feat: Support Ingress annotation override for HTTP-01 ingressClassName by lunarwhite · Pull Request #8244 · cert-manager/cert-manager

lunarwhite · 2025-11-11T13:38:38Z

This PR implements a new acme.cert-manager.io/http01-ingress-ingressclassname Ingress annotation, to enable users to configure annotation-based override for HTTP01 solver's ingressClassName field in ACME Issuer.

This reduces operational complexity and the likelihood of user misconfiguration. Notably it also maintains strict backward compatibility with the existing acme.cert-manager.io/http01-ingress-class annotation - users who want to override the value of the kubernetes.io/ingress.class Ingress annotation can still make use of it.

sequenceDiagram
    participant User
    participant Ingress
    participant CertShim as Certificate-Shim
    participant Cert as Certificate
    participant Orders as ACME Orders
    participant Challenge as HTTP01 Challenge

    User->>Ingress: Create Ingress with new annotation
    Note over User,Ingress: acme.cert-manager.io/http01-ingress-ingressclassname
    CertShim->>Ingress: Watch and reconcile
    CertShim->>Cert: Create Certificate with override annotation
    Note over CertShim,Cert: acme.cert-manager.io/http01-override-ingress-ingressclassname
    Orders->>Cert: Process Certificate request
    Orders->>Orders: Validate mutual exclusivity
    Orders->>Challenge: Create HTTP01 challenge with custom ingressClassName
    Challenge->>Challenge: Apply ingressClassName override

Please refer to this design proposal for the full context.

Pull Request Motivation

Closes #6184

Currently cert-manager supports annotation-based overrides for http01.ingress.class via annotation acme.cert-manager.io/http01-ingress-class. But the same capability is missing for http01.ingress.ingressClassName spec field. This inconsistency could easily break the user experience and would likely cause misconfigurations, resulting in a "conflict".

It would also eliminate the requirement to set up a dedicated Issuer for every Ingress controller/class, as #6184 (comment) and #6651 (comment) reported.

E2E Verification

Issuer with ingressClassName

with new Ingress annotation to override `ingressClassName`

# create Issuer with ingressClassName
k apply -f - << EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-universal
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-http01-resources
    solvers:
    - http01:
        ingress:
          ingressClassName: fake
EOF

# create Ingress with new annotation
k apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-universal
    acme.cert-manager.io/http01-ingress-ingressclassname: nginx
  name: pebble
  namespace: pebble
spec:
  ingressClassName: nginx
  rules:
  - host: pebble.com
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: pebble
            port:
              number: 443
  tls:
  - hosts:
    - pebble.com
    secretName: pebble-cert
EOF

# check Ingress, Challenge, Certificate objects value should be override properly
k get ingress -n pebble -o yaml
...
metadata:
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::
  name: cm-acme-http-solver-k8nh8
  namespace: pebble
spec:
  ingressClassName: nginx
...

k get challenge -n pebble -o yaml
...
  spec:
    solver:
      http01:
        ingress:
          ingressClassName: nginx
...

k get certificate -n pebble -o yaml
...
  metadata:
    annotations:
      acme.cert-manager.io/http01-override-ingress-ingressclassname: nginx
    name: pebble-cert
    namespace: pebble
...

with old Ingress annotation to override `Class`

# create Ingress with old annotation
k apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-universal
    acme.cert-manager.io/http01-ingress-class: nginx
  name: pebble
  namespace: pebble
spec:
  ingressClassName: nginx
  rules:
  - host: pebble.com
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: pebble
            port:
              number: 443
  tls:
  - hosts:
    - pebble.com
    secretName: pebble-cert
EOF

# check Ingress, Challenge, Certificate objects value should be override properly
k get ingress -n pebble -o yaml
...
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  name: cm-acme-http-solver-q2fs6
  namespace: pebble
...

k get challenge -n pebble -o yaml
...
  spec:
    solver:
      http01:
        ingress:
          class: nginx
...

