Add unhealthyPodEvictionPolicy to supported PDB options by jcpunk · Pull Request #7728 · cert-manager/cert-manager

jcpunk · 2025-05-02T20:42:40Z

Pull Request Motivation

unhealthyPodEvictionPolicy is a feature of the podDisruptionBudget, so it is nice to be able to set it via the chart.

Currently the chart ignores this value when set.

Kind

/kind feature

Release Note

Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget

cert-manager-prow · 2025-05-02T20:42:50Z

Hi @jcpunk. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

erikgb · 2025-05-02T21:00:13Z

@jcpunk Thanks for your PR. Have you seen #7537?

jcpunk · 2025-05-02T21:19:47Z

I did not. Weird, I'd swear I searched for PRs before writing this...

Whichever you prefer to merge is fine with me.

cert-manager-bot · 2025-10-31T22:20:07Z

Issues go stale after 6 months of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues remain open for an additional 3 months of inactivity and then close.
If this issue is safe to close now please do so with /close.
/lifecycle stale

erikgb

@jcpunk, as we didn't get any feedback from the author of #7537, I am hoping you can finish up this PR.

/ok-to-test

deploy/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml

deploy/charts/cert-manager/templates/poddisruptionbudget.yaml

deploy/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml

deploy/charts/cert-manager/values.yaml

jcpunk · 2025-11-06T16:27:15Z

In theory I've addressed the review and made the requested changes.

erikgb · 2025-11-06T16:53:50Z

Please run 'make vendor-go generate-helm-docs'

jcpunk · 2025-11-06T19:55:40Z

I do not understand the test failures...

erikgb · 2025-11-06T21:09:46Z

I do not understand the test failures...

@jcpunk, the problem is the failing verify job. 😸 You need to ensure generated files are up-to-date. Did you try to run make vendor-go generate-helm-docs locally, as suggested by the failing verify job?

jcpunk · 2025-11-06T21:11:44Z

I did run that, but nothing in my local repo changed...

riehecky@leibniz:/tmp/foo/cert-manager$ make vendor-go generate-helm-docs
/tmp/foo/cert-manager/_bin/tools/helm-tool inject \
        --header-search '^<!-- AUTO-GENERATED -->' \
        --footer-search '^<!-- /AUTO-GENERATED -->' \
        -i deploy/charts/cert-manager/values.yaml \
        -o deploy/charts/cert-manager/README.template.md
riehecky@leibniz:/tmp/foo/cert-manager$ git status
On branch pdb-smarter
Your branch is up to date with 'origin/pdb-smarter'.

nothing to commit, working tree clean

I'll rebase off HEAD?

erikgb · 2025-11-06T21:24:27Z

I did run that, but nothing in my local repo changed...

riehecky@leibniz:/tmp/foo/cert-manager$ make vendor-go generate-helm-docs
/tmp/foo/cert-manager/_bin/tools/helm-tool inject \
        --header-search '^<!-- AUTO-GENERATED -->' \
        --footer-search '^<!-- /AUTO-GENERATED -->' \
        -i deploy/charts/cert-manager/values.yaml \
        -o deploy/charts/cert-manager/README.template.md
riehecky@leibniz:/tmp/foo/cert-manager$ git status
On branch pdb-smarter
Your branch is up to date with 'origin/pdb-smarter'.

nothing to commit, working tree clean

I'll rebase off HEAD?

I checked out your branch, and I agree it doesn't change anything. But when I rebased the branch on top of upstream/master, the Helm schema was modified after rerunning the command. Could you try that and force push the result? I am not sure if I have permission to force push to your branch. Sorry about this! 🤷

jcpunk · 2025-11-06T21:29:58Z

I'll rebase and send you an invite for full access to my repo. Once this is merged up I plan to delete my fork.

jcpunk · 2025-11-07T16:02:47Z

I flattened the commits out, not sure why I'm still getting a failure...

erikgb · 2025-11-08T16:18:39Z

I flattened the commits out, not sure why I'm still getting a failure...

Seems like you sorted it out, but I just pushed an additional commit replacing hasKey with with. I did not like the new linter exceptions added, but I also felt a bit guilty - as I asked you to remove the wrong parts. 😆

erikgb

/hold
/lgtm
/approve

Adding a hold in case you want to rebase the PR into a single commit.

cert-manager-prow · 2025-11-08T16:19:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [erikgb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jcpunk · 2025-12-26T14:23:04Z

I've flattened it down and rebased off HEAD. In theory this is good to go...

Copilot

Pull request overview

This PR adds support for the unhealthyPodEvictionPolicy field in PodDisruptionBudget resources across all cert-manager components (controller, webhook, and cainjector). This field, which requires Kubernetes 1.31 or the PDBUnhealthyPodEvictionPolicy feature gate to be enabled, controls how unhealthy pods are handled during eviction scenarios.

