feat(helm): update cert-manager ( v1.20.2 ➔ v1.21.1 ) - #804
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Contributor
Argo CD Diff PreviewSummary: Modified (4):
± apps (+1|-1)
± cert-manager (+397|-58)
± infra (+1|-1)
± n8n (+1|-1)apps (kubernetes/bootstrap/apps.yaml)Application: argocd/n8n server: https://kubernetes.default.svc
info:
- name: Chart
value: app-template@4.6.2
- name: Image
- value: ghcr.io/n8n-io/n8n:2.37.4@sha256:3ef785400f1a03361584e5533a2e3eb72de56311fd4dc996ac4031a7fdede8bc
+ value: ghcr.io/n8n-io/n8n:2.37.1@sha256:303088e67eb9b545253de11d7ad8a1074e781abe018565fe6fccb05278371178
project: default
source:
path: kubernetes/apps/n8n/
repoURL: https://github.com/mpeterson/homelab
targetRevision: maincert-manager (kubernetes/infra/cert-manager/app.yaml)Deployment: infra/cert-manager containers:
- args:
- --v=2
- --cluster-resource-namespace=$(POD_NAMESPACE)
- --leader-election-namespace=kube-system
- - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.20.2
+ - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.21.1
- --enable-gateway-api
- --dns01-recursive-nameservers-only
- --dns01-recursive-nameservers=1.1.1.1:53
- --max-concurrent-challenges=60
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- image: quay.io/jetstack/cert-manager-controller:v1.20.2
+ image: quay.io/jetstack/cert-manager-controller:v1.21.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 8
httpGet:
path: /livezDeployment: infra/cert-manager-cainjector env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- image: quay.io/jetstack/cert-manager-cainjector:v1.20.2
+ image: quay.io/jetstack/cert-manager-cainjector:v1.21.1
imagePullPolicy: IfNotPresent
name: cert-manager-cainjector
ports:
- containerPort: 9402
name: http-metricsDeployment: infra/cert-manager-webhook env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- image: quay.io/jetstack/cert-manager-webhook:v1.20.2
+ image: quay.io/jetstack/cert-manager-webhook:v1.21.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 3
httpGet:
path: /livezClusterRole: cert-manager-edit - update
- apiGroups:
- acme.cert-manager.io
resources:
- challenges
- - orders
verbs:
- - create
- delete
- deletecollection
- patch
- update
+- apiGroups:
+ - acme.cert-manager.io
+ resources:
+ - orders
+ verbs:
+ - delete
+ - deletecollectionRole: infra/cert-manager-tokenrequest-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
- labels:
- app: cert-manager
- app.kubernetes.io/component: controller
- app.kubernetes.io/instance: cert-manager
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: cert-manager
- app.kubernetes.io/version: v1.20.2
- helm.sh/chart: cert-manager-v1.20.2
- name: cert-manager-tokenrequest
- namespace: infra
-rules:
-- apiGroups:
- - ""
- resourceNames:
- - cert-manager
- resources:
- - serviceaccounts/token
- verbs:
- - createRoleBinding: infra/cert-manager-tokenrequest-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- labels:
- app: cert-manager
- app.kubernetes.io/component: controller
- app.kubernetes.io/instance: cert-manager
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: cert-manager
- app.kubernetes.io/version: v1.20.2
- helm.sh/chart: cert-manager-v1.20.2
- name: cert-manager-tokenrequest
- namespace: infra
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: cert-manager-tokenrequest
-subjects:
-- kind: ServiceAccount
- name: cert-manager
- namespace: infraService: infra/cert-manager+ helm.sh/chart: cert-manager-v1.21.1
name: cert-manager
namespace: infra
spec:
ports:
- - name: tcp-prometheus-servicemonitor
+ - name: http-metrics
port: 9402
protocol: TCP
- targetPort: http-metrics
selector:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/name: cert-manager
type: ClusterIPCustomResourceDefinition: certificates.cert-manager.io `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
(e.g., because of company policy). Please note that the security of the algorithm is not that important
in reality, because the unencrypted certificate and private key are also stored in the Secret.
+ `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026.
+ Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC.
+ The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256.
+ Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher,
+ or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements.
enum:
- LegacyRC2
- LegacyDES
- Modern2023
+ - Modern2026
type: string
required:
- create
type: object
type: object
@@ skipped 209 lines (312 -> 520) @@
`renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
minutes.
Cannot be set if the `renewBefore` field is set.
format: int32
type: integer
+ renewal:
+ description: |-
+ `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is
+ `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`.
+ properties:
+ policy:
+ description: '`policy` must be one of `Disabled`, `RenewBefore`.'
+ enum:
+ - RenewBefore
+ - Disabled
+ type: string
+ windows:
+ description: '`windows` mentions the behavior of when the renewal
+ must happen.'
+ items:
+ description: CertificateRenewalWindows is the definition for
+ renewal windows
+ properties:
+ cron:
+ description: |-
+ `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below:
+ * * * * *
+ | | | | |
+ | | | | day of the week (0–6) (Sunday to Saturday;
+ | | | month (1–12) 7 is also Sunday on some systems)
+ | | day of the month (1–31)
+ | hour (0–23)
+ minute (0–59)
+ minLength: 1
+ type: string
+ timezone:
+ description: |-
+ `timezone` is IANA compliant timezone. For example America/Denver.
+ If this field is not set, timezone is treated as UTC.
+ minLength: 1
+ type: string
+ windowDuration:
+ description: |-
+ `windowDuration` is how long the cron definition is active for.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+ pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$
+ type: string
+ required:
+ - cron
+ - windowDuration
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ type: object
revisionHistoryLimit:
description: |-
The maximum number of CertificateRequest revisions that are maintained in
the Certificate's history. Each revision represents a single `CertificateRequest`
created by this Certificate, either when it was created, renewed, or Spec
@@ skipped 182 lines (580 -> 761) @@
Status of the Certificate.
This is set and managed automatically.
Read-only.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
properties:
+ acme:
+ description: ACME stores information that is fetched from the ACME
+ CA server.
+ properties:
+ ari:
+ description: |-
+ ARI stores the ACME Renewal Information that is fetched from the ACME server
+ in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled.
+ properties:
+ explanationURL:
+ description: |-
+ ExplanationURL is a human-readable URL that may explain why the suggested window
+ has its current value.
+ type: string
+ lastChecked:
+ description: LastChecked is the time at which the ACME server
+ was last checked for renewal information.
+ format: date-time
+ type: string
+ lastError:
+ description: LastError is the last error encountered when
+ checking the ACME server for renewal information, if any.
+ type: string
+ nextCheck:
+ description: NextCheck is the time at which the ACME server
+ will next be checked for renewal information.
+ format: date-time
+ type: string
+ suggestedWindow:
+ description: SuggestedWindow is the suggested renewal window
+ as returned by the ACME server in accordance with RFC 9773.
+ properties:
+ end:
+ description: End is the end of the suggested renewal window.
+ format: date-time
+ type: string
+ start:
+ description: Start is the start of the suggested renewal
+ window.
+ format: date-time
+ type: string
+ required:
+ - end
+ - start
+ type: object
+ type: object
+ type: object
conditions:
description: |-
List of status conditions to indicate the status of certificates.
Known condition types are `Ready` and `Issuing`.
items:CustomResourceDefinition: challenges.acme.cert-manager.io description: |-
A label selector that is used to refine the set of certificate's that
this challenge solver will apply to.
type: object
type: object
+ waitInsteadOfSelfCheck:
+ description: |-
+ WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+ instead waits this long after presentation before asking the ACME server
+ to validate the challenge.
+
+ This is an advanced escape hatch for environments where cert-manager's
+ self-check cannot succeed from its own network or DNS viewpoint even
+ though the ACME server can still validate successfully, for example due
+ to split-horizon DNS or NAT hairpinning.
+
+ A value of 0 skips the self-check and asks the ACME server to validate
+ immediately after presentation, relying on the ACME server's own
+ validation retries (RFC 8555 section 8.2) to succeed once the challenge
+ has propagated. A negative duration is rejected.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+ for example `30s` or `2m`.
+ type: string
type: object
token:
description: |-
The ACME challenge token for this challenge.
This is the raw value returned from the ACME server.
@@ skipped 28 lines (3445 -> 3472) @@
type: object
status:
properties:
presented:
description: |-
- presented will be set to true if the challenge values for this challenge
- are currently 'presented'.
