]
+ - apiGroups: ["admissionregistration.k8s.io"]
+ resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
+ verbs: ["get", "watch", "list"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ verbs: ["watch", "list"]
- apiGroups: ["policy"]
resources: ["poddisruptionbudgets"]
verbs: ["get", "list", "watch"]
# Write
- apiGroups: ["karpenter.sh"]
resources: ["nodeclaims", "nodeclaims/status"]
verbs: ["create", "delete", "update", "patch"]
- apiGroups: ["karpenter.sh"]
resources: ["nodepools", "nodepools/status"]
verbs: ["update", "patch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]
- apiGroups: [""]
resources: ["nodes"]
verbs: ["patch", "delete"]
- apiGroups: [""]
resources: ["pods/eviction"]
verbs: ["create"]
+ - apiGroups: ["admissionregistration.k8s.io"]
+ resources: ["validatingwebhookconfigurations"]
+ verbs: ["update"]
+ resourceNames: ["validation.webhook.karpenter.sh", "validation.webhook.config.karpenter.sh"]
+ - apiGroups: ["apiextensions.k8s.io"]
+ resources: ["customresourcedefinitions"]
+ resourceNames: ["ec2nodeclasses.karpenter.k8s.aws", "nodepools.karpenter.sh", "nodeclaims.karpenter.sh"]
+ verbs: ["update"]
karpenter, karpenter-core, ClusterRoleBinding (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/clusterrole-core.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: karpenter-core
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: karpenter-core
subjects:
- kind: ServiceAccount
name: karpenter
namespace: karpenter
kube-node-lease, karpenter-lease, Role (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: karpenter-lease
namespace: kube-node-lease
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
rules:
# Read
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["get", "list", "watch"]
# Write
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["delete"]
kube-node-lease, karpenter-lease, RoleBinding (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: karpenter-lease
namespace: kube-node-lease
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: karpenter-lease
subjects:
- kind: ServiceAccount
name: karpenter
namespace: karpenter
kube-system, karpenter-dns, Role (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: karpenter-dns
namespace: kube-system
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
rules:
# Read
- apiGroups: [""]
resources: ["services"]
resourceNames: ["kube-dns"]
verbs: ["get"]
kube-system, karpenter-dns, RoleBinding (rbac.authorization.k8s.io) has changed:
# Source: karpenter/templates/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: karpenter-dns
namespace: kube-system
labels:
- helm.sh/chart: karpenter-0.36.1
+ helm.sh/chart: karpenter-0.37.7
app.kubernetes.io/name: karpenter
app.kubernetes.io/instance: karpenter
- app.kubernetes.io/version: "0.36.1"
+ app.kubernetes.io/version: "0.37.7"
app.kubernetes.io/managed-by: Helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: karpenter-dns
subjects:
- kind: ServiceAccount
name: karpenter
namespace: karpenter
karpenter, defaulting.webhook.karpenter.k8s.aws, MutatingWebhookConfiguration (admissionregistration.k8s.io) has been added:
-
+ # Source: karpenter/templates/webhooks.yaml
+ apiVersion: admissionregistration.k8s.io/v1
+ kind: MutatingWebhookConfiguration
+ metadata:
+ name: defaulting.webhook.karpenter.k8s.aws
+ labels:
+ helm.sh/chart: karpenter-0.37.7
+ app.kubernetes.io/name: karpenter
+ app.kubernetes.io/instance: karpenter
+ app.kubernetes.io/version: "0.37.7"
+ app.kubernetes.io/managed-by: Helm
+ webhooks:
+ - name: defaulting.webhook.karpenter.k8s.aws
+ admissionReviewVersions: ["v1"]
+ clientConfig:
+ service:
+ name: karpenter
+ namespace: karpenter
+ port: 8443
+ failurePolicy: Fail
+ sideEffects: None
+ rules:
+ - apiGroups:
+ - karpenter.k8s.aws
+ apiVersions:
+ - v1beta1
+ operations:
+ - CREATE
+ - UPDATE
+ resources:
+ - ec2nodeclasses
+ - ec2nodeclasses/status
+ scope: '*'
karpenter, karpenter-cert, Secret (v1) has been added:
+ # Source: karpenter/templates/secret-webhook-cert.yaml
