Promoting XListenerSet to ListenerSet by hjoshi123 · Pull Request #8501 · cert-manager/cert-manager

hjoshi123 · 2026-02-10T23:27:16Z

Pull Request Motivation

GatewayAPI plans to promote XListenerSet to ListenerSet as part of v1.5. We would like to do this promotion on our end so that the shift when 1.5 is out is pretty easy. Currently we use release 1.5 RC (v1.5.0-0.rc1)

Kind

Release Note

promoting xlistenerset feature gate to listenerset

Copilot

Pull request overview

This PR updates cert-manager’s Gateway API integration to use the promoted ListenerSet (v1) API instead of the experimental XListenerSet (apisx/v1alpha1), aligning with upcoming Gateway API v1.5 changes and simplifying future upgrades.

Changes:

Migrate certificate-shim ListenerSet controller and e2e tests from XListenerSet (apisx) to ListenerSet (gateway.networking.k8s.io/v1).
Rename related feature gate/config/flags from XListenerSets / enable-gateway-api-xlistenerset to ListenerSets / enable-gateway-api-listenerset.
Update Gateway API dependency and regenerate generated artifacts (OpenAPI) accordingly.

Reviewed changes

Copilot reviewed 24 out of 33 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
test/integration/go.sum	Module checksum updates for Gateway API + indirect deps.
test/integration/go.mod	Bump Gateway API/k8s.io/utils and indirect deps for integration tests.
test/e2e/util/util.go	Switch helper constructors from `XListenerSet` types to `ListenerSet` v1.
test/e2e/suite/conformance/certificates/tests.go	Use `ListenerSets` feature gate + v1 client for ListenerSet creation.
test/e2e/go.sum	Module checksum updates for e2e module.
test/e2e/go.mod	Bump Gateway API/k8s.io/utils and indirect deps for e2e module.
pkg/controller/context.go	Update client/CRD availability checks for ListenerSet CRD under new gate/flag.
pkg/controller/certificate-shim/sync.go	Treat `ListenerSet` as an ingress-like source for cert issuance logic.
pkg/controller/certificate-shim/listenerset/controller_test.go	Update controller tests to create/listen for `ListenerSet` resources.
pkg/controller/certificate-shim/listenerset/controller.go	Update listers/informers to `GatewayV1().ListenerSets()` and v1 types.
pkg/controller/certificate-shim/helper.go	Adjust listener translation helper to use v1 `ListenerEntry`.
pkg/apis/config/controller/v1alpha1/zz_generated.deepcopy.go	Regenerate deepcopy for renamed config field.
pkg/apis/config/controller/v1alpha1/types.go	Rename controller config field to `EnableGatewayAPIListenerSet`.
make/e2e.sh	Update default feature gates to `ListenerSets=true`.
make/e2e-setup.mk	Update feature gate plumbing and controller args to listenerset naming.
internal/generated/openapi/zz_generated.openapi.go	Regenerated OpenAPI to include ListenerSet and related schemas.
internal/controller/feature/features.go	Rename feature gate key to `ListenerSets`.
internal/apis/config/controller/v1alpha1/zz_generated.conversion.go	Update conversions for renamed config field.
internal/apis/config/controller/types.go	Rename internal config field to `EnableGatewayAPIListenerSet`.
go.sum	Root module checksum updates (Gateway API, k8s.io/utils, testing libs, etc.).
go.mod	Root module bumps for Gateway API + related deps.
cmd/webhook/go.sum	Webhook module checksum updates for aligned deps.
cmd/webhook/go.mod	Webhook module bumps (indirect Gateway API/k8s.io/utils, etc.).
cmd/startupapicheck/go.sum	Startup API check module checksum updates.
cmd/startupapicheck/go.mod	Startup API check module bumps for aligned deps.
cmd/controller/go.sum	Controller module checksum updates.
cmd/controller/go.mod	Controller module bumps for aligned deps.
cmd/controller/app/options/options.go	Rename CLI flag to `--enable-gateway-api-listenerset` and wire new config field.
cmd/controller/app/controller.go	Wire new `EnableGatewayAPIListenerSet` option into controller context factory.
cmd/cainjector/go.sum	CA injector module checksum updates.
cmd/cainjector/go.mod	CA injector module bumps for aligned deps.
cmd/acmesolver/go.sum	ACME solver module checksum updates.
cmd/acmesolver/go.mod	ACME solver module bumps for aligned deps.