Key Changes:

Added unhealthyPodEvictionPolicy configuration option to all three PDB configurations
Updated Helm templates to conditionally render the field when specified
Enhanced schema validation and documentation for the new field

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
deploy/charts/cert-manager/values.yaml	Added `unhealthyPodEvictionPolicy` configuration comments and examples for controller, webhook, and cainjector PDBs; minor whitespace cleanup
deploy/charts/cert-manager/values.schema.json	Added JSON schema definitions for `unhealthyPodEvictionPolicy` field across all three PDB configurations
deploy/charts/cert-manager/values.linter.exceptions	Formatting update to maintain consistent file structure
deploy/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml	Added conditional template logic to include `unhealthyPodEvictionPolicy` in webhook PDB spec
deploy/charts/cert-manager/templates/poddisruptionbudget.yaml	Added conditional template logic to include `unhealthyPodEvictionPolicy` in controller PDB spec
deploy/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml	Added conditional template logic to include `unhealthyPodEvictionPolicy` in cainjector PDB spec
deploy/charts/cert-manager/README.template.md	Added documentation sections for the new `unhealthyPodEvictionPolicy` field in all three PDB configurations

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

deploy/charts/cert-manager/values.yaml

deploy/charts/cert-manager/values.schema.json

deploy/charts/cert-manager/README.template.md

deploy/charts/cert-manager/values.yaml

deploy/charts/cert-manager/values.schema.json

deploy/charts/cert-manager/README.template.md

Signed-off-by: Pat Riehecky <riehecky@fnal.gov>

jcpunk · 2025-12-26T16:50:21Z

Spelling errors corrected.

erikgb · 2026-01-01T12:41:25Z

/retest

erikgb

Thanks @jcpunk! 🚀

/lgtm
/unhold

erikgb · 2026-01-01T13:08:52Z

/test pull-cert-manager-master-make-test

wallrj-cyberark · 2026-02-03T14:08:47Z

📢 The fix or feature is now available for testing in an alpha release

https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0-alpha.1

Please test and report back.

…#4581) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager/cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4581 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4582 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

cert-manager-prow bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 2, 2025

jcpunk force-pushed the pdb-smarter branch from b14fac3 to 9eefc36 Compare May 2, 2025 20:43

cert-manager-prow bot added dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. and removed dco-signoff: no Indicates that at least one commit in this pull request is missing the DCO sign-off message. labels May 2, 2025

jcpunk force-pushed the pdb-smarter branch from 9eefc36 to f740eba Compare May 2, 2025 20:47

erikgb mentioned this pull request May 3, 2025

feat: Added support for unhealthyPodEvictionPolicy to PDBs #7537

Closed

cert-manager-prow bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 31, 2025

erikgb reviewed Nov 1, 2025

View reviewed changes

cert-manager-prow bot added ok-to-test and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 1, 2025

jcpunk force-pushed the pdb-smarter branch from f740eba to 96150e9 Compare November 6, 2025 16:26

jcpunk force-pushed the pdb-smarter branch 2 times, most recently from f61f724 to 6922b68 Compare November 6, 2025 17:50

jcpunk force-pushed the pdb-smarter branch from 6922b68 to 0fd38a9 Compare November 6, 2025 21:14

jcpunk force-pushed the pdb-smarter branch from 8b4ffa1 to ac66ee8 Compare November 7, 2025 16:01

jcpunk force-pushed the pdb-smarter branch 2 times, most recently from afc1d4e to 966b528 Compare November 7, 2025 16:20

erikgb reviewed Nov 8, 2025

View reviewed changes

cert-manager-prow bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm Indicates that a PR is ready to be merged. labels Nov 8, 2025

cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 8, 2025

jcpunk force-pushed the pdb-smarter branch from c7eb5d0 to 638bc2c Compare December 23, 2025 16:34

cert-manager-prow bot removed the lgtm Indicates that a PR is ready to be merged. label Dec 23, 2025

erikgb requested a review from Copilot December 26, 2025 14:33

Copilot started reviewing on behalf of erikgb December 26, 2025 14:33 View session

Copilot AI reviewed Dec 26, 2025

View reviewed changes

Add unhealthyPodEvictionPolicy to supported PDB options

3d29a83

Signed-off-by: Pat Riehecky <riehecky@fnal.gov>

jcpunk force-pushed the pdb-smarter branch from 315bc19 to 3d29a83 Compare December 26, 2025 16:50

erikgb reviewed Jan 1, 2026

View reviewed changes

cert-manager-prow bot added lgtm Indicates that a PR is ready to be merged. and removed do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Jan 1, 2026

cert-manager-prow bot merged commit 140000a into cert-manager:master Jan 1, 2026
8 checks passed

jcpunk deleted the pdb-smarter branch January 2, 2026 17:28

HadeedS mentioned this pull request Jan 22, 2026

Allow adding new fields such as unhealthyPodEvictionPolicy to the PDB #7275

Closed

Conversation

jcpunk commented May 2, 2025 • edited by maelvls Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Motivation

Kind

Release Note

Uh oh!

cert-manager-prow bot commented May 2, 2025

Uh oh!

erikgb commented May 2, 2025

Uh oh!

jcpunk commented May 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cert-manager-bot commented Oct 31, 2025

Uh oh!

erikgb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jcpunk commented Nov 6, 2025

Uh oh!

erikgb commented Nov 6, 2025

Uh oh!

jcpunk commented Nov 6, 2025

Uh oh!

erikgb commented Nov 6, 2025

Uh oh!

jcpunk commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

erikgb commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jcpunk commented Nov 6, 2025

Uh oh!

jcpunk commented Nov 7, 2025

Uh oh!

erikgb commented Nov 8, 2025

Uh oh!

erikgb left a comment

Choose a reason for hiding this comment

Uh oh!

cert-manager-prow bot commented Nov 8, 2025

Uh oh!

jcpunk commented Dec 26, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jcpunk commented Dec 26, 2025

Uh oh!

erikgb commented Jan 1, 2026

Uh oh!

erikgb left a comment

Choose a reason for hiding this comment

Uh oh!

erikgb commented Jan 1, 2026

Uh oh!

Uh oh!

wallrj-cyberark commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

jcpunk commented May 2, 2025 •

edited by maelvls

Loading

jcpunk commented May 2, 2025 •

edited

Loading

jcpunk commented Nov 6, 2025 •

edited

Loading

erikgb commented Nov 6, 2025 •

edited

Loading