+ apiVersion: v1
+ kind: Secret
+ metadata:
+ labels:
+ app.kubernetes.io/instance: karpenter
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: karpenter
+ app.kubernetes.io/version: 0.37.7
+ helm.sh/chart: karpenter-0.37.7
+ name: karpenter-cert
+ namespace: karpenter
karpenter, validation.webhook.config.karpenter.sh, ValidatingWebhookConfiguration (admissionregistration.k8s.io) has been added:
-
+ # Source: karpenter/templates/webhooks-core.yaml
+ apiVersion: admissionregistration.k8s.io/v1
+ kind: ValidatingWebhookConfiguration
+ metadata:
+ name: validation.webhook.config.karpenter.sh
+ labels:
+ helm.sh/chart: karpenter-0.37.7
+ app.kubernetes.io/name: karpenter
+ app.kubernetes.io/instance: karpenter
+ app.kubernetes.io/version: "0.37.7"
+ app.kubernetes.io/managed-by: Helm
+ webhooks:
+ - name: validation.webhook.config.karpenter.sh
+ admissionReviewVersions: ["v1"]
+ clientConfig:
+ service:
+ name: karpenter
+ namespace: karpenter
+ port: 8443
+ failurePolicy: Fail
+ sideEffects: None
+ objectSelector:
+ matchLabels:
+ app.kubernetes.io/part-of: karpenter
karpenter, validation.webhook.karpenter.k8s.aws, ValidatingWebhookConfiguration (admissionregistration.k8s.io) has been added:
-
+ # Source: karpenter/templates/webhooks.yaml
+ apiVersion: admissionregistration.k8s.io/v1
+ kind: ValidatingWebhookConfiguration
+ metadata:
+ name: validation.webhook.karpenter.k8s.aws
+ labels:
+ helm.sh/chart: karpenter-0.37.7
+ app.kubernetes.io/name: karpenter
+ app.kubernetes.io/instance: karpenter
+ app.kubernetes.io/version: "0.37.7"
+ app.kubernetes.io/managed-by: Helm
+ webhooks:
+ - name: validation.webhook.karpenter.k8s.aws
+ admissionReviewVersions: ["v1"]
+ clientConfig:
+ service:
+ name: karpenter
+ namespace: karpenter
+ port: 8443
+ failurePolicy: Fail
+ sideEffects: None
+ rules:
+ - apiGroups:
+ - karpenter.k8s.aws
+ apiVersions:
+ - v1beta1
+ operations:
+ - CREATE
+ - UPDATE
+ resources:
+ - ec2nodeclasses
+ - ec2nodeclasses/status
+ scope: '*'
karpenter, validation.webhook.karpenter.sh, ValidatingWebhookConfiguration (admissionregistration.k8s.io) has been added:
-
+ # Source: karpenter/templates/webhooks-core.yaml
+ apiVersion: admissionregistration.k8s.io/v1
+ kind: ValidatingWebhookConfiguration
+ metadata:
+ name: validation.webhook.karpenter.sh
+ labels:
+ helm.sh/chart: karpenter-0.37.7
+ app.kubernetes.io/name: karpenter
+ app.kubernetes.io/instance: karpenter
+ app.kubernetes.io/version: "0.37.7"
+ app.kubernetes.io/managed-by: Helm
+ webhooks:
+ - name: validation.webhook.karpenter.sh
+ admissionReviewVersions: ["v1"]
+ clientConfig:
+ service:
+ name: karpenter
+ namespace: karpenter
+ port: 8443
+ failurePolicy: Fail
+ sideEffects: None
+ rules:
+ - apiGroups:
+ - karpenter.sh
+ apiVersions:
+ - v1beta1
+ operations:
+ - CREATE
+ - UPDATE
+ resources:
+ - nodeclaims
+ - nodeclaims/status
+ scope: '*'
+ - apiGroups:
+ - karpenter.sh
+ apiVersions:
+ - v1beta1
+ operations:
+ - CREATE
+ - UPDATE
+ resources:
+ - nodepools
+ - nodepools/status
+ scope: '*'
Comparing release=karpenter-nodepool, chart=charts/karpenter-nodepool
Comparing release=priority-classes, chart=deliveryhero/priority-class
Comparing release=secrets-store-csi-driver, chart=secrets-store-csi-driver/secrets-store-csi-driver
Comparing release=aws-secrets-provider, chart=aws-secrets-manager/secrets-store-csi-driver-provider-aws
Comparing release=kube-state-metrics, chart=prometheus-community/kube-state-metrics
kube-system, kube-state-metrics, ClusterRole (rbac.authorization.k8s.io) has changed:
# Source: kube-state-metrics/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
- helm.sh/chart: kube-state-metrics-5.18.1
+ helm.sh/chart: kube-state-metrics-5.29.0
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: metrics
app.kubernetes.io/part-of: kube-state-metrics
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/instance: kube-state-metrics
- app.kubernetes.io/version: "2.12.0"
+ app.kubernetes.io/version: "2.14.0"
