📋 Recommended Actions

✅ No Immediate Action Required
No immediate action is required. However, reviewing these updates is recommended to benefit from improved stability, enhanced security, and to better support your users by understanding the strengthened supply chain integrity.

📝 Summary

cert-manager v1.20.4 delivers crucial updates focused on strengthening security, improving controller stability, and hardening the release process. This patch release includes a critical fix for the certificate shim, preventing unintended mutation of cached Kubernetes objects—a vital step for controller reliability. You’ll also find a suite of dependency upgrades addressing various underlying security advisories, fortifying cert-manager’s overall supply chain posture. Significant enhancements to the release pipeline now incorporate Cosign signing for metadata, boosting integrity and trust. Furthermore, e2e tests are now more robust with retry mechanisms for Kyverno policy application and dynamic resolution of initial upgrade versions, ensuring a smoother development experience. Review these changes to leverage a more secure and stable cert-manager environment.

🔒 Comprehensive Dependency Security Updates

To maintain a robust security posture and address potential vulnerabilities originating from upstream libraries, cert-manager v1.20.4 includes a wide array of dependency updates. These upgrades target various components, ensuring that cert-manager benefits from the latest security patches and bug fixes from its underlying Go modules and external libraries. This continuous effort in dependency management is crucial for the overall supply chain security of cert-manager deployments.

This release updates numerous Go modules, including critical security bumps for google.golang.org/grpc to v1.83.2, github.com/google/cel-go to v0.30.0, go.etcd.io/etcd/client/pkg/v3 to v3.6.14, go.opentelemetry.io/otel to v1.44.0, and software.sslmate.com/src/go-pkcs12 to v0.7.2. Additionally, various golang.org/x modules such as x/crypto, x/net, x/sys, and x/text have been updated to their latest secure versions to resolve known vulnerabilities identified by tools like Trivy. For instance, golang.org/x/crypto is bumped from v0.52.0 to v0.55.0 to incorporate fixes, although specific x/crypto/ssh CVEs (CVE-2026-56855, CVE-2026-78662) are explicitly ignored as cert-manager does not use the vulnerable parts and cannot upgrade to the required Go 1.26.0 on this branch.

Source:

  • cmd/acmesolver/go.mod (35-42)
  • cmd/cainjector/go.mod (56-65)
  • cmd/controller/go.mod (130-149)
  • cmd/webhook/go.mod (16-36)
  • go.mod (35-51)
  • .trivyignore (2-17)
  • make/_shared/tools/00_mod.mk (32)

✨ Refined Certificate Shim: Preventing Object Mutation

A subtle yet critical bug in the certificate shim logic has been addressed, ensuring that shared informer caches remain immutable. Previously, when the shim generated a Certificate resource from an Ingress or Gateway object, it would directly modify the labels map from the cached object. This could lead to unexpected behavior and race conditions within controllers relying on the stability of cached data. This fix introduces a defensive copy, guaranteeing that any modifications to the Certificate’s labels no longer inadvertently affect the original, cached Kubernetes object.

The fix specifically targets the buildCertificates function within the certificate shim. Instead of directly referencing the ingress or gateway’s labels, a clone of the labels map is now created. This ensures that when applyset labels or other internal labels are removed or modified for the new Certificate resource, the original object in the informer cache remains untouched, preserving data integrity and preventing unintended side effects. This change is crucial for controller stability and adherence to Kubernetes’ best practices for informer usage.

Source:

  • pkg/controller/certificate-shim/sync.go (423-426)
  • pkg/controller/certificate-shim/sync_test.go (4663-4672)

🏗️ Enhanced Release Process with Cosign Metadata Signing

Supply chain security is paramount, and cert-manager is continuously working to strengthen its release integrity. This release introduces a significant enhancement to the build and release pipeline: the signing of staged metadata.json files with Cosign. This new step ensures that the release metadata—which describes the artifacts published—is cryptographically signed, providing verifiable proof of authenticity and integrity. Users can now be confident that the release metadata they consume has not been tampered with.

During the release process, the metadata.json file, which aggregates information about all release artifacts, is now signed using Cosign and a KMS key (CMREL_KEY). This signature is then stored alongside the metadata file. The build process now also includes a ‘fail fast’ mechanism if the CMREL_KEY is not provided during signing, ensuring that unsigned metadata cannot proceed through the pipeline. Additionally, Google Cloud Build (GCB) logging has been configured to explicitly store logs in a GCS bucket, improving auditability and traceability of the build process.

Source:

🛠️ Improved E2E Test Stability and Reliability

Reliable end-to-end (E2E) tests are the backbone of a stable project. This release includes several enhancements that significantly boost the stability and reliability of cert-manager’s E2E test suite. These improvements address flakiness and ensure that the test environment behaves more predictably, leading to more confident and faster development cycles. Key changes involve more resilient test setups and robust version resolution for upgrade scenarios.

A common cause of E2E test flakiness, particularly with Kyverno admission webhooks, has been mitigated by introducing a retry mechanism for applying Kyverno policies. This accounts for the webhook’s startup delay after a Helm upgrade, preventing premature test failures. Additionally, conformance tests for certificates now randomize the CommonName, reducing potential conflicts or caching issues with certain issuers during test runs. The upgrade test script (hack/verify-upgrade.sh) has also been refactored to dynamically resolve the initial release version for upgrades directly from published Helm charts, making tests less sensitive to local git history and more representative of real-world upgrade paths.

Source:

Minor Updates & Housekeeping

This release also updates base images to their latest Debian 12 versions across multiple architectures and includes general housekeeping, such as refining the .gitignore to no longer track specific dockerfiles and removing the unused github.com/stoewer/go-strcase dependency.