Comments suppressed due to low confidence (4)

pkg/controller/certificate-shim/listenerset/controller.go:208

The certificate event handler still filters on controllerRef.Kind == "XListenerSet". With the migration to Gateway API v1 ListenerSet, Certificates created/owned by a ListenerSet will have Kind "ListenerSet", so this handler will stop re-queuing ListenerSets on Certificate changes. Update the kind check (and ideally the handler name) to use "ListenerSet".

func xListenerSetCertificateHandler(queue workqueue.TypedRateLimitingInterface[types.NamespacedName]) func(crt *cmapi.Certificate) {
	return func(crt *cmapi.Certificate) {
		ref := metav1.GetControllerOf(crt)
		if ref == nil {
			// No controller should care about orphans being deleted or
			// updated.
			return
		}

		if ref.Kind != "XListenerSet" {
			return
		}

pkg/controller/certificate-shim/listenerset/controller.go:86

Several comments/error strings in this controller still refer to "xlistenerset"/"XListenerSet" (indexer setup and error messages). Since the controller now exclusively handles ListenerSet, please update these strings to avoid confusion in logs and future maintenance.

	xlsInf := ctx.GWShared.Gateway().V1().ListenerSets().Informer()

	// Adding an indexer for easier queries on xlistenerset
	if err := xlsInf.AddIndexers(cache.Indexers{
		indexByParentGateway: func(obj any) ([]string, error) {
			xls, ok := obj.(*gwapi.ListenerSet)
			if !ok {
				return nil, nil
			}

			ns := xls.GetNamespace()
			if xls.Spec.ParentRef.Namespace != nil && string(*xls.Spec.ParentRef.Namespace) != "" {
				ns = string(*xls.Spec.ParentRef.Namespace)
			}
			if xls.Spec.ParentRef.Name == "" {
				return nil, nil
			}

			return []string{fmt.Sprintf("%s/%s", ns, xls.Spec.ParentRef.Name)}, nil
		},
	}); err != nil {
		return nil, nil, fmt.Errorf("error adding indexer for xlistenerset %v", err)
	}

	if _, err := xlsInf.AddEventHandler(controllerpkg.QueuingEventHandler(c.queue)); err != nil {
		return nil, nil, fmt.Errorf("error setting up event handler for xlistenerset %v", err)
	}

pkg/controller/certificate-shim/sync.go:211

The panic message in validateIngressLike is now outdated: the switch handles *gwapi.ListenerSet, but the panic still says it expects only Ingress or Gateway. Please update the message so it matches the supported types (Ingress/Gateway/ListenerSet).

func validateIngressLike(ingLike metav1.Object) field.ErrorList {
	switch o := ingLike.(type) {
	case *networkingv1.Ingress:
		return checkForDuplicateSecretNames(field.NewPath("spec", "tls"), o.Spec.TLS)
	case *gwapi.Gateway:
		return nil
	case *gwapi.ListenerSet:
		return nil
	default:
		panic(fmt.Errorf("programmer mistake: validateIngressLike can't handle %T, expected Ingress or Gateway", ingLike))
	}

pkg/controller/certificate-shim/helper.go:317

The function name and comment still refer to an "experimental XListener" conversion, but the parameter type is now gwapi.ListenerEntry (ListenerSet v1). Renaming this helper (and its call sites) to reflect ListenerEntry/ListenerSet will reduce confusion as the XListenerSet API is removed.

// translateXListenerToGWAPIV1Listener converts the experimental listener to v1 gateway listener.
// Both listeners have the same fields for now but due to being in different versions,
// we need to convert them for having a unified validation. If these types diverge, then this function
// would need to account for that.
func translateXListenerToGWAPIV1Listener(l gwapi.ListenerEntry) gwapi.Listener {
	return gwapi.Listener{
		Hostname:      l.Hostname,
		Port:          gwapi.PortNumber(l.Port),
		Protocol:      l.Protocol,
		TLS:           l.TLS,
		Name:          l.Name,
		AllowedRoutes: l.AllowedRoutes,
	}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

internal/controller/feature/features.go

pkg/apis/config/controller/v1alpha1/types.go

pkg/controller/certificate-shim/listenerset/controller_test.go

cmd/controller/app/options/options.go

pkg/controller/context.go

pkg/controller/certificate-shim/listenerset/controller_test.go

ThatsMrTalbot · 2026-02-11T01:30:16Z

Should we be replacing xlistenersets, or should we be supporting both?

hjoshi123 · 2026-02-11T04:36:53Z

@ThatsMrTalbot that's one of the questions I wanted to post 😅
I think supporting both is kinda not so trivial here since we would have to maintain two versions of gateway API.. because the release 1.5 removed it from apisx altogether. But if people are actually consuming it then it might be worth it.