app.kubernetes.io/component: exporter
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/version: 2.8.2
name: kube-state-metrics
rules:
- apiGroups: ["certificates.k8s.io"]
resources:
- certificatesigningrequests
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- configmaps
verbs: ["list", "watch"]
- apiGroups: ["batch"]
resources:
- cronjobs
verbs: ["list", "watch"]
- apiGroups: ["extensions", "apps"]
resources:
- daemonsets
verbs: ["list", "watch"]
- apiGroups: ["extensions", "apps"]
resources:
- deployments
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- endpoints
verbs: ["list", "watch"]
- apiGroups: ["autoscaling"]
resources:
- horizontalpodautoscalers
verbs: ["list", "watch"]
- apiGroups: ["extensions", "networking.k8s.io"]
resources:
- ingresses
verbs: ["list", "watch"]
- apiGroups: ["batch"]
resources:
- jobs
verbs: ["list", "watch"]
- apiGroups: ["coordination.k8s.io"]
resources:
- leases
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- limitranges
verbs: ["list", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
resources:
- mutatingwebhookconfigurations
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- namespaces
verbs: ["list", "watch"]
- apiGroups: ["networking.k8s.io"]
resources:
- networkpolicies
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- nodes
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- persistentvolumeclaims
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- persistentvolumes
verbs: ["list", "watch"]
- apiGroups: ["policy"]
resources:
- poddisruptionbudgets
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- pods
verbs: ["list", "watch"]
- apiGroups: ["extensions", "apps"]
resources:
- replicasets
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- replicationcontrollers
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- resourcequotas
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- secrets
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- services
verbs: ["list", "watch"]
- apiGroups: ["apps"]
resources:
- statefulsets
verbs: ["list", "watch"]
- apiGroups: ["storage.k8s.io"]
resources:
- storageclasses
verbs: ["list", "watch"]
- apiGroups: ["admissionregistration.k8s.io"]
resources:
- validatingwebhookconfigurations
verbs: ["list", "watch"]
- apiGroups: ["storage.k8s.io"]
resources:
- volumeattachments
verbs: ["list", "watch"]
kube-system, kube-state-metrics, ClusterRoleBinding (rbac.authorization.k8s.io) has changed:
# Source: kube-state-metrics/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
- helm.sh/chart: kube-state-metrics-5.18.1
+ helm.sh/chart: kube-state-metrics-5.29.0
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: metrics
app.kubernetes.io/part-of: kube-state-metrics
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/instance: kube-state-metrics
- app.kubernetes.io/version: "2.12.0"
+ app.kubernetes.io/version: "2.14.0"
app.kubernetes.io/component: exporter
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/version: 2.8.2
name: kube-state-metrics
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kube-state-metrics
subjects:
- kind: ServiceAccount
name: kube-state-metrics
namespace: kube-system
kube-system, kube-state-metrics, Deployment (apps) has changed:
# Source: kube-state-metrics/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: kube-state-metrics
namespace: kube-system
labels:
- helm.sh/chart: kube-state-metrics-5.18.1
+ helm.sh/chart: kube-state-metrics-5.29.0
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: metrics
app.kubernetes.io/part-of: kube-state-metrics
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/instance: kube-state-metrics
- app.kubernetes.io/version: "2.12.0"
+ app.kubernetes.io/version: "2.14.0"
app.kubernetes.io/component: exporter
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/version: 2.8.2
spec:
selector:
matchLabels:
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/instance: kube-state-metrics
replicas: 1
strategy:
type: RollingUpdate
revisionHistoryLimit: 10
template:
