Skip to content

Commit afa1148

Browse files
authored
Merge pull request #102590 from snarayan-redhat/OCPBUGS-64720_CMRN421
OCPBUGS#64720: Removed all RNs except 1.18
2 parents 96d992a + f15a418 commit afa1148

File tree

1 file changed

+1
-316
lines changed

1 file changed

+1
-316
lines changed

security/cert_manager_operator/cert-manager-operator-release-notes.adoc

Lines changed: 1 addition & 316 deletions
Original file line numberDiff line numberDiff line change
@@ -54,319 +54,4 @@ By default, this feature is disabled to prevent connectivity issues during upgra
5454
=== Known issues
5555

5656
* The upstream cert-manager `v1.18` release updated the ACME HTTP-01 challenge ingress path type from `ImplementationSpecific` to `Exact`. The OpenShift Route API does not have an equivalent for the `Exact` path type, which prevents the ingress-to-route controller from supporting it. As a result, ingress resources created for HTTP-01 challenges cannot route traffic to the solver pod, causing the challenge to fail with a 503 error.
57-
To mitigate this issue, the `ACMEHTTP01IngressPathTypeExact` feature gate is disabled by default in this release.
58-
59-
[id="cert-manager-operator-release-notes-1-17-0_{context}"]
60-
== {cert-manager-operator} 1.17.0
61-
62-
Issued: 2025-08-06
63-
64-
The following advisories are available for the {cert-manager-operator} 1.17.0:
65-
66-
* link:https://access.redhat.com/errata/RHBA-2025:13182[RHBA-2025:13182]
67-
* link:https://access.redhat.com/errata/RHBA-2025:13134[RHBA-2025:13134]
68-
* link:https://access.redhat.com/errata/RHBA-2025:13133[RHBA-2025:13133]
69-
70-
Version `1.17.0` of the {cert-manager-operator} is based on the upstream cert-manager version `v1.17.4`. For more information, see the link:https://cert-manager.io/docs/releases/release-notes/release-notes-1.17#v1174[cert-manager project release notes for v1.17.4].
71-
72-
[id="cert-manager-operator-1-17-0-bugs_{context}"]
73-
=== Bug fixes
74-
75-
* Previously, the `status` field in the `IstioCSR` custom resource (CR) was not set to `Ready` even after the successful deployment of Istio‑CSR. With this fix, the `status` field is correctly set to `Ready`, ensuring consistent and reliable status reporting. (link:https://issues.redhat.com/browse/CM-546[CM-546])
76-
77-
[id="cert-manager-operator-1-17-0-features-enhancements_{context}"]
78-
=== New features and enhancements
79-
80-
*Support to configure resource requests and limits for ACME HTTP‑01 solver pods*
81-
82-
With this release, the {cert-manager-operator} supports configuring CPU and memory resource requests and limits for ACME HTTP‑01 solver pods. You can configure the CPU and memory resource requests and limits by using the following overridable arguments in the `CertManager` custom resource (CR):
83-
84-
* `--acme-http01-solver-resource-limits-cpu`
85-
* `--acme-http01-solver-resource-limits-memory`
86-
* `--acme-http01-solver-resource-request-cpu`
87-
* `--acme-http01-solver-resource-request-memory`
88-
89-
For more information, see xref:../../security/cert_manager_operator/cert-manager-customizing-api-fields.adoc#cert-manager-overridable-arguments_cert-manager-customizing-api-fields[Overridable arguments for the cert‑manager components].
90-
91-
[id="cert-manager-operator-1-17-0-CVEs_{context}"]
92-
=== CVEs
93-
94-
* link:https://access.redhat.com/security/cve/CVE-2025-22866[CVE-2025-22866]
95-
* link:https://access.redhat.com/security/cve/CVE-2025-22868[CVE-2025-22868]
96-
* link:https://access.redhat.com/security/cve/CVE-2025-22872[CVE-2025-22872]
97-
