feat(acme/http01): adding overrides for parentRef by hjoshi123 · Pull Request #8518 · cert-manager/cert-manager

hjoshi123 · 2026-02-17T05:24:48Z

Pull Request Motivation

This PR handles two bugs that came up recently. One was related to how we handle parentRef for the newly released ListenerSet and the other bug is about handling multiple parentRefs required in the clusterIssuer #7890. The solution to this was proposed in our last weekly meeting on 02/12/2026. This diagram also represents the solution in brief.

Kind

/kind feature

Release Note

added `parentRef` override annotations on the Certificate resource.

hjoshi123 · 2026-02-17T05:25:11Z

/hold

Trying to add tests to this PR

maelvls · 2026-02-17T10:03:22Z

Let's cut our first beta once this out. How can I help?

pkg/apis/acme/v1/types.go

maelvls · 2026-02-17T15:17:13Z

pkg/controller/acmeorders/util.go

+	if hasParentRefName || hasParentRefNamespace || hasParentRefKind {
+		return fmt.Errorf("cannot specify only one of parentRefName, parentRefKind, parentRefNamespace override annotations")
+	}


Copy-paste issue? Looks like the ingress logic 😅

I do feel we need this check (obviously without the namespace stuff).. because what happens if someone only adds the kind annotation and forgets the name annotation

Agreed, we should catch the case where name was given but kind wasn't (and vice-versa), good point.

hjoshi123 · 2026-02-18T23:03:52Z

/unhold

maelvls · 2026-02-19T11:44:38Z

I built an image+helm chart out of your branch, it seems the requirement on the parentRefs in validation/issuer.go#L242-L244 needs to be relaxed:

admission webhook "webhook.cert-manager.io" denied the request: spec.acme.solvers[0].http01.gateway.parentRefs: Required value: at least 1 parentRef is required

Reproduce

Here is how I'm pushing the helm chart and image:

make ko-images-push KO_PLATFORM=linux/amd64,linux/arm64 KO_REGISTRY=ttl.sh/maelvls VERSION=v1.20.0-test.0
$ yq -i '.imageRegistry = "ttl.sh" | .imageNamespace = "maelvls" | (..| select(key=="pullPolicy")) = "Always"' deploy/charts/cert-manager/values.yaml
make helm-chart _bin/cert-manager.tgz VERSION=v1.20.0-test.0
helm push _bin/cert-manager.tgz oci://ttl.sh/maelvls

helm upgrade --install cert-manager oci://ghcr.io/maelvls/cert-manager --version v1.20.0-ttw.0 \
  --namespace cert-manager \
  --set config.apiVersion="controller.config.cert-manager.io/v1alpha1" \
  --set config.kind="ControllerConfiguration" \
  --set config.enableGatewayAPI=true \
  --set config.enableGatewayAPIListenerSet=true \
  --set config.featureGates.ListenerSet=true \
  --set crds.enabled=true \
  --set crds.keep=false

This fails:

kubectl apply -f- <<EOF
kind: ClusterIssuer
apiVersion: cert-manager.io/v1
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: mael.valais@cyberak.com
    privateKeySecretRef:
      name: letsencrypt-acc-key
    solvers:
      - http01:
          gatewayHTTPRoute: {}
EOF

cert-manager's RBAC might need adjusting, too:

E0219 13:23:56.296175 1 reflector.go:204] "Failed to watch" err="failed to list *v1.ListenerSet: listenersets.gateway.networking.k8s.io is forbidden: User "system:serviceaccount:cert-manager:cert-manager" cannot list resource "listenersets" in API group "gateway.networking.k8s.io" at the cluster scope" logger="UnhandledError" reflector="k8s.io/client-go@v0.35.1/tools/cache/reflector.go:289" type="*v1.ListenerSet"

hjoshi123 · 2026-02-19T18:07:22Z

@maelvls I think I fixed the issue now with validation and RBAC.. I forgot to update the RBAC from xlistenersets to listenersets due to the case sensitivity of XListenerSets vs xlistenersets 😅 but we should be good now

maelvls · 2026-02-19T20:11:25Z

I've just tested and it all works! Took me forever to get it end-to-end. I've used envoygateway's 1.5 branch. For anyone willing to this branch out, I've written a tutorial: https://hackmd.io/@maelvls/test-xlistenerset. Helm chart:

helm upgrade --install cert-manager oci://ghcr.io/maelvls/cert-manager --version v1.20.0-dev.0

maelvls · 2026-02-19T20:23:29Z

pkg/controller/acmeorders/util_test.go

+							ParentRefs: []gwapi.ParentReference{
+								{
+									Kind:      (*gwapi.Kind)(ptr.To("ListenerSet")),
+									Name:      gwapi.ObjectName("test-parent-ref-name"),
+									Namespace: (*gwapi.Namespace)(ptr.To("")),
+								},


What happens if someone also sets parentRefs on the issuer/clusterissuer? Are they replaced with this? meaning that the clusterissuer/issuer's parentRefs is now ineffective? (fine by me, just wanted to be sure)

The way it is it will append to the existing parentRefs right now.. we could do a replace if you think that's a better approach

Would be great to have more coverage on these scenarii; I've written some test cases in case it can help: maelvls@d6c2421

In particular, the test case:

no annotations and no parentRefs on issuer

isn't clear to me: is it possible to create a valid HTTPRoute with 0 parentRef? If not, it should error out.