- This *does not* imply the self check is passing. Only that the values
- have been 'submitted' for the appropriate challenge mechanism (i.e. the
- DNS01 TXT record has been presented, or the HTTP01 configuration has been
- configured).
+ Presented is true once cert-manager has configured the solver resources
+ needed to expose this challenge's validation material.
+ For example, the DNS01 TXT record has been created, or the HTTP01 solver
+ has been configured to serve the challenge token.
+ This does not imply the self check is passing, that the ACME server has
+ validated the challenge, or that cert-manager has already accepted the
+ challenge with the ACME server.
type: boolean
+ presentedAt:
+ description: |-
+ PresentedAt records when cert-manager first configured the solver
+ resources for this challenge. This is used by the optional delay-based
+ readiness logic.
+ format: date-time
+ type: string
processing:
description: |-
Used to denote whether this challenge should be processed or not.
This field will only be set to true by the 'scheduling' component.
It will only be set to false by the 'challenges' controller, after theCustomResourceDefinition: clusterissuers.cert-manager.io description: |-
A label selector that is used to refine the set of certificate's that
this challenge solver will apply to.
type: object
type: object
+ waitInsteadOfSelfCheck:
+ description: |-
+ WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+ instead waits this long after presentation before asking the ACME server
+ to validate the challenge.
+
+ This is an advanced escape hatch for environments where cert-manager's
+ self-check cannot succeed from its own network or DNS viewpoint even
+ though the ACME server can still validate successfully, for example due
+ to split-horizon DNS or NAT hairpinning.
+
+ A value of 0 skips the self-check and asks the ACME server to validate
+ immediately after presentation, relying on the ACME server's own
+ validation retries (RFC 8555 section 8.2) to succeed once the challenge
+ has propagated. A negative duration is rejected.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+ for example `30s` or `2m`.
+ type: string
type: object
type: array
x-kubernetes-list-type: atomic
required:
- privateKeySecretRef
@@ skipped 105 lines (3609 -> 3713) @@
required:
- path
- roleId
- secretRef
type: object
+ aws:
+ description: |-
+ AWS authenticates with Vault using AWS IAM authentication.
+ This allows authentication using IAM roles for service accounts (IRSA),
+ EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+ properties:
+ iamRoleArn:
+ description: |-
+ The ARN of the AWS IAM role to assume using the Kubernetes service account
+ token. Required when using IRSA (serviceAccountRef is set).
+ This role must have a trust policy that allows the OIDC provider to assume it.
+ type: string
+ mountPath:
+ description: |-
+ The Vault mountPath here is the mount path to use when authenticating with
+ Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+ `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+ default value "/v1/auth/aws" will be used.
+ type: string
+ region:
+ description: |-
+ The AWS region to use for authentication. If not specified, the region
+ will be determined from AWS_REGION or AWS_DEFAULT_REGION environment
+ variables, falling back to "us-east-1" if not set.
+ type: string
+ role:
+ description: A required field containing the Vault Role
+ to assume when authenticating.
+ minLength: 1
+ type: string
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a web identity
+ token for IRSA (IAM Roles for Service Accounts) authentication.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+ The default audiences are always included in the token.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request
+ a token.
+ type: string
+ required:
+ - name
+ type: object
+ vaultHeaderValue:
+ description: |-
+ The Vault header value to include in the STS signing request.
+ This is used to prevent replay attacks.
+ type: string
+ required:
+ - role
+ type: object
clientCertificate:
description: |-
ClientCertificate authenticates with Vault by presenting a client
certificate during the request's TLS handshake.
Works only when using HTTPS protocol.
@@ skipped 228 lines (3782 -> 4009) @@
Defaults to "https://api.venafi.cloud/".
type: string
required:
- apiTokenSecretRef
type: object
+ ngts:
+ description: |-
+ NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration
+ using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+ properties:
+ credentialsRef:
+ description: |-
+ CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0
+ Client ID and Client Secret. The secret must contain the keys 'client-id' and
+ 'client-secret'.
+ properties:
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ tokenEndpoint:
+ description: |-
+ TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,
+ for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token".
+ Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set.
+ type: string
+ tsgID:
+ description: |-
+ TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,
+ for example "1234567890". The tsg_id: prefix is added automatically.