* link:https://access.redhat.com/security/cve/CVE-2025-22870[CVE-2025-22870]
98-
* link:https://access.redhat.com/security/cve/CVE-2025-27144[CVE-2025-27144]
99-
* link:https://access.redhat.com/security/cve/CVE-2025-22871[CVE-2025-22871]
100-
101-
[id="cert-manager-operator-release-notes-1-16-2_{context}"]
102-
== {cert-manager-operator} 1.16.2
103-
104-
Issued: 2025-10-16
105-
106-
The following advisories are available for the {cert-manager-operator} 1.16.2:
107-
108-
* https://access.redhat.com/errata/RHSA-2025:18219[RHSA-2025:18219]
109-
* https://access.redhat.com/errata/RHBA-2025:18223[RHBA-2025:18223]
110-
* https://access.redhat.com/errata/RHBA-2025:18229[RHBA-2025:18229]
111-
112-
Version `1.16.2` of the {cert-manager-operator} is based on the upstream cert-manager version `v1.16.5`. For more information, see the link:https://cert-manager.io/docs/releases/release-notes/release-notes-1.16#v1165[cert-manager project release notes for v1.16.5].
113-
114-
[id="cert-manager-operator-1-16-2-CVEs_{context}"]
115-
=== CVEs
116-
117-
* link:https://access.redhat.com/security/cve/CVE-2024-12718[CVE-2024-12718]
118-
* link:https://access.redhat.com/security/cve/CVE-2025-4138[CVE-2025-4138]
119-
* link:https://access.redhat.com/security/cve/CVE-2025-4517[CVE-2025-4517]
120-
* link:https://access.redhat.com/security/cve/CVE-2025-49794[CVE-2025-49794]
121-
* link:https://access.redhat.com/security/cve/CVE-2025-49796[CVE-2025-49796]
122-
* link:https://access.redhat.com/security/cve/CVE-2025-5914[CVE-2025-5914]
123-
* link:https://access.redhat.com/security/cve/CVE-2025-6020[CVE-2025-6020]
124-
* link:https://access.redhat.com/security/cve/CVE-2025-6965[CVE-2025-6965]
125-
* link:https://access.redhat.com/security/cve/CVE-2025-7425[CVE-2025-7425]
126-
* link:https://access.redhat.com/security/cve/CVE-2025-8941[CVE-2025-8941]
127-
128-
[id="cert-manager-operator-release-notes-1-16-1_{context}"]
129-
== {cert-manager-operator} 1.16.1
130-
131-
Issued: 2025-07-10
132-
133-
The following advisories are available for the {cert-manager-operator} 1.16.1:
134-
135-
* link:https://access.redhat.com/errata/RHBA-2025:10765[RHBA-2025:10765]
136-
* link:https://access.redhat.com/errata/RHBA-2025:10766[RHBA-2025:10766]
137-
* link:https://access.redhat.com/errata/RHBA-2025:10785[RHBA-2025:10785]
138-
139-
Version `1.16.1` of the {cert-manager-operator} is based on the upstream cert-manager version `v1.16.5`. For more information, see the link:https://cert-manager.io/docs/releases/release-notes/release-notes-1.16#v1165[cert-manager project release notes for v1.16.5].
140-
141-
[id="cert-manager-operator-1-16-1-bugs_{context}"]
142-
=== Bug fixes
143-
144-
Previously, {cert-manager-operator} failed to create the `cert-manager-tokenrequest` role due to insufficient RBAC permissions. This resulted in `RoleCreateFailed` errors and a degraded static-resource controller. With this release, the issue is resolved by adding the necessary `serviceaccounts/token` create permission to the RBAC configuration. As a result, the `cert-manager-tokenrequest` role and role binding are now successfully created, and `RoleCreateFailed` errors no longer appear in the operator logs. link:https://issues.redhat.com/browse/OCPBUGS-56758[(OCPBUGS-56758)]
145-
146-
[id="cert-manager-operator-1-16-1-CVEs_{context}"]
147-
=== CVEs
148-
149-
* link:https://access.redhat.com/security/cve/CVE-2025-22871[CVE-2025-22871]
150-
* link:https://access.redhat.com/security/cve/CVE-2025-30204[CVE-2025-30204]
151-
* link:https://access.redhat.com/security/cve/CVE-2025-22872[CVE-2025-22872]