metadata:
labels:
- helm.sh/chart: kube-state-metrics-5.18.1
+ helm.sh/chart: kube-state-metrics-5.29.0
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: metrics
app.kubernetes.io/part-of: kube-state-metrics
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/instance: kube-state-metrics
- app.kubernetes.io/version: "2.12.0"
+ app.kubernetes.io/version: "2.14.0"
app.kubernetes.io/component: exporter
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/version: 2.8.2
spec:
+ automountServiceAccountToken: true
hostNetwork: false
serviceAccountName: kube-state-metrics
securityContext:
fsGroup: 65534
runAsGroup: 65534
runAsNonRoot: true
runAsUser: 65534
seccompProfile:
type: RuntimeDefault
priorityClassName: system-node-critical
containers:
- name: kube-state-metrics
args:
- --port=8080
- --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
imagePullPolicy: IfNotPresent
- image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0
+ image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.0
ports:
- containerPort: 8080
name: "http"
livenessProbe:
failureThreshold: 3
httpGet:
httpHeaders:
- path: /healthz
+ path: /livez
port: 8080
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
readinessProbe:
failureThreshold: 3
httpGet:
httpHeaders:
- path: /
- port: 8080
+ path: /readyz
+ port: 8081
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
+ resources:
+ {}
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
kube-system, kube-state-metrics, Service (v1) has changed:
# Source: kube-state-metrics/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: kube-state-metrics
namespace: kube-system
labels:
- helm.sh/chart: kube-state-metrics-5.18.1
+ helm.sh/chart: kube-state-metrics-5.29.0
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: metrics
app.kubernetes.io/part-of: kube-state-metrics
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/instance: kube-state-metrics
- app.kubernetes.io/version: "2.12.0"
+ app.kubernetes.io/version: "2.14.0"
app.kubernetes.io/component: exporter
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/version: 2.8.2
annotations:
prometheus.io/scrape: 'true'
spec:
type: "ClusterIP"
ports:
- name: "http"
protocol: TCP
port: 8080
targetPort: 8080
selector:
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/instance: kube-state-metrics
kube-system, kube-state-metrics, ServiceAccount (v1) has changed:
# Source: kube-state-metrics/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
+ automountServiceAccountToken: true
metadata:
labels:
- helm.sh/chart: kube-state-metrics-5.18.1
+ helm.sh/chart: kube-state-metrics-5.29.0
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: metrics
app.kubernetes.io/part-of: kube-state-metrics
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/instance: kube-state-metrics
- app.kubernetes.io/version: "2.12.0"
+ app.kubernetes.io/version: "2.14.0"
app.kubernetes.io/component: exporter
app.kubernetes.io/name: kube-state-metrics
app.kubernetes.io/version: 2.8.2
name: kube-state-metrics
namespace: kube-system
Comparing release=blazer, chart=stakater/application
Comparing release=ingress, chart=charts/nginx-ingress
Comparing release=xray-daemon, chart=okgolove/aws-xray
Comparing release=ipv4-geolocate, chart=charts/ipv4-geolocate
Comparing release=cert-manager, chart=jetstack/cert-manager |
renovate
bot
force-pushed
the
renovate/all-minor
branch
16 times, most recently
from
c317cf3 to
45e2e91
Compare
renovate
bot
force-pushed
the
renovate/all-minor
branch
11 times, most recently
from
63eb268 to
bb6a4b0
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-minor
branch
13 times, most recently
from
cd80dc8 to
faaf167
Compare
renovate
bot
force-pushed
the
renovate/all-minor
branch
from
faaf167 to
492e93b
Compare
STAGING HELMFILE DIFF:Helmfile diff too large to display. Check the github actions logs for more details. |
ben851
approved these changes
Jul 15, 2025
Collaborator
ben851
left a comment
ben851
left a comment
There was a problem hiding this comment.
