feat(certificate-shim): implementing XListenerSet by hjoshi123 · Pull Request #8394 · cert-manager/cert-manager

hjoshi123 · 2026-01-10T08:08:12Z

Pull Request Motivation

This PR introduces support for XListenerSet and allows the self-service model of TLS in ingress to be brought to Gateways. On a high level it uses this design https://github.com/cert-manager/cert-manager/blob/3a268f0720e1d34a495e7e73ba6ebfada8e8cb14/design/20250703.gatewayapi-listenerset.md.
Fixes #8252

/kind feature

Release Note

added experimental `XListenerSet` feature gate

Test it yourself

You can try out the certificate-shim support for XListenerSet using v1.20.0-alpha.1:

helm upgrade --install cert-manager oci://quay.io/jetstack/charts/cert-manager \
  --version v1.20.0-alpha.1 \
  --namespace cert-manager \
  --set config.apiVersion="controller.config.cert-manager.io/v1alpha1" \
  --set config.kind="ControllerConfiguration" \
  --set config.enableGatewayAPI=true \
  --set config.enableGatewayAPIXListenerSet=true

maelvls · 2026-01-13T11:01:24Z

I've asked Codex to review the PR. It left a couple of comments.

internal/controller/feature/features.go

deploy/charts/cert-manager/templates/rbac.yaml

pkg/controller/certificate-shim/listenerset/controller.go

pkg/controller/certificate-shim/listenerset/controller_test.go

cmd/controller/app/options/options.go

hjoshi123 · 2026-01-14T05:27:42Z

/label tide/merge-method-squash

pkg/controller/certificate-shim/listenerset/controller.go

thomaslochet · 2026-01-23T18:44:24Z

there is a typo issue in cmd/controller/app/options/options.go at line 179: "enabeld".

cmd/controller/app/options/options.go

Copilot

Pull request overview

This PR implements support for XListenerSet resources in cert-manager, enabling self-service TLS configuration for Gateway API users. XListenerSet is an experimental Gateway API feature that allows teams to manage their own listeners on a shared Gateway without requiring cluster-admin privileges.

Changes:

Added experimental XListenerSets feature gate (alpha in v1.20.1)
Implemented listenerset controller that watches XListenerSets and creates Certificate resources
Extended certificate-shim sync logic to handle XListenerSet resources alongside Ingress and Gateway resources
Added annotation inheritance from parent Gateway to XListenerSet for issuer configuration

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
internal/controller/feature/features.go	Adds XListenerSets feature gate definition as an alpha feature
pkg/apis/config/controller/v1alpha1/types.go	Adds EnableGatewayAPIXListenerSets configuration field
internal/apis/config/controller/types.go	Adds internal EnableGatewayAPIXListenerSets configuration field
pkg/apis/config/controller/v1alpha1/zz_generated.deepcopy.go	Generated deepcopy code for new configuration field
internal/apis/config/controller/v1alpha1/zz_generated.conversion.go	Generated conversion code for new configuration field
pkg/controller/certificate-shim/listenerset/controller.go	Implements the listenerset controller with parent Gateway indexing and annotation inheritance
pkg/controller/certificate-shim/listenerset/controller_test.go	Unit tests for controller registration and event handling
pkg/controller/certificate-shim/sync.go	Extends buildCertificates, validateIngressLike, and secretNameUsedIn to support XListenerSet
pkg/controller/certificate-shim/helper.go	Adds translateXListenerToGWAPIV1Listener helper for validation
pkg/controller/context.go	Adds validation to ensure experimental Gateway API CRDs are installed when feature is enabled
cmd/controller/app/controller.go	Wires EnableGatewayAPIXListenerSets config option into controller context
cmd/controller/app/options/options.go	Adds --enable-gateway-api-xlistenersets command-line flag and enables controller conditionally
deploy/charts/cert-manager/templates/rbac.yaml	Adds RBAC permissions for XListenerSet resources
test/e2e/util/util.go	Adds NewListenerSet test helper function
test/e2e/suite/conformance/certificates/tests.go	Adds E2E test for XListenerSet certificate creation with annotations
make/e2e.sh	Enables XListenerSets feature gate in E2E tests
make/e2e-setup.mk	Adds XListenerSets to feature gates and controller extraArgs for E2E setup

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

test/e2e/suite/conformance/certificates/tests.go

pkg/controller/certificate-shim/listenerset/controller.go

pkg/controller/certificate-shim/listenerset/controller_test.go

pkg/controller/certificate-shim/listenerset/controller.go

pkg/controller/context.go

pkg/apis/config/controller/v1alpha1/types.go

pkg/controller/certificate-shim/listenerset/controller_test.go

Signed-off-by: Hemant Joshi <mail@hjoshi.me> Signed-off-by: hjoshi123 <mail@hjoshi.me> Signed-off-by: Hemant Joshi <mail@hjoshi.me>

cmd/controller/app/options/options.go

maelvls · 2026-01-29T15:09:21Z

I was able to manually test the PR using kgateway. I haven't tested the ACME integration with XListenerSet yet, though.

I found that it is not possible to have 0 listener on the Gateway resource as discussed in kubernetes-sigs/gateway-api#4425, so I had to keep a dummy listener.