k get certificate -n pebble -o yaml
...
  metadata:
    annotations:
      acme.cert-manager.io/http01-override-ingress-class: nginx
    name: pebble-cert
    namespace: pebble
...

with both Ingress annotations

covered by UT - ACME Order creation fails with validation error

Issuer with class

with new Ingress annotation to override `ingressClassName`

# create Issuer with class
k apply -f - << EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-universal
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-http01-resources
    solvers:
    - http01:
        ingress:
          class: fake
EOF

# create Ingress with new annotation

# check Ingress, Challenge, Certificate objects value should be override properly
k get ingress -n pebble -o yaml
...
metadata:
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  name: cm-acme-http-solver-k8nh8
  namespace: pebble
spec:
  ingressClassName: nginx
...

k get challenge -n pebble -o yaml
...
  spec:
    solver:
      http01:
        ingress:
          ingressClassName: nginx
...

k get certificate -n pebble -o yaml
...
  metadata:
    annotations:
      acme.cert-manager.io/http01-override-ingress-ingressclassname: nginx
    name: pebble-cert
    namespace: pebble
...

with old Ingress annotation to override `Class`

# create Ingress with legacy annotation

# check Ingress, Challenge, Certificate objects value should be override properly
k get ingress -n pebble -o yaml
...
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  name: cm-acme-http-solver-tcr9t
  namespace: pebble
...

k get challenge -n pebble -o yaml
...
  spec:
    solver:
      http01:
        ingress:
          class: nginx
...

k get certificate -n pebble -o yaml
...
  metadata:
    annotations:
      acme.cert-manager.io/http01-override-ingress-class: nginx
    name: pebble-cert
    namespace: pebble
...

with no Ingress annotation for override

# create Ingress with neither annotation
k apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-universal
  name: pebble
  namespace: pebble
spec:
  ingressClassName: fake
  rules:
  - host: pebble.com
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: pebble
            port:
              number: 443
  tls:
  - hosts:
    - pebble.com
    secretName: pebble-cert
EOF

# check Ingress, Challenge, Certificate objects value should not be overridden (uses solver's configs)
k get ingress -n pebble -o yaml
...
metadata:
  annotations:
    kubernetes.io/ingress.class: fake
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  name: cm-acme-http-solver-x4h6c
  namespace: pebble
...

k get challenge -n pebble -o yaml
...
  spec:
    solver:
      http01:
        ingress:
          class: fake
...

k get certificate -n pebble -o yaml
...
  metadata:
    name: pebble-cert
    namespace: pebble
...

with both Ingress annotations

covered by UT - ACME Order creation fails with validation error

[Multiple solvers] Issuer with ingressClassName and class

with new Ingress annotation to override `ingressClassName`

# create Issuer with ingressClassName + class
k apply -f - << EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-universal
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-http01-resources
    solvers:
    - http01:
        ingress:
          ingressClassName: fake
      selector:
        dnsZones:
          - pebble-new.com
    - http01:
        ingress:
          class: fake
      selector:
        dnsZones:
          - pebble-legacy.com
EOF

# create Ingress with new annotation
k apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-universal
    acme.cert-manager.io/http01-ingress-ingressclassname: nginx
  name: pebble
  namespace: pebble
spec:
  ingressClassName: nginx
  rules:
  - host: a.pebble-new.com
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: pebble
            port:
              number: 443
  tls:
  - hosts:
    - a.pebble-new.com
    secretName: pebble-cert
EOF

# check Ingress, Challenge, Certificate objects value should be override properly
k get ingress -n pebble -l acme.cert-manager.io/http01-solver="true" -o yaml
...
metadata:
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  name: cm-acme-http-solver-tcr9t
  namespace: pebble
spec:
  ingressClassName: nginx
  rules:
  - host: a.pebble-new.com
...