152-
* link:https://access.redhat.com/security/cve/CVE-2025-27144[CVE-2025-27144]
153-
* link:https://access.redhat.com/security/cve/CVE-2025-22870[CVE-2025-22870]
154-
155-
156-
[id="cert-manager-operator-release-notes-1-16-0_{context}"]
157-
== {cert-manager-operator} 1.16.0
158-
159-
Issued: 2025-05-27
160-
161-
The following advisories are available for the {cert-manager-operator} 1.16.0:
162-
163-
* link:https://access.redhat.com/errata/RHEA-2025:8163[RHEA-2025:8163]
164-
* link:https://access.redhat.com/errata/RHEA-2025:8164[RHEA-2025:8164]
165-
* link:https://access.redhat.com/errata/RHEA-2025:8165[RHEA-2025:8165]
166-
* link:https://access.redhat.com/errata/RHEA-2025:8198[RHEA-2025:8198]
167-
168-
Version `1.16.0` of the {cert-manager-operator} is based on the upstream cert-manager version `v1.16.4`. For more information, see the link:https://cert-manager.io/docs/releases/release-notes/release-notes-1.16/#v1164[cert-manager project release notes for v1.16.4].
169-
170-
[id="cert-manager-operator-1-16-0-features-enhancements_{context}"]
171-
=== New features and enhancements
172-
173-
*Disconnected environment support*
174-
175-
With this release, the {cert-manager-operator} has been verified to be mirrored to and installed in a disconnected environment.
176-
177-
The Operator has also been validated to work with the following issuer types in disconnected environments: ACME, CA, Self-signed, and Vault.
178-
Specifically, private or self-hosted ACME servers have been validated, as Let's Encrypt or other public ACME services are not feasible options in disconnected environments.
179-
The oc-mirror plugin v2 is the preferred method to mirror Operator images.
180-
For more information, see xref:../../disconnected/about-installing-oc-mirror-v2.adoc#about-installing-oc-mirror-v2[Mirroring images for a disconnected installation by using the oc-mirror plugin v2].
181-
182-
*Extended operand metrics support*
183-
184-
With this release, cert-manager webhook and cainjector operands now expose Prometheus metrics on port 9402 by default via the `/metrics` service endpoint.
185-
You can configure OpenShift Monitoring to collect metrics from all cert-manager operands by enabling the built-in user workload monitoring stack.
186-
For more information, see xref:../../security/cert_manager_operator/cert-manager-monitoring.adoc#cert-manager-monitoring[Monitoring {cert-manager-operator}].
187-
188-
*Streaming Lists enablement*
189-
190-
With this release, the {cert-manager-operator} now uses the new upstream WatchListClient feature.
191-
This enables use of the Streaming Lists feature of the Kubernetes API server, which reduces the load on the API server.
192-
The peak memory use of the cert-manager components when they start up is optimized on {product-title} 4.14 and later.
193-
194-
[id="cert-manager-operator-1-16-0-CVEs_{context}"]
195-
=== CVEs
196-
197-
* link:https://access.redhat.com/security/cve/CVE-2024-45337[CVE-2024-45337]
198-
* link:https://access.redhat.com/security/cve/CVE-2024-45338[CVE-2024-45338]
199-
* link:https://access.redhat.com/security/cve/CVE-2025-22866[CVE-2025-22866]
200-
201-
[id="cert-manager-operator-1-16-0-known-issues_{context}"]
202-
=== Known Issues
203-
204-
When using the Venafi issuer with username and password authentication in cert-manager version 1.16.0, the default client ID is hard-coded as `cert-manager.io` and cannot be customized. This limitation can affect users requiring a specific client ID for authentication with the Venafi platform.
205-
206-
[id="cert-manager-operator-release-notes-1-15-1_{context}"]