I spent hours figuring out why I was getting "connection refused" from Envoy: turns out the HTTPRoute's conditions were telling me that the service wasn't found... which wasn't obvious as no error was showing with kubectl get httproute. I've hit lots of weird UX problems related to conditions and what's shown by kubectl get... I've compiled a list in https://hackmd.io/@maelvls/kgateway-rough-edges.

Also, I had to upgrade kgateway to v2.2.0-rc2 as v2.1.2 doesn't have arm64 images as detailed in #8426.

Details

make make kind-cluster e2e-setup-gatewayapi e2e-setup-gwapi-provider e2e-setup-certmanager e2e-setup-bind

Then, apply this:

kind: Gateway
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: example-gw
  namespace: kgateway-system
  labels:
    app: example
spec:
  gatewayClassName: kgateway
  infrastructure:
    parametersRef:
      name: custom-gw-params
      kind: GatewayParameters
      group: gateway.kgateway.dev
  allowedListeners:
    namespaces:
      from: All
  listeners:
    - name: dummy
      hostname: dummy.example.com
      protocol: HTTP
      port: 12345
---
kind: XListenerSet
apiVersion: gateway.networking.x-k8s.io/v1alpha1
metadata:
  name: example-xls
  labels:
    app: example
  annotations:
    cert-manager.io/cluster-issuer: caissuer
spec:
  parentRef:
    name: example-gw
    namespace: kgateway-system
  listeners:
    - hostname: whoami.gateway.http01.example.com
      name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - name: example
      allowedRoutes:
        namespaces:
          from: All
---
kind: HTTPRoute
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: example-route
  labels:
    app: example
spec:
  parentRefs:
    - name: example-xls
      kind: XListenerSet
      group: gateway.networking.x-k8s.io
  hostnames:
    - whoami.gateway.http01.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: example
          port: 80
---
kind: Pod
apiVersion: v1
metadata:
  name: example
  labels:
    app: example
spec:
  containers:
    - name: example
      image: traefik/whoami
      ports:
        - name: http
          containerPort: 80
      resources:
        limits:
          cpu: 100m
          memory: 64Mi
        requests:
          cpu: 100m
          memory: 64Mi
---
apiVersion: v1
kind: Service
metadata:
  name: example
  labels:
    app: example
spec:
  ports:
    - name: http
      protocol: TCP
      port: 80
  selector:
    app: example
---
kind: ClusterIssuer
apiVersion: cert-manager.io/v1
metadata:
  name: caissuer
  labels:
    app: example
spec:
  ca:
    secretName: ca-key-pair
---
kind: ClusterIssuer
apiVersion: cert-manager.io/v1
metadata:
  name: selfsigned-issuer
  labels:
    app: example
spec:
  selfSigned: {}
---
kind: Certificate
apiVersion: cert-manager.io/v1
metadata:
  name: ca-key-pair
  namespace: cert-manager
  labels:
    app: example
spec:
  isCA: true
  commonName: my-ca
  secretName: ca-key-pair
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer

It worked:

$ k get -A -l app=example all,gateway-api,cert-manager                            
NAMESPACE   NAME          READY   STATUS    RESTARTS   AGE
default     pod/example   1/1     Running   0          25m

NAMESPACE   NAME              TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
default     service/example   ClusterIP   10.0.252.22   <none>        80/TCP    25m

NAMESPACE         NAME                                           CLASS      ADDRESS   PROGRAMMED   AGE
kgateway-system   gateway.gateway.networking.k8s.io/example-gw   kgateway             True         3m34s

NAMESPACE   NAME                                                HOSTNAMES                               AGE
default     httproute.gateway.networking.k8s.io/example-route   ["whoami.gateway.http01.example.com"]   3m34s

NAMESPACE   NAME                                                  ACCEPTED   PROGRAMMED   AGE
default     xlistenerset.gateway.networking.x-k8s.io/example-ls   True       True         3m34s

NAMESPACE      NAME                                      READY   SECRET        AGE
cert-manager   certificate.cert-manager.io/ca-key-pair   True    ca-key-pair   25m

NAMESPACE   NAME                                              READY   AGE
            clusterissuer.cert-manager.io/caissuer            True    25m
            clusterissuer.cert-manager.io/selfsigned-issuer   True    25m

and run:

$ k run dummy -it --rm --restart=Never -q --image=nicolaka/netshoot -- curl -sS --fail-with-body -k https://whoami.gateway.http01.example.com
Hostname: example
IP: 127.0.0.1
IP: ::1
IP: 10.244.0.27
IP: fe80::b808:81ff:fe6b:5ec3
RemoteAddr: 10.244.0.28:54646
GET / HTTP/1.1
Host: whoami.gateway.http01.example.com
User-Agent: curl/8.18.0
Accept: */*
X-Envoy-Expected-Rq-Timeout-Ms: 15000
X-Envoy-External-Address: 10.244.0.29
X-Forwarded-For: 10.244.0.29
X-Forwarded-Proto: https
X-Request-Id: abd94ebe-38f3-40b0-9b18-e36c222796bd

maelvls · 2026-01-29T18:08:42Z

/lgtm
/approve

cert-manager-prow · 2026-01-29T18:08:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maelvls

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [maelvls]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…#4581) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager/cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4581 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4582 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

maelvls added the ok-to-test label Jan 10, 2026

hjoshi123 force-pushed the feat/xlistenerset-implementation branch from e44ddd1 to 8d0afca Compare January 10, 2026 18:14