LoginSign Up
← Back to all sparks
C

cert-manager

INFRA · APIS
Velocity0.0

Automated TLS certificate management for Kubernetes

cert-manager.io ↗

cert-manager's 1.21 line is about failure handling: backoff caps, renewal policies and clearer auth errors

kubernetescertificatespkireliabilitypre-release
◆Current state
cert-manager is running the 1.21 pre-release train through alpha.0, alpha.1 and now beta.0. The changes cluster around what happens when certificate issuance goes wrong: a configurable cap on CertificateRequest retry backoff, a new AuthFailed issuer condition that separates bad Venafi credentials from transient infrastructure failures, and certificate renewal policies.
◆Where it's heading
This is a reliability and observability cycle rather than a feature cycle. The recurring theme is making cert-manager's failure states legible — distinguishing permanent from transient errors, bounding retry storms, and letting Helm's common labels propagate into the ACME solver resources it creates on the fly. CAInjectorMerging reaching GA and deprecated API removal point to a line that is consolidating.
◆Prediction
Expect a 1.21.0 release candidate next, with the renewal policy work being the piece most likely to change shape before it stabilises.

◆Recent moves

  1. 1mo ago

    v1.21.0-beta.0

    The beta adds certificateRequestMaximumBackoffDuration, letting operators cap how long a failed CertificateRequest backs off — configurable by file, CLI flag or Helm value, defaulting to 32 hours. It bounds a retry curve that previously ran unchecked.

    View source ↗
  2. 1mo ago

    v1.21.0-alpha.1

    Adds Venafi OAuth token observability and an AuthFailed issuer condition that separates bad credentials from transient infrastructure errors — a distinction operators previously had to infer from logs. A new flag also propagates Helm common labels to dynamically created ACME HTTP01 solver resources.

    View source ↗
  3. 4mo ago

    v1.21.0-alpha.0

    Opens the 1.21 cycle with certificate renewal policies, promotes the CAInjectorMerging feature gate to GA, and removes deprecated API surface. The renewal policy work is the piece to watch as the line matures.

    View source ↗