207-
== {cert-manager-operator} 1.15.1
208-
209-
Issued: 2025-03-13
210-
211-
The following advisories are available for the {cert-manager-operator} 1.15.1:
212-
213-
* link:https://access.redhat.com/errata/RHBA-2025:2733[RHEA-2025-2733]
214-
* link:https://access.redhat.com/errata/RHBA-2025:2780[RHEA-2025-2780]
215-
* link:https://access.redhat.com/errata/RHBA-2025:2821[RHEA-2025-2821]
216-
* link:https://access.redhat.com/errata/RHBA-2025:2828[RHEA-2025-2828]
217-
218-
Version `1.15.1` of the {cert-manager-operator} is based on the upstream cert-manager version `v1.15.5`. For more information, see the link:https://cert-manager.io/docs/releases/release-notes/release-notes-1.15/#v1155[cert-manager project release notes for v1.15.5].
219-
220-
[id="cert-manager-operator-1-15-1-features-enhancements_{context}"]
221-
=== New features and enhancements
222-
223-
*Integrating the {cert-manager-operator} with Istio-CSR* (Technology Preview)
224-
225-
The {cert-manager-operator} now supports the Istio-CSR. With this integration, cert-manager Operator's issuers can issue, sign, and renew certificates for mutual TLS (mTLS) communication. {SMProductName} and `Istio` can now request these certificates directly from the cert-manager Operator.
226-
227-
For more information, see xref:../../security/cert_manager_operator/cert-manager-operator-integrating-istio.adoc#cert-manager-operator-istio-csr-installing_cert-manager-operator-integrating-istio[Integrating the cert-manager Operator with Istio-CSR].
228-
229-
[id="cert-manager-operator-1-15-1-CVEs_{context}"]
230-
=== CVEs
231-
232-
* link:https://access.redhat.com/security/cve/CVE-2024-9287[CVE-2024-9287]
233-
* link:https://github.com/advisories/GHSA-7wrw-r4p8-38rx[CVE-2024-45336]
234-
* link:https://github.com/advisories/GHSA-3f6r-qh9c-x6mm[CVE-2024-45341]
235-
236-
[id="cert-manager-operator-release-notes-1-15-0_{context}"]
237-
== {cert-manager-operator} 1.15.0
238-
239-
Issued: 2025-01-22
240-
241-
The following advisories are available for the {cert-manager-operator} 1.15.0:
242-
243-
* link:https://access.redhat.com/errata/RHEA-2025:0487[RHEA-2025:0487]
244-
* link:https://access.redhat.com/errata/RHSA-2025:0535[RHSA-2025:0535]
245-
* link:https://access.redhat.com/errata/RHSA-2025:0536[RHSA-2025:0536]
246-
247-
Version `1.15.0` of the {cert-manager-operator} is based on the upstream cert-manager version `v1.15.4`. For more information, see the link:https://cert-manager.io/docs/releases/release-notes/release-notes-1.15/#v1154[cert-manager project release notes for v1.15.4].
248-
249-
[id="cert-manager-operator-1-15-0-features-enhancements_{context}"]
250-
=== New features and enhancements
251-
252-
*Scheduling overrides for {cert-manager-operator}*
253-
254-
With this release, you can configure scheduling overrides for {cert-manager-operator}, including the cert-manager controller, webhook, and CA injector.
255-
256-
*Google CAS issuer*
257-
258-
The {cert-manager-operator} now supports the Google Certificate Authority Service (CAS) issuer. The `google-cas-issuer` is an external issuer for cert-manager that automates certificate lifecycle management, including issuance and renewal, with CAS-managed private certificate authorities.
259-
260-
[NOTE]
261-
====
262-
The Google CAS issuer is validated only with version 0.9.0 and {cert-manager-operator} version 1.15.0. These versions support tasks such as issuing, renewing, and managing certificates for the API server and ingress controller in {product-title} clusters.
263-
====
264-
265-