Signed-off-by: Hemant Joshi <mail@hjoshi.me>

Copilot

Pull request overview

Copilot reviewed 25 out of 34 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/controller/certificate-shim/listenerset/controller_test.go

erikgb

Thanks for moving this forward @hjoshi123! A few minor nits, but in general this LGTM.

pkg/controller/certificate-shim/sync.go

hjoshi123 · 2026-02-14T16:20:14Z

@erikgb thank you for reviewing it quickly.. do you think this looks good?

erikgb · 2026-02-14T17:25:21Z

Do you think this looks good?

@hjoshi123, I think it looks good, even if your IDE appears to introduce some unrelated changes. 😅

Copilot

Pull request overview

Copilot reviewed 25 out of 34 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (2)

pkg/controller/certificate-shim/sync.go:210

The panic message in validateIngressLike still says it only expects Ingress or Gateway, but the function now explicitly supports *gwapi.ListenerSet too. Please update the message to include ListenerSet so debugging unexpected types is accurate.

	case *gwapi.ListenerSet:
		return nil
	default:
		panic(fmt.Errorf("programmer mistake: validateIngressLike can't handle %T, expected Ingress or Gateway", ingLike))
	}

pkg/controller/certificate-shim/listenerset/controller.go:208

The certificate event handler is still filtering on controllerRef.Kind == "XListenerSet". After switching to GatewayV1 ListenerSet, Certificates created by the shim will have Kind "ListenerSet", so this handler will never enqueue and updates/deletes to Certificates won’t trigger ListenerSet reconciliation. Update the Kind check (and consider temporarily accepting both kinds for upgrade compatibility).

func xListenerSetCertificateHandler(queue workqueue.TypedRateLimitingInterface[types.NamespacedName]) func(crt *cmapi.Certificate) {
	return func(crt *cmapi.Certificate) {
		ref := metav1.GetControllerOf(crt)
		if ref == nil {
			// No controller should care about orphans being deleted or
			// updated.
			return
		}

		if ref.Kind != "XListenerSet" {
			return
		}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/controller/certificate-shim/listenerset/controller.go

pkg/controller/certificate-shim/helper.go

Copilot · 2026-02-14T17:31:46Z

test/e2e/suite/conformance/certificates/tests.go

 		s.it(f, "Creating a ListenerSet with annotations for issuer ref and other related fields", func(ctx context.Context, ir cmmeta.IssuerReference) {
+			// TODO: @hjoshi123 No gwapi provider supports ListenerSet yet. Remove this once we upgrade to something that does support it.
+			if s.HTTP01TestType != "ListenerSet" {
+				Skip("skipping test as there is no gwapi provider with LS support")
+				return
+			}


This test is gated on s.HTTP01TestType == "ListenerSet", but the certificates Suite currently only sets HTTP01TestType to "Ingress" or "Gateway" (see test/e2e/suite/conformance/certificates/acme/acme.go and suite.go). As written, this test will always be skipped and never exercised. Consider gating on an existing mode (e.g., "Gateway") plus a provider capability flag, or add a Suite variant that sets HTTP01TestType to "ListenerSet" when supported.

Good catch! This looks like a bug in the test gate, @hjoshi123. WDYT?

I added that check because that would allow the LS tests to skip.. we can remove them once we have the support.. when we do have the support I think we can add a ListenerSet suite as copilot is saying

But we cannot disable other gateway-api e2e-tests. Only the ones that require ListenerSet should be disabled. If we have to disable ALL gateway-api e2e-tests, I am not in favor of this PR.