Yup.. I can take a look at it and add them back

The no annotation and no parentRef is I think left for us to decide because technically on the API parentRefs is marked as optional so I think it depends on the implementation if they should throw an error. To be clear, the httpRoute would be invalid but the resource itself would be admitted at least from the API spec.

I think given me removed the requirement from the issuer side, after checking for annotation if the number of parentRef is 0 we should return an error.. wdyt?

@maelvls thank you for the tests :).. I modified them a bit and also added validation when parentRefs are not present after we process the annotations. The only caveat being that this validation now happens on the orders controller and not during the admission which I guess is fair because we cant control the workflow during admission of issuer.

deploy/charts/cert-manager/templates/rbac.yaml

Signed-off-by: Hemant Joshi <mail@hjoshi.me>

maelvls · 2026-02-21T19:31:20Z

Hey. I'll run the e2e with envoygateway. If it works, I'd be happy to merge this!

maelvls · 2026-02-22T15:07:41Z

I managed to make the e2es pass using envoygateway! I'll opena PR to fix the e2es.

/lgtm
/approve

Here is an edited version of the diagram that I showed to a colleague in case that can help:

(Excalidraw link)

cert-manager-prow · 2026-02-22T15:08:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maelvls

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [maelvls]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…#4581) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager/cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4581 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.19.4` → `v1.20.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.20.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.0) [Compare Source](cert-manager/cert-manager@v1.19.4...v1.20.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.0 adds support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta. #### Changes by Kind ##### Feature - Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#8370](cert-manager/cert-manager#8370), [@jcpunk](https://github.com/jcpunk)) - Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#8256](cert-manager/cert-manager#8256), [@tareksha](https://github.com/tareksha)) - Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#8186](cert-manager/cert-manager#8186), [@mathieu-clnk](https://github.com/mathieu-clnk)) - Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#8355](cert-manager/cert-manager#8355), [@dancmeyers](https://github.com/dancmeyers)) - Added `parentRef` override annotations on the Certificate resource. ([#8518](cert-manager/cert-manager#8518), [@hjoshi123](https://github.com/hjoshi123)) - Added support for azure private zones for dns01 issuer. ([#8494](cert-manager/cert-manager#8494), [@hjoshi123](https://github.com/hjoshi123)) - Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#7642](cert-manager/cert-manager#7642), [@robertlestak](https://github.com/robertlestak)) - Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#7728](cert-manager/cert-manager#7728), [@jcpunk](https://github.com/jcpunk)) - For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#8301](cert-manager/cert-manager#8301), [@k0da](https://github.com/k0da)) - Improve error message when CA issuers are misconfigured to use a clashing secret name ([#8374](cert-manager/cert-manager#8374), [@majiayu000](https://github.com/majiayu000)) - Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#8244](cert-manager/cert-manager#8244), [@lunarwhite](https://github.com/lunarwhite)) - Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#8195](cert-manager/cert-manager#8195), [@StingRayZA](https://github.com/StingRayZA)) - Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#8228](cert-manager/cert-manager#8228), [@terinjokes](https://github.com/terinjokes)) - Added experimental `XListenerSet` feature gate ([#8394](cert-manager/cert-manager#8394), [@hjoshi123](https://github.com/hjoshi123)) ##### Documentation - Add GWAPI documentation to NOTES.TXT in helm chart ([#8353](cert-manager/cert-manager#8353), [@jaxels10](https://github.com/jaxels10)) ##### Bug or Regression - Adds logs for cases when acme server returns us a fatal error in the order controller ([#8199](cert-manager/cert-manager#8199), [@Peac36](https://github.com/Peac36)) - Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#8160](cert-manager/cert-manager#8160), [@inteon](https://github.com/inteon)) - Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#8232](cert-manager/cert-manager#8232), [@eleanor-merry](https://github.com/eleanor-merry)) - Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#8456](cert-manager/cert-manager#8456), [@tkna](https://github.com/tkna)) - Fix unregulated retries with the DigitalOcean DNS-01 solver Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#8221](cert-manager/cert-manager#8221), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#8403](cert-manager/cert-manager#8403), [@calm329](https://github.com/calm329)) - Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#8424](cert-manager/cert-manager#8424), [@SlashNephy](https://github.com/SlashNephy)) - Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#8443](cert-manager/cert-manager#8443), [@alviss7](https://github.com/alviss7)) - Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#8173](cert-manager/cert-manager#8173), [@erikgb](https://github.com/erikgb)) - Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#8469](cert-manager/cert-manager#8469), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#8290](cert-manager/cert-manager#8290), [@octo-sts](https://github.com/octo-sts)\[bot]) - When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#8162](cert-manager/cert-manager#8162), [@LiquidPL](https://github.com/LiquidPL)) ##### Other (Cleanup or Flake) - Promoted the OtherNames feature to Beta and enabled it by default ([#8288](cert-manager/cert-manager#8288), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Promoting `xlistenerset` feature gate to `listenerset` ([#8501](cert-manager/cert-manager#8501), [@hjoshi123](https://github.com/hjoshi123)) - Rebranding of the Venafi Issuer to CyberArk ([#8215](cert-manager/cert-manager#8215), [@iossifbenbassat123](https://github.com/iossifbenbassat123)) - Switched to SSA for challenge finalizer updates ([#8519](cert-manager/cert-manager#8519), [@inteon](https://github.com/inteon)) - The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#8408](cert-manager/cert-manager#8408), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#8287](cert-manager/cert-manager#8287), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update cert-manager's ACME client, forked from golang/x/crypto ([#8268](cert-manager/cert-manager#8268), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#8389](cert-manager/cert-manager#8389), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#8426](cert-manager/cert-manager#8426), [@hjoshi123](https://github.com/hjoshi123)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4582 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