I manually tested all of these in dev and they all work as expected 🎉
We can upgrade these in staging tomorrow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.17.0→v1.20.0v1.20.10.48.5→0.56.06.3.0→6.4.23.12.2→3.13.01.4.1→1.5.60.110.0→0.116.20.117.1(+1)11.1.1→11.4.0Review
Release Notes
cert-manager/cert-manager (cert-manager)
v1.20.0Compare Source
v1.19.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.
Changes by Kind
Bug or Regression
v1.19.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.
Changes by Kind
Bug or Regression
Other (Cleanup or Flake)
v1.19.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We updated Go to fix some vulnerabilities in the standard library.
Changes since
v1.19.1Bug or Regression
CVE-2025-47914andCVE-2025-58181which were reported by Trivy. (#8283, @SgtCoDFish)v1.25.5to fixCVE-2025-61727andCVE-2025-61729(#8294, @wallrj-cyberark)global.nodeSelectorto helm chart to perform amergeand allow for a singlenodeSelectorto be set across all services. (#8233, @cert-manager-bot)Other (Cleanup or Flake)
golang/x/crypto(#8270, @SgtCoDFish)v1.19.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We reverted the CRD-based API defaults for
Certificate.Spec.IssuerRefandCertificateRequest.Spec.IssuerRefafter they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager1.20.We fixed a bug that caused certificates to be re-issued unexpectedly if the
issuerRefkind or group was changed to one of the "runtime" default values.We upgraded Go to
1.25.3to address the following security vulnerabilities:CVE-2025-61724,CVE-2025-58187,CVE-2025-47912,CVE-2025-58183,CVE-2025-61723,CVE-2025-58186,CVE-2025-58185,CVE-2025-58188, andCVE-2025-61725.Changes since
v1.19.0:Bug or Regression
issuerRefof a Certificate was omitted, upgrading to1.19.xincorrectly caused the certificate to be renewed (#8175, @cert-manager-bot)v1.19.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.
Changes since
v1.18.0:Feature
global.nodeSelectorto helm chart to allow for a singlenodeSelectorto be set across all services. (#7818, @StingRayZA)pathTypeExactin ACME HTTP01 Ingress challenge solvers. (#7795, @sspreitzer)applyconfigurationsallowing clients to make type-safe server-side apply requests for cert-manager resources. (#7866, @erikgb)certmanager_certificate_challenge_statusPrometheus metric. (#7736, @hjoshi123)protocolfield forrfc2136DNS01 provider (#7881, @hjoshi123)hostUsersflag to all pods. Not set by default. (#7973, @hjoshi123)--acme-http01-solver-resource-*settings. (#7972, @lunarwhite)CAInjectorMergingfeature has been promoted to BETA and is now enabled by default (#8017, @ThatsMrTalbot)certificatemetrics to the collector approach. (#7856, @hjoshi123)Bug or Regression
error waiting for authorization(#7796, @hjoshi123)class,ingressClassName,name) are specified simultaneously (#8021, @lunarwhite)global.rbac.disableHTTPChallengesRoleHelm option. (#7836, @inteon)pathlabel of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. (#8109, @mladen-rusev-cyberark)ingress-nginxin E2E tests to ensure compatibility (#7792, @wallrj)Other (Cleanup or Flake)
tokenrequestRoleBinding resource to improve consistency (#7761, @lunarwhite)maps.Copyfor cleaner map handling (#8092, @quantpoet)vault-client-goto the newvault/apiclient. (#8059, @armagankaratosun)v1.18.6Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.18.6 is a simple patch release to fix some reported vulnerabilities, most notably CVE-2025-68121.