No it is not disabling all gateway api tests.. the check is inside the listener set's tests.. so other gateway suites should run fine
https://storage.googleapis.com/cert-manager-prow-artifacts/pr-logs/pull/cert-manager_cert-manager/8501/pull-cert-manager-master-e2e-v1-35/2022703521786236928/build-log.txt
Double checked here to confirm that Gateway tests are running

pkg/controller/certificate-shim/listenerset/controller.go

pkg/controller/certificate-shim/sync.go

Copilot

Pull request overview

Copilot reviewed 25 out of 34 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/controller/certificate-shim/listenerset/controller.go

pkg/controller/certificate-shim/helper.go

Signed-off-by: Hemant Joshi <mail@hjoshi.me>

hjoshi123 · 2026-02-16T04:45:42Z

/cc @maelvls for visibility regarding this upgrade path

cert-manager-prow · 2026-02-16T04:45:46Z

@hjoshi123: GitHub didn't allow me to request PR reviews from the following users: upgrade, path, for, visibility, regarding, this.

Note that only cert-manager members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

/cc @maelvls for visibility regarding this upgrade path

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

erikgb · 2026-02-16T05:41:29Z

/cc @maelvls

maelvls · 2026-02-16T11:47:09Z

Upgrade path

The upgrade path proposed in your PR makes sense. This Slack thread explains that implementations should do a clear-cut migration to the standard ListenerSet CRD (i.e., without supporting both X and standard CRDs). If we had wanted to offer a clean upgrade path, we would have had to let Rob and team know, and since we haven't, we will go ahead and do it "clear cut". 😅

To summarize, the tens of people who tried the XListenerSet certificate-shim and HTTP-01 solver in v1.20.0-alpha.1 will have to be aware of four changes:

The flag --enable-gateway-api-xlistenerset disappears and is replaced with --enable-gateway-api-listenerset,
The config field enableGatewayAPIXListenerSet disappears and is replaced with enableGatewayAPIListenerSet,
The feature gate --feature-gates=EnableGatewayAPIXListenerSet=true disappears and is replaced with --feature-gates=EnableGatewayAPIListenerSet=true,
cert-manager no longers reconciles XListenerSet resources.

I'm OK with this plan, and the PR LGTM.

hjoshi123 · 2026-02-16T14:33:25Z

Upgrade path

The upgrade path propose with this PR makes sense. This Slack thread explains that implementations should do a clear-cut migration to the standard ListenerSet CRD (i.e., without supporting both X and standard CRDs). If we had wanted to offer a clean upgrade path, we would have had to let Rob and team know...

To summarize, the tens of people who tried the XListenerSet certificate-shim and HTTP-01 solver in v1.20.0-alpha.1 will have to be aware of four changes:

The flag --enable-gateway-api-xlistenerset disappears and is replaced with --enable-gateway-api-listenerset,

The config field enableGatewayAPIXListenerSet disappears and is replaced with enableGatewayAPIListenerSet,

The feature gate --feature-gates=EnableGatewayAPIXListenerSet=true disappears and is replaced with --feature-gates=EnableGatewayAPIListenerSet=true,

cert-manager no longers reconciles XListenerSet resources.

I'm OK with this plan, and the PR LGTM.

That's a really good summary of changes.. thank you @maelvls :).. I think one thing we probably need to put in the next release is that we had to disable e2e tests for LS as there are no implementations of LS yet.

maelvls · 2026-02-16T19:18:11Z

/lgtm
/approve

cert-manager-prow · 2026-02-16T19:18:19Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maelvls

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [maelvls]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

hjoshi123 · 2026-02-16T19:53:45Z

/test pull-cert-manager-master-e2e-v1-35

…#4581) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager/cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4581 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4582 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

erikgb requested a review from Copilot February 10, 2026 23:33

Copilot started reviewing on behalf of erikgb February 10, 2026 23:34 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

cert-manager-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 11, 2026

hjoshi123 force-pushed the feat/xlistenerset-listenerset-promotion branch from b2ed6f6 to d49a518 Compare February 11, 2026 18:49

cert-manager-prow bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 11, 2026

hjoshi123 force-pushed the feat/xlistenerset-listenerset-promotion branch from d49a518 to ac2dd0e Compare February 11, 2026 20:28

hjoshi123 changed the title ~~promoting XListenerSet to ListenerSet~~ Promoting XListenerSet to ListenerSet Feb 11, 2026

changing XLS to LS

1366aaf

Signed-off-by: Hemant Joshi <mail@hjoshi.me>

hjoshi123 force-pushed the feat/xlistenerset-listenerset-promotion branch 2 times, most recently from fd633ec to e70c8d8 Compare February 14, 2026 04:10

erikgb requested a review from Copilot February 14, 2026 09:56

Copilot started reviewing on behalf of erikgb February 14, 2026 09:56 View session