k get challenge -n pebble -o yaml
...
  spec:
    solver:
      http01:
        ingress:
          ingressClassName: nginx
      selector:
        dnsZones:
        - pebble-new.com
...

k get certificate -n pebble -o yaml
...
  metadata:
    annotations:
      acme.cert-manager.io/http01-override-ingress-ingressclassname: nginx
    name: pebble-cert
    namespace: pebble
...

with old Ingress annotation to override `Class`

# create ingress with legacy annotation
k apply -f - << EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-universal
    acme.cert-manager.io/http01-ingress-class: nginx
  name: pebble
  namespace: pebble
spec:
  ingressClassName: nginx
  rules:
  - host: b.pebble-legacy.com
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: pebble
            port:
              number: 443
  tls:
  - hosts:
    - b.pebble-legacy.com
    secretName: pebble-cert
EOF

# check Ingress, Challenge, Certificate objects value should be override properly
k get ingress -n pebble -l acme.cert-manager.io/http01-solver="true" -o yaml
...
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0,::/0
  name: cm-acme-http-solver-tcr9t
  namespace: pebble
spec:
  rules:
  - host: b.pebble-legacy.com
...

k get challenge -n pebble -o yaml
...
    solver:
      http01:
        ingress:
          class: nginx
      selector:
        dnsZones:
        - pebble-legacy.com
...

k get certificate -n pebble -o yaml
...
  metadata:
    annotations:
      acme.cert-manager.io/http01-override-ingress-class: nginx
    name: pebble-cert
    namespace: pebble
...

Kind

/kind feature

Release Note

Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers.

…` Ingress annotation, to override HTTP01 solver's `ingressClassName` field in ACME Issuer Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

lunarwhite · 2025-11-11T14:16:16Z

/cc @maelvls

Please kindly add this to your review queue, thanks in advance!

Copilot

Pull Request Overview

This PR introduces a new Ingress annotation acme.cert-manager.io/http01-ingress-ingressclassname to enable annotation-based override of the ingressClassName field in HTTP-01 challenge solvers. This enhancement addresses a gap in functionality where users could override the legacy class field but not the newer ingressClassName field, reducing the need for multiple Issuers for different Ingress classes.

Key Changes

Added new annotation constants for overriding ingressClassName in both Ingress and Certificate resources
Extended setIssuerSpecificConfig to handle the new annotation alongside the existing class override
Enhanced applyIngressParameterAnnotationOverrides to support the new override with mutual exclusivity validation
Comprehensive test coverage for all mutual exclusivity scenarios between the three override types (name, class, ingressClassName)

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`pkg/apis/certmanager/v1/types.go`	Added `IngressACMEIssuerHTTP01IngressClassNameAnnotationKey` constant for the new Ingress annotation
`pkg/apis/acme/v1/types.go`	Added `ACMECertificateHTTP01IngressClassNameOverride` constant for Certificate/Order annotation
`internal/apis/certmanager/types.go`	Added internal annotation constant for consistency
`pkg/controller/certificate-shim/sync.go`	Extended `setIssuerSpecificConfig` to process the new annotation and set it on the Certificate
`pkg/controller/certificate-shim/sync_test.go`	Added test cases for the new annotation handling and empty value scenarios
`pkg/controller/acmeorders/util.go`	Enhanced mutual exclusivity validation to include the new override annotation
`pkg/controller/acmeorders/util_test.go`	Added comprehensive test cases for all mutual exclusivity combinations with the new override

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

maelvls · 2025-11-18T08:25:59Z

pkg/apis/acme/v1/types.go

+	// This is especially useful for users deploying many different ingress
+	// classes into a single cluster that want to be able to re-use a single
+	// solver for each ingress class.
+	ACMECertificateHTTP01IngressClassNameOverride = "acme.cert-manager.io/http01-override-ingress-ingressclassname"


tiny nit: this doesn't match the diagram (excellent diagram by the way!! I never thought of using mermaid, I'll use that from now on)

Good catch! Updated the name in the diagram

maelvls · 2025-11-18T14:41:38Z

Hey! This looks great, I'd be happy to approve right away. The only comment Codex had was:

Couldn’t find any e2e/integration test that exercises ACMECertificateHTTP01IngressClassNameOverride, so regressions in the new override path would only be caught by unit tests. Consider adding an HTTP‑01 scenario in test/e2e to cover it end-to-end.