NB: We didn't attempt to patch CVE-2026-24051 but that vulnerability affects macOS only, so cert-manager will be unaffected.
Changes by Kind
Bug or Regression
v1.18.5Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.
Changes by Kind
Bug or Regression
Other (Cleanup or Flake)
v1.18.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We updated Go to fix some vulnerabilities in the standard library.
Changes since
v1.18.3Bug or Regression
CVE-2025-47914andCVE-2025-58181which were reported by Trivy. (#8282, @SgtCoDFish)v1.24.11to fixCVE-2025-61727andCVE-2025-61729(#8295, @wallrj-cyberark)Other (Cleanup or Flake)
golang/x/crypto(#8271, @SgtCoDFish)v1.18.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We fixed a bug which caused certificates to be re-issued unexpectedly, if the issuerRef kind or group was changed to one of the "runtime" default values. We increased the size limit when parsing PEM certificate chains to handle leaf certificates with large numbers of DNS named or other identities. We upgraded Go to 1.24.9 to fix various non-critical security vulnerabilities.
Changes since
v1.18.2:Bug or Regression
Other (Cleanup or Flake)
v1.18.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We fixed a bug in the CSR's name constraints construction (only applies if you have enabled the
NameConstraintsfeature gate).We dropped the new
global.rbac.disableHTTPChallengesRoleHelm option due to a bug we found, this feature will be released inv1.19instead.Changes since
v1.18.1:Bug or Regression
global.rbac.disableHTTPChallengesRoleHelm option. (#7837, @cert-manager-bot)v1.18.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We have added a new feature gate
ACMEHTTP01IngressPathTypeExact, to allowingress-nginxusers to turn off the new default IngressPathType: Exactbehavior, in ACME HTTP01 Ingress challenge solvers.This change fixes the following issue: #7791
We have increased the ACME challenge authorization timeout to two minutes, which we hope will fix a timeout error (
error waiting for authorization), which has been reported by multiple users, since the release of cert-managerv1.16.0.This change should fix the following issues: #7337, #7444, and #7685.
Changes since
v1.18.0:Feature
ACMEHTTP01IngressPathTypeExact, to allowingress-nginxusers to turn off the new default IngressPathType: Exactbehavior, in ACME HTTP01 Ingress challenge solvers. (#7810, @sspreitzer)Bug or Regression
error waiting for authorization. (#7801, @hjoshi123)Other (Cleanup or Flake)
#7807, @wallrj)v1.18.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager 1.18 introduces several new features and breaking changes. Highlights include support for ACME certificate profiles, a new default for
Certificate.Spec.PrivateKey.RotationPolicynow set toAlways(breaking change), and the defaultCertificate.Spec.RevisionHistoryLimitnow set to1(potentially breaking).Known Issues
Changes since
v1.17.2:Feature
app.kubernetes.io/managed-by: cert-managerlabel to the created Let's Encrypt account keys (#7577, @terinjokes)certmanager_certificate_not_before_timestamp_seconds,certmanager_certificate_not_after_timestamp_seconds). (#7612, @solidDoWant)--extra-certificate-annotations, which sets a list of annotation keys to be copied from Ingress-like to resulting Certificate object (#7083, @k0da)issshort name for the cert-managerIssuerresource. (#7373, @SgtCoDFish)cissshort name for the cert-managerClusterIssuerresource (#7373, @SgtCoDFish)global.rbac.disableHTTPChallengesRolehelm value to disable HTTP-01 ACME challenges. This allows cert-manager to drop its permission to create pods, improving security when HTTP-01 challenges are not required. (#7666, @ali-hamza-noor)FindZoneByFqdn(#7596, @ThatsIvan)UseDomainQualifiedFinalizerfeature to GA. (#7735, @jsoref)Certificate.Spec.PrivateKey.RotationPolicychanged fromNevertoAlways. (#7723, @wallrj)Documentation