+ This field is required.
+ type: string
+ url:
+ description: |-
+ URL is the base URL for the NGTS API endpoint.
+ Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set.
+ type: string
+ required:
+ - credentialsRef
+ - tsgID
+ type: object
tpp:
description: |-
TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
Only one of CyberArk Certificate Manager may be specified.
properties:
@@ skipped 58 lines (4060 -> 4117) @@
This field is required.
type: string
required:
- zone
type: object
+ x-kubernetes-validations:
+ - message: exactly one of tpp, cloud, or ngts must be configured
+ rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts)
+ ? 1 : 0) == 1'
type: object
status:
description: Status of the ClusterIssuer. This is set and managed automatically.
properties:
acme:CustomResourceDefinition: issuers.cert-manager.io description: |-
A label selector that is used to refine the set of certificate's that
this challenge solver will apply to.
type: object
type: object
+ waitInsteadOfSelfCheck:
+ description: |-
+ WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+ instead waits this long after presentation before asking the ACME server
+ to validate the challenge.
+
+ This is an advanced escape hatch for environments where cert-manager's
+ self-check cannot succeed from its own network or DNS viewpoint even
+ though the ACME server can still validate successfully, for example due
+ to split-horizon DNS or NAT hairpinning.
+
+ A value of 0 skips the self-check and asks the ACME server to validate
+ immediately after presentation, relying on the ACME server's own
+ validation retries (RFC 8555 section 8.2) to succeed once the challenge
+ has propagated. A negative duration is rejected.
+ Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+ for example `30s` or `2m`.
+ type: string
type: object
type: array
x-kubernetes-list-type: atomic
required:
- privateKeySecretRef
@@ skipped 105 lines (3608 -> 3712) @@
required:
- path
- roleId
- secretRef
type: object
+ aws:
+ description: |-
+ AWS authenticates with Vault using AWS IAM authentication.
+ This allows authentication using IAM roles for service accounts (IRSA),
+ EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+ properties:
+ iamRoleArn:
+ description: |-
+ The ARN of the AWS IAM role to assume using the Kubernetes service account
+ token. Required when using IRSA (serviceAccountRef is set).
+ This role must have a trust policy that allows the OIDC provider to assume it.
+ type: string
+ mountPath:
+ description: |-
+ The Vault mountPath here is the mount path to use when authenticating with
+ Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+ `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+ default value "/v1/auth/aws" will be used.
+ type: string
+ region:
+ description: |-
+ The AWS region to use for authentication. If not specified, the region
+ will be determined from AWS_REGION or AWS_DEFAULT_REGION environment
+ variables, falling back to "us-east-1" if not set.
+ type: string
+ role:
+ description: A required field containing the Vault Role
+ to assume when authenticating.
+ minLength: 1
+ type: string
+ serviceAccountRef:
+ description: |-
+ A reference to a service account that will be used to request a web identity
+ token for IRSA (IAM Roles for Service Accounts) authentication.
+ properties:
+ audiences:
+ description: |-
+ TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+ The default audiences are always included in the token.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ name:
+ description: Name of the ServiceAccount used to request
+ a token.
+ type: string
+ required:
+ - name
+ type: object
+ vaultHeaderValue:
+ description: |-
+ The Vault header value to include in the STS signing request.
+ This is used to prevent replay attacks.
+ type: string
+ required:
+ - role
+ type: object
clientCertificate:
description: |-
ClientCertificate authenticates with Vault by presenting a client
certificate during the request's TLS handshake.
Works only when using HTTPS protocol.
@@ skipped 228 lines (3781 -> 4008) @@
Defaults to "https://api.venafi.cloud/".
type: string
required:
- apiTokenSecretRef
type: object
+ ngts:
+ description: |-
+ NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration
+ using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+ properties:
+ credentialsRef:
+ description: |-
+ CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0
+ Client ID and Client Secret. The secret must contain the keys 'client-id' and
+ 'client-secret'.
+ properties:
+ name:
+ description: |-
+ Name of the resource being referred to.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ required:
+ - name
+ type: object
+ tokenEndpoint:
+ description: |-
+ TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,
+ for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token".
+ Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set.