Copilot AI reviewed Feb 14, 2026

View reviewed changes

pkg/controller/certificate-shim/listenerset/controller_test.go Outdated Show resolved Hide resolved

pkg/controller/certificate-shim/listenerset/controller_test.go Outdated Show resolved Hide resolved

erikgb reviewed Feb 14, 2026

View reviewed changes

pkg/controller/certificate-shim/sync.go Outdated Show resolved Hide resolved

hjoshi123 force-pushed the feat/xlistenerset-listenerset-promotion branch from e70c8d8 to c7f4805 Compare February 14, 2026 16:04

hjoshi123 requested a review from erikgb February 14, 2026 16:20

erikgb requested a review from Copilot February 14, 2026 17:24

Copilot started reviewing on behalf of erikgb February 14, 2026 17:24 View session

Copilot AI reviewed Feb 14, 2026

View reviewed changes

erikgb reviewed Feb 14, 2026

View reviewed changes

pkg/controller/certificate-shim/listenerset/controller.go Outdated Show resolved Hide resolved

erikgb reviewed Feb 14, 2026

View reviewed changes

pkg/controller/certificate-shim/sync.go Outdated Show resolved Hide resolved

hjoshi123 force-pushed the feat/xlistenerset-listenerset-promotion branch from c7f4805 to 68683af Compare February 14, 2026 18:03

hjoshi123 requested a review from Copilot February 14, 2026 18:04

Copilot started reviewing on behalf of hjoshi123 February 14, 2026 18:04 View session

Copilot AI reviewed Feb 14, 2026

View reviewed changes

pkg/controller/certificate-shim/listenerset/controller.go Show resolved Hide resolved

pkg/controller/certificate-shim/helper.go Outdated Show resolved Hide resolved

disabling e2e tests for listenerset

44affc0

Signed-off-by: Hemant Joshi <mail@hjoshi.me>

hjoshi123 force-pushed the feat/xlistenerset-listenerset-promotion branch from 68683af to 44affc0 Compare February 14, 2026 18:21

hjoshi123 requested a review from erikgb February 14, 2026 20:23

cert-manager-prow bot requested a review from maelvls February 16, 2026 04:45

cert-manager-prow bot added the lgtm Indicates that a PR is ready to be merged. label Feb 16, 2026

cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 16, 2026

cert-manager-prow bot merged commit 5c0d4d2 into cert-manager:master Feb 16, 2026
6 checks passed

maelvls added this to the 1.20 milestone Feb 17, 2026

This was referenced Feb 17, 2026

Implement XListenerSet #8252

Closed

Re-enable the ListenerSet e2e tests #8536

Open

maelvls added kind/feature Categorizes issue or PR as related to a new feature. and removed kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. labels Mar 10, 2026

github-actions bot mentioned this pull request Mar 30, 2026

Update Helm release cert-manager to v1.20.0 claytono/infra#1873

Merged

1 task

Conversation

hjoshi123 commented Feb 10, 2026 • edited by maelvls Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Motivation

Kind

Release Note

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ThatsMrTalbot commented Feb 11, 2026

Uh oh!

hjoshi123 commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

erikgb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hjoshi123 commented Feb 14, 2026

Uh oh!

erikgb commented Feb 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 14, 2026

Choose a reason for hiding this comment

Uh oh!

erikgb Feb 14, 2026

Choose a reason for hiding this comment

Uh oh!

hjoshi123 Feb 14, 2026

Choose a reason for hiding this comment

Uh oh!

erikgb Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hjoshi123 Feb 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

hjoshi123 commented Feb 16, 2026

Uh oh!

cert-manager-prow bot commented Feb 16, 2026

Uh oh!

erikgb commented Feb 16, 2026

Uh oh!

maelvls commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hjoshi123 commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maelvls commented Feb 16, 2026

hjoshi123 commented Feb 10, 2026 •

edited by maelvls

Loading

hjoshi123 commented Feb 11, 2026 •

edited

Loading

erikgb Feb 14, 2026 •

edited

Loading

maelvls commented Feb 16, 2026 •

edited

Loading

hjoshi123 commented Feb 16, 2026 •

edited

Loading