Bug or Regression
go-josedependency to addressCVE-2025-27144. (#7606, @SgtCoDFish)golang.org/x/oauth2to patchCVE-2025-22868. (#7638, @NicholasBlaskey)golang.org/x/cryptoto patchGHSA-hcg3-q754-cr77. (#7638, @NicholasBlaskey)github.com/golang-jwt/jwtto patchGHSA-mh63-6h87-95cp. (#7638, @NicholasBlaskey)ImplementationSpecifictoExactfor a reliable handling of ingress controllers and enhanced security. (#7767, @sspreitzer)--namespace=<namespace>: limit the scope of cert-manager to a single namespace and disable cluster-scoped controllers. (#7678, @tsaarni)commonNamefield; IP addresses are no longer added to the DNSsubjectAlternativeNamelist and are instead added to theipAddressesfield as expected. (#7081, @johnjcool)certmanager_certificate_renewal_timestamp_secondsmetric help text indicating that the metric is relative to expiration time, rather than Unix epoch time. (#7609, @solidDoWant)Passthroughmode. (#6986, @vehagn)golang.org/x/netfixingCVE-2025-22870. (#7619, @dependabot[bot])Other (Cleanup or Flake)
third_party/forked/acmepackage with support for the ACME profiles extension. (#7776, @wallrj)AdditionalCertificateOutputFormatsfeature to GA, making additional formats always enabled. (#7744, @erikgb)ValidateCAA. Setting this feature gate is now a no-op which does nothing but print a warning log line (#7553, @SgtCoDFish)v1.24.4(#7785, @wallrj)v1.17.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
We fixed a bug in the CSR's name constraints construction (only applies if you have enabled the
NameConstraintsfeature gate).Changes since
v1.17.3:Bug or Regression
v1.17.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release addresses several vulnerabilities reported by the Trivy security scanner. It is built with the latest version of Go 1.23.
We have increased the ACME challenge authorization timeout to two minutes, which we hope will fix a timeout error (
error waiting for authorization), which has been reported by multiple users, in: #7337, #7444, and #7685.Changes since
v1.17.2:Bug or Regression
waiting for authorization(#7798, @hjoshi123)Other (Cleanup or Flake)
v1.17.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release addresses several vulnerabilities reported by the Trivy security scanner. It is built with the latest version of Go 1.23 and includes various dependency updates.
Changes since
v1.17.1Bug or Regression
v1.23.8to fixCVE-2025-22871(#7701,@wallrj)go-josedependency to addressCVE-2025-27144(#7603,@SgtCoDFish)golang.org/x/netto addressCVE-2025-22870reported by Trivy (#7622,@SgtCoDFish)golang.org/x/netto fixCVE-2025-22872(#7703,@wallrj)golang.org/x/oauth2to patchCVE-2025-22868(#7692,@lentzi90)golang.org/x/cryptoto patchGHSA-hcg3-q754-cr77(#7692,@lentzi90)github.com/golang-jwt/jwtto patchGHSA-mh63-6h87-95cp(#7692,@lentzi90)v1.17.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This release is primarily intended to address a breaking change in Cloudflare's API which impacted ACME DNS-01 challenges using Cloudflare.
Many thanks to the community members who reported this issue!