+ type: string
+ tsgID:
+ description: |-
+ TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,
+ for example "1234567890". The tsg_id: prefix is added automatically.
+ This field is required.
+ type: string
+ url:
+ description: |-
+ URL is the base URL for the NGTS API endpoint.
+ Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set.
+ type: string
+ required:
+ - credentialsRef
+ - tsgID
+ type: object
tpp:
description: |-
TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
Only one of CyberArk Certificate Manager may be specified.
properties:
@@ skipped 58 lines (4059 -> 4116) @@
This field is required.
type: string
required:
- zone
type: object
+ x-kubernetes-validations:
+ - message: exactly one of tpp, cloud, or ngts must be configured
+ rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts)
+ ? 1 : 0) == 1'
type: object
status:
description: Status of the Issuer. This is set and managed automatically.
properties:
acme:CustomResourceDefinition: orders.acme.cert-manager.io type: array
x-kubernetes-list-type: atomic
duration:
description: |-
Duration is the duration for the not after date for the requested certificate.
- this is set on order creation as pe the ACME spec.
+ This is set on order creation as per the ACME spec.
type: string
ipAddresses:
description: |-
IPAddresses is a list of IP addresses that should be included as part of the Order
validation process.
@@ skipped 28 lines (96 -> 123) @@
type: object
profile:
description: |-
Profile allows requesting a certificate profile from the ACME server.
Supported profiles are listed by the server's ACME directory URL.
+ type: string
+ replaces:
+ description: |-
+ Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this
+ Order is intended to replace. When set, cert-manager will include the
+ "replaces" field on the newOrder request to the ACME server if and only
+ if the server advertises ARI support in its directory. The CertID has
+ the form "base64url(AKI).base64url(serial)" and is derived locally from
+ the currently issued leaf certificate.
type: string
request:
description: |-
Certificate signing request bytes in DER encoding.
This will be used when finalizing the order.infra (kubernetes/bootstrap/infra.yaml)Application: argocd/cert-manager destination:
namespace: infra
server: https://kubernetes.default.svc
info:
- name: Chart
- value: cert-manager@v1.20.2
+ value: cert-manager@v1.21.1
project: default
source:
path: kubernetes/infra/cert-manager/
repoURL: https://github.com/mpeterson/homelab
targetRevision: mainn8n (kubernetes/apps/n8n/app.yaml)Deployment: selfhosted/n8n value: "8080"
- name: N8N_PROTOCOL
value: https
- name: WEBHOOK_URL
value: https://n8n-webhook.peterson.com.ar/
- image: ghcr.io/n8n-io/n8n:2.37.4@sha256:3ef785400f1a03361584e5533a2e3eb72de56311fd4dc996ac4031a7fdede8bc
+ image: ghcr.io/n8n-io/n8n:2.37.1@sha256:303088e67eb9b545253de11d7ad8a1074e781abe018565fe6fccb05278371178
name: app
resources:
limits:
memory: 2Gi
requests:Stats: |
renovate
Bot
force-pushed
the
renovate/cert-manager-1.x
branch
6 times, most recently
from
July 22, 2026 03:15
d1b8acf to
856395f
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/cert-manager-1.x
branch
15 times, most recently
from
August 5, 2026 13:39
1839e3c to
cd3d4df
Compare
renovate
Bot
force-pushed
the
renovate/cert-manager-1.x
branch
5 times, most recently
from
August 6, 2026 09:56
c1e170a to
d488dcf
Compare
renovate
Bot
force-pushed
the
renovate/cert-manager-1.x
branch
13 times, most recently
from
August 19, 2026 07:54
06161e5 to
1c6fb49
Compare
renovate
Bot
force-pushed
the
renovate/cert-manager-1.x
branch
14 times, most recently
from
August 26, 2026 13:55
49a2606 to
9576142
Compare
renovate
Bot
force-pushed
the
renovate/cert-manager-1.x
branch
2 times, most recently
from
August 27, 2026 02:13
b7e88b4 to
c7fa004
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.20.2→v1.21.1v1.20.2→v1.21.1Release Notes
cert-manager/cert-manager (cert-manager)
v1.21.1Compare Source
v1.21.0Compare Source
v1.20.3Compare Source
Configuration
📅 Schedule: (in timezone Asia/Jerusalem)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.