*Default `installMode` updated to `AllNamespaces`*
266-
267-
Starting from version 1.15.0, the default and recommended Operator Lifecycle Manager (OLM) `installMode` is `AllNamespaces`. Previously, the default was `SingleNamespace`. This change aligns with best practices for multi-namespace Operator management.
268-
For more information, see link:https://issues.redhat.com/browse/OCPBUGS-23406[OCPBUGS-23406].
269-
270-
*Redundant `kube-rbac-proxy` sidecar removed*
271-
272-
The Operator no longer includes the redundant `kube-rbac-proxy` sidecar container, reducing resource usage and complexity.
273-
For more information, see link:https://issues.redhat.com/browse/CM-436[CM-436].
274-
275-
[id="cert-manager-operator-1-15-0-CVEs_{context}"]
276-
=== CVEs
277-
278-
* link:https://access.redhat.com/security/cve/CVE-2024-35255[CVE-2024-35255]
279-
* link:https://access.redhat.com/security/cve/CVE-2024-28180[CVE-2024-28180]
280-
* link:https://access.redhat.com/security/cve/CVE-2024-24783[CVE-2024-24783]
281-
* link:https://access.redhat.com/security/cve/CVE-2024-6104[CVE-2024-6104]
282-
* link:https://access.redhat.com/security/cve/CVE-2023-45288[CVE-2023-45288]
283-
* link:https://access.redhat.com/security/cve/CVE-2024-45337[CVE-2024-45337]
284-
* link:https://access.redhat.com/security/cve/CVE-2024-45338[CVE-2024-45338]
285-
286-
[id="cert-manager-operator-release-notes-1-14-0"]
287-
== {cert-manager-operator} 1.14.0
288-
289-
Issued: 2024-07-08
290-
291-
The following advisory is available for the {cert-manager-operator} 1.14.0:
292-
293-
* link:https://access.redhat.com/errata/RHEA-2024:4360[RHEA-2024:4360]
294-
295-
Version `1.14.0` of the {cert-manager-operator} is based on the upstream cert-manager version `v1.14.5`. For more information, see the link:https://cert-manager.io/docs/releases/release-notes/release-notes-1.14/#v1145[cert-manager project release notes for v1.14.5].
296-
297-
[id="cert-manager-operator-new-features-1-14-0"]
298-
=== New features and enhancements
299-
300-
*FIPS compliance support*
301-
302-
With this release, FIPS mode is now automatically enabled for {cert-manager-operator}. When installed on an {product-title} cluster in FIPS mode, {cert-manager-operator} ensures compatibility without affecting the cluster's FIPS support status.
303-
304-
*Securing routes with cert-manager managed certificates (Technology Preview)*
305-
306-
With this release, you can manage certificates referenced in `Route` resources by using the {cert-manager-operator}. For more information, see xref:../../security/cert_manager_operator/cert-manager-securing-routes.adoc#cert-manager-securing-routes[Securing routes with the {cert-manager-operator}].
307-
308-
*NCM issuer*
309-
310-
The {cert-manager-operator} now supports the Nokia NetGuard Certificate Manager (NCM) issuer. The `ncm-issuer` is a cert-manager external issuer that integrates with the NCM PKI system using a Kubernetes controller to sign certificate requests. This integration streamlines the process of obtaining non-self-signed certificates for applications, ensuring their validity and keeping them updated.
311-
312-
[NOTE]
313-
====
314-
The NCM issuer is validated only with version 1.1.1 and the {cert-manager-operator} version 1.14.0. This version handles tasks such as issuance, renewal, and managing certificates for the API server and ingress controller of {product-title} clusters.
315-
====
316-
317-
[id="cert-manager-operator-1-14-0-CVEs"]
318-
=== CVEs
319-
320-
* link:https://access.redhat.com/security/cve/CVE-2023-45288[CVE-2023-45288]
321-