Changes by Kind
Bug or Regression
fluent/helm-charts (fluent-bit)
v0.56.0Compare Source
Added
.autoscaling.vpa.recommenderv0.55.1Compare Source
Changed
v0.55.0Compare Source
Changed
v0.54.1Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.54.0Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.53.0Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.52.0Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.51.0Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
What's Changed
Full Changelog: fluent/helm-charts@fluent-operator-3.4.2...fluent-bit-0.51.0
v0.50.0Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.49.1Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.49.0Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.48.10Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.48.9Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.48.8Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.48.7Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
v0.48.6Compare Source
Fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
prometheus-community/helm-charts (kube-state-metrics)
v6.4.2Compare Source
Install kube-state-metrics to generate and expose cluster-level metrics
What's Changed
Full Changelog: prometheus-community/helm-charts@prom-label-proxy-0.16.1...kube-state-metrics-6.4.2
v6.4.1Compare Source
Install kube-state-metrics to generate and expose cluster-level metrics
What's Changed
Full Changelog: prometheus-community/helm-charts@prometheus-nginx-exporter-1.15.2...kube-state-metrics-6.4.1
kubernetes-sigs/metrics-server (metrics-server)
v3.13.0kubernetes-sigs/secrets-store-csi-driver (secrets-store-csi-driver)
v1.5.6Compare Source
v1.5.6 - 2026-02-26
Changelog
Maintenance 🔧
605661fchore: bump version to v1.5.6 in release-1.50dedb0echore: update to kubectl 1.34.2 in helm-crds image965c958chore: update to go 1.24.12Security Fix 🛡️
ccc4c20security: bump to go 1.24.13 to resolve CVE-2025-68121v1.5.5Compare Source
v1.5.5 - 2025-12-15
Changelog
Maintenance 🔧
4b3d15fchore: bump version to v1.5.5 in release-1.53d55662chore: update to go 1.24.11 and bump golang.org/x/crypto to v0.46.04a374c5chore: update to go 1.24.9v1.5.4Compare Source
v1.5.4 - 2025-10-01
Changelog
Continuous Integration 💜
96dbbdcci: resolve azure e2e test flakes with rbac, windows vm size0071011ci: update azure scripts to use rbac for keyvault permissionsMaintenance 🔧
8d33239chore: bump version to v1.5.4 in release-1.56665902chore: bump kubectl to v1.34.1 in driver-crds321f0f4chore: update debian-base to bookworm-v1.0.6893cf34chore: update to go 1.24.7v1.5.3Compare Source
v1.5.3 - 2025-07-24
Changelog
Continuous Integration 💜
7cbb6ebci: use ubuntu-latest for gh workflowsMaintenance 🔧
f61041cchore: bump version to v1.5.3 in release-1.5a884676chore: bump golang.org/x/oauth2 from 0.7.0 to 0.27.0v1.5.2Compare Source
v1.5.2 - 2025-06-26
Changelog
Maintenance 🔧
Testing 💚
Security Fix 🛡️
Full Changelog: kubernetes-sigs/secrets-store-csi-driver@v1.5.1...v1.5.2
v1.5.1Compare Source
v1.5.1 - 2025-05-19
Changelog
Maintenance 🔧
Security Fix 🛡️
Full Changelog: kubernetes-sigs/secrets-store-csi-driver@v1.5.0...v1.5.1
v1.5.0Compare Source
v1.5.0 - 2025-04-09
Changelog
Bug Fixes 🐞
b0fdeb5fix: update sha generation logicf0e9dccfix: add unit test to show failures in current sha logicCode Refactoring 💎
9548c23refactor: cleanup unused err checkFeatures 🌈
bf7e77efeat: add build for windows ltsc2025Maintenance 🔧
a488327chore: bump kind to v0.27.0515358echore: disable trivy package testing for driver-crds924b3b8chore: bump docker golang base images to 1.23572e439chore: move tam7t to emeritus_approvers0b00da8chore: bump github/codeqConfiguration
📅 Schedule: Branch creation - "every weekend" in timezone America/Montreal, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.