I'm OK with the unit tests (which rely on the "fake clientset"). I'm confident enough with just the tests you added.

/approve
/lgtm
/hold so that you can merge this once you are ready

cert-manager-prow · 2025-11-18T14:41:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maelvls

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [maelvls]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

lunarwhite · 2025-11-19T02:26:50Z

/unhold

wallrj-cyberark · 2026-02-03T14:10:15Z

📢 The fix or feature is now available for testing in an alpha release

https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0-alpha.1

Please test and report back.

…#4581) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager/cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4581 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4582 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

Add support for `acme.cert-manager.io/http01-ingress-ingressclassname…

ed1ac31

…` Ingress annotation, to override HTTP01 solver's `ingressClassName` field in ACME Issuer Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

lunarwhite changed the title ~~Add support for `acme.cert-manager.io/http01-ingress-ingressclassname…~~ feat: Support Ingress annotation override for HTTP-01 IngressClassName Nov 11, 2025

lunarwhite changed the title ~~feat: Support Ingress annotation override for HTTP-01 IngressClassName~~ feat: Support Ingress annotation override for HTTP-01 ingressClassName Nov 11, 2025

cert-manager-prow bot requested a review from maelvls November 11, 2025 14:16

erikgb requested a review from Copilot November 13, 2025 10:50

Copilot started reviewing on behalf of erikgb November 13, 2025 10:50 View session

Copilot finished reviewing on behalf of erikgb November 13, 2025 10:52

Copilot AI reviewed Nov 13, 2025

View reviewed changes

maelvls reviewed Nov 18, 2025

View reviewed changes

cert-manager-prow bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm Indicates that a PR is ready to be merged. labels Nov 18, 2025

cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 18, 2025

cert-manager-prow bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 19, 2025

cert-manager-prow bot merged commit 8b1c8d9 into cert-manager:master Nov 19, 2025
11 of 12 checks passed

lunarwhite deleted the ingress-anno branch November 19, 2025 02:43

lunarwhite mentioned this pull request Nov 19, 2025

Add doc content for new Ingress annotation http01-ingress-ingressclassname cert-manager/website#1848

Merged

github-actions bot mentioned this pull request Mar 30, 2026

Update Helm release cert-manager to v1.20.0 claytono/infra#1873

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Support Ingress annotation override for HTTP-01 ingressClassName#8244

feat: Support Ingress annotation override for HTTP-01 ingressClassName#8244
cert-manager-prow[bot] merged 1 commit intocert-manager:masterfrom
lunarwhite:ingress-anno

lunarwhite commented Nov 11, 2025 •

edited

Loading

Uh oh!

lunarwhite commented Nov 11, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

maelvls Nov 18, 2025

Uh oh!

lunarwhite Nov 18, 2025

Uh oh!

maelvls commented Nov 18, 2025

Uh oh!

cert-manager-prow bot commented Nov 18, 2025

Uh oh!

lunarwhite commented Nov 19, 2025

Uh oh!

Uh oh!

wallrj-cyberark commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

lunarwhite commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Motivation

E2E Verification

Kind

Release Note

Uh oh!

lunarwhite commented Nov 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes

Reviewed Changes

Uh oh!

maelvls Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

lunarwhite Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

maelvls commented Nov 18, 2025

Uh oh!

cert-manager-prow bot commented Nov 18, 2025

Uh oh!

lunarwhite commented Nov 19, 2025

Uh oh!

Uh oh!

wallrj-cyberark commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lunarwhite commented Nov 11, 2025 •

edited

Loading