cert-manager-prow bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 17, 2026

maelvls added this to the 1.20 milestone Feb 17, 2026

maelvls reviewed Feb 17, 2026

View reviewed changes

pkg/apis/acme/v1/types.go Outdated Show resolved Hide resolved

maelvls reviewed Feb 17, 2026

View reviewed changes

maelvls mentioned this pull request Feb 17, 2026

Implement XListenerSet #8252

Closed

hjoshi123 force-pushed the feat/httproute-parentref-bug branch from 5fa448f to 7d05db5 Compare February 18, 2026 05:53

cert-manager-prow bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Feb 18, 2026

hjoshi123 force-pushed the feat/httproute-parentref-bug branch 3 times, most recently from 24a23eb to c6db335 Compare February 18, 2026 16:57

hjoshi123 requested a review from maelvls February 18, 2026 17:19

cert-manager-prow bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 18, 2026

hjoshi123 force-pushed the feat/httproute-parentref-bug branch from c6db335 to b7fd71f Compare February 19, 2026 18:06

cert-manager-prow bot added the area/deploy Indicates a PR modifies deployment configuration label Feb 19, 2026

maelvls reviewed Feb 19, 2026

View reviewed changes

hjoshi123 force-pushed the feat/httproute-parentref-bug branch from b7fd71f to 3958459 Compare February 19, 2026 20:25

cert-manager-prow bot added the area/testing Issues relating to testing label Feb 19, 2026

hjoshi123 force-pushed the feat/httproute-parentref-bug branch 2 times, most recently from bcd520f to a0a20a3 Compare February 20, 2026 04:11

maelvls reviewed Feb 20, 2026

View reviewed changes

deploy/charts/cert-manager/templates/rbac.yaml Outdated Show resolved Hide resolved

maelvls reviewed Feb 20, 2026

View reviewed changes

deploy/charts/cert-manager/templates/rbac.yaml Outdated Show resolved Hide resolved

adding overrides for parentRef

4ead253

Signed-off-by: Hemant Joshi <mail@hjoshi.me>

hjoshi123 force-pushed the feat/httproute-parentref-bug branch from a0a20a3 to 4ead253 Compare February 20, 2026 13:35

hjoshi123 requested a review from maelvls February 21, 2026 05:20

cert-manager-prow bot added the lgtm Indicates that a PR is ready to be merged. label Feb 22, 2026

cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 22, 2026

cert-manager-prow bot merged commit a2e947f into cert-manager:master Feb 22, 2026
6 checks passed

maelvls mentioned this pull request Mar 5, 2026

Cluster issuer for HTTP-01 gatewayHTTPRoute should not require a gateway parentRef #7890

Open

Conversation

hjoshi123 commented Feb 17, 2026

Pull Request Motivation

Kind

Release Note

Uh oh!

hjoshi123 commented Feb 17, 2026

Uh oh!

maelvls commented Feb 17, 2026

Uh oh!

Uh oh!

maelvls Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hjoshi123 Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

maelvls Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

hjoshi123 commented Feb 18, 2026

Uh oh!

maelvls commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hjoshi123 commented Feb 19, 2026

Uh oh!

maelvls commented Feb 19, 2026

Uh oh!

maelvls Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

hjoshi123 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

maelvls Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hjoshi123 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

hjoshi123 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

hjoshi123 Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

maelvls commented Feb 21, 2026

Uh oh!

maelvls commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cert-manager-prow bot commented Feb 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

maelvls Feb 17, 2026 •

edited

Loading

maelvls commented Feb 19, 2026 •

edited

Loading

maelvls Feb 19, 2026 •

edited

Loading

maelvls commented Feb 22, 2026 •

edited

Loading