* link:https://access.redhat.com/security/cve/CVE-2024-28180[CVE-2024-28180]
322-
* link:https://access.redhat.com/security/cve/CVE-2020-8559[CVE-2020-8559]
323-
* link:https://access.redhat.com/security/cve/CVE-2024-26147[CVE-2024-26147]
324-
* link:https://access.redhat.com/security/cve/CVE-2024-24783[CVE-2024-24783]
325-
326-
[id="cert-manager-operator-release-notes-1-13-1"]
327-
== {cert-manager-operator} 1.13.1
328-
329-
Issued: 2024-05-15
330-
331-
The following advisory is available for the {cert-manager-operator} 1.13.1:
332-
333-
* link:https://access.redhat.com/errata/RHEA-2024:2849[RHEA-2024:2849]
334-
335-
Version `1.13.1` of the {cert-manager-operator} is based on the upstream cert-manager version `v1.13.6`. For more information, see the link:https://cert-manager.io/docs/releases/release-notes/release-notes-1.13#v1136[cert-manager project release notes for v1.13.6].
336-
337-
[id="cert-manager-operator-1-13-1-CVEs"]
338-
=== CVEs
339-
340-
* link:https://access.redhat.com/security/cve/CVE-2023-45288[CVE-2023-45288]
341-
* link:https://access.redhat.com/security/cve/CVE-2023-48795[CVE-2023-48795]
342-
* link:https://access.redhat.com/security/cve/CVE-2024-24783[CVE-2024-24783]
343-
344-
[id="cert-manager-operator-release-notes-1-13-0"]
345-
== {cert-manager-operator} 1.13.0
346-
347-
Issued: 2024-01-16
348-
349-
The following advisory is available for the {cert-manager-operator} 1.13.0:
350-
351-
* link:https://access.redhat.com/errata/RHEA-2024:0259[RHEA-2024:0259]
352-
353-
Version `1.13.0` of the {cert-manager-operator} is based on the upstream cert-manager version `v1.13.3`. For more information, see the link:https://cert-manager.io/docs/release-notes/release-notes-1.13/#v1133[cert-manager project release notes for v1.13.0].
354-
355-
[id="cert-manager-operator-new-features-1-13-0"]
356-
=== New features and enhancements
357-
358-
* You can now manage certificates for API Server and Ingress Controller by using the {cert-manager-operator}.
359-
For more information, see xref:../../security/cert_manager_operator/cert-manager-creating-certificate.adoc#cert-manager-creating-certificate[Configuring certificates with an issuer].
360-
361-
* With this release, the scope of the {cert-manager-operator}, which was previously limited to the {product-title} on AMD64 architecture, has now been expanded to include support for managing certificates on {product-title} running on {ibm-z-name} (`s390x`), {ibm-power-name} (`ppc64le`) and ARM64 architectures.
362-
363-
* With this release, you can use DNS over HTTPS (DoH) for performing the self-checks during the ACME DNS-01 challenge verification. The DNS self-check method can be controlled by using the command-line flags, `--dns01-recursive-nameservers-only` and `--dns01-recursive-nameservers`.
364-
For more information, see xref:../../security/cert_manager_operator/cert-manager-customizing-api-fields.html#cert-manager-override-arguments_cert-manager-customizing-api-fields[Customizing cert-manager by overriding arguments from the cert-manager Operator API].
365-
366-
[id="cert-manager-operator-1-13-0-CVEs"]
367-
=== CVEs
368-
369-
* link:https://access.redhat.com/security/cve/CVE-2023-39615[CVE-2023-39615]
370-
* link:https://access.redhat.com/security/cve/CVE-2023-3978[CVE-2023-3978]
371-
* link:https://access.redhat.com/security/cve/CVE-2023-37788[CVE-2023-37788]
372-
* link:https://access.redhat.com/security/cve/CVE-2023-29406[CVE-2023-29406]
57+
To mitigate this issue, the `ACMEHTTP01IngressPathTypeExact` feature gate is disabled by default in this release.

0 commit comments

Comments
 (0)