feat(helm): update cert-manager ( v1.15.3 → v1.16.0 )

[renovate]

This PR contains the following updates:

Package	Update	Change
cert-manager (source)	minor	v1.15.3 -> v1.16.0

---

Release Notes

cert-manager/cert-manager (cert-manager)

v1.16.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "on monday,on wednesday,on friday" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

kustomization changes in kubernetes/main

--- kubernetes/main/apps/cert-manager/cert-manager/app Kustomization: flux-system/cert-manager HelmRelease: cert-manager/cert-manager

+++ kubernetes/main/apps/cert-manager/cert-manager/app Kustomization: flux-system/cert-manager HelmRelease: cert-manager/cert-manager

@@ -13,36 +13,47 @@

     spec:
       chart: cert-manager
       sourceRef:
         kind: HelmRepository
         name: jetstack
         namespace: flux-system
-      version: v1.15.3
+      version: v1.16.0
   install:
     remediation:
       retries: 3
   interval: 2h
   maxHistory: 2
   uninstall:
     keepHistory: false
   upgrade:
     cleanupOnFail: true
     remediation:
       retries: 3
   values:
+    cainjector:
+      extraEnv:
+      - name: KUBE_FEATURE_WatchListClient
+        value: 'true'
     extraArgs:
     - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
     - --dns01-recursive-nameservers-only
+    extraEnv:
+    - name: KUBE_FEATURE_WatchListClient
+      value: 'true'
     global:
       revisionHistoryLimit: 3
     installCRDs: true
     podDnsConfig:
       nameservers:
       - 1.1.1.1
       - 9.9.9.9
     podDnsPolicy: None
     prometheus:
       enabled: true
-      servicemonitor:
+      podmonitor:
         enabled: true
         prometheusInstance: monitoring
+    webhook:
+      extraEnv:
+      - name: KUBE_FEATURE_WatchListClient
+        value: 'true'
 

[github-actions]

helmrelease changes in kubernetes/main

--- HelmRelease: cert-manager/cert-manager ClusterRoleBinding: cert-manager/cert-manager-webhook:subjectaccessreviews

+++ HelmRelease: cert-manager/cert-manager ClusterRoleBinding: cert-manager/cert-manager-webhook:subjectaccessreviews

@@ -11,11 +11,10 @@

     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: cert-manager-webhook:subjectaccessreviews
 subjects:
-- apiGroup: ''
-  kind: ServiceAccount
+- kind: ServiceAccount
   name: cert-manager-webhook
   namespace: cert-manager
 
--- HelmRelease: cert-manager/cert-manager RoleBinding: kube-system/cert-manager:leaderelection

+++ HelmRelease: cert-manager/cert-manager RoleBinding: kube-system/cert-manager:leaderelection

@@ -12,11 +12,10 @@

     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: cert-manager:leaderelection
 subjects:
-- apiGroup: ''
-  kind: ServiceAccount
+- kind: ServiceAccount
   name: cert-manager
   namespace: cert-manager
 
--- HelmRelease: cert-manager/cert-manager RoleBinding: cert-manager/cert-manager-webhook:dynamic-serving

+++ HelmRelease: cert-manager/cert-manager RoleBinding: cert-manager/cert-manager-webhook:dynamic-serving

@@ -12,11 +12,10 @@

     app.kubernetes.io/managed-by: Helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: cert-manager-webhook:dynamic-serving
 subjects:
-- apiGroup: ''
-  kind: ServiceAccount
+- kind: ServiceAccount
   name: cert-manager-webhook
   namespace: cert-manager
 
--- HelmRelease: cert-manager/cert-manager Service: cert-manager/cert-manager

+++ HelmRelease: cert-manager/cert-manager Service: cert-manager/cert-manager

@@ -1,24 +0,0 @@

----
-apiVersion: v1
-kind: Service
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/managed-by: Helm
-spec:
-  type: ClusterIP
-  ports:
-  - protocol: TCP
-    port: 9402
-    name: tcp-prometheus-servicemonitor
-    targetPort: 9402
-  selector:
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/component: controller
-
--- HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-cainjector

+++ HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-cainjector

@@ -32,22 +32,28 @@

       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cert-manager-cainjector
-        image: quay.io/jetstack/cert-manager-cainjector:v1.15.3
+        image: quay.io/jetstack/cert-manager-cainjector:v1.16.0
         imagePullPolicy: IfNotPresent
         args:
         - --v=2
         - --leader-election-namespace=kube-system
+        ports:
+        - containerPort: 9402
+          name: http-metrics
+          protocol: TCP
         env:
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: KUBE_FEATURE_WatchListClient
+          value: 'true'
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           readOnlyRootFilesystem: true
--- HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager

+++ HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager

@@ -32,19 +32,19 @@

       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cert-manager-controller
-        image: quay.io/jetstack/cert-manager-controller:v1.15.3
+        image: quay.io/jetstack/cert-manager-controller:v1.16.0
         imagePullPolicy: IfNotPresent
         args:
         - --v=2
         - --cluster-resource-namespace=$(POD_NAMESPACE)
         - --leader-election-namespace=kube-system
-        - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.15.3
+        - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.16.0
         - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
         - --dns01-recursive-nameservers-only
         - --max-concurrent-challenges=60
         ports:
         - containerPort: 9402
           name: http-metrics
@@ -60,12 +60,14 @@

           readOnlyRootFilesystem: true
         env:
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: KUBE_FEATURE_WatchListClient
+          value: 'true'
         livenessProbe:
           httpGet:
             port: http-healthz
             path: /livez
             scheme: HTTP
           initialDelaySeconds: 10
--- HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-webhook

+++ HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-webhook

@@ -32,13 +32,13 @@

       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cert-manager-webhook
-        image: quay.io/jetstack/cert-manager-webhook:v1.15.3
+        image: quay.io/jetstack/cert-manager-webhook:v1.16.0
         imagePullPolicy: IfNotPresent
         args:
         - --v=2
         - --secure-port=10250
         - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
         - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
@@ -49,12 +49,15 @@

         - name: https
           protocol: TCP
           containerPort: 10250
         - name: healthcheck
           protocol: TCP
           containerPort: 6080
+        - containerPort: 9402
+          name: http-metrics
+          protocol: TCP
         livenessProbe:
           httpGet:
             path: /livez
             port: 6080
             scheme: HTTP
           initialDelaySeconds: 60
@@ -80,9 +83,11 @@

           readOnlyRootFilesystem: true
         env:
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: KUBE_FEATURE_WatchListClient
+          value: 'true'
       nodeSelector:
         kubernetes.io/os: linux
 
--- HelmRelease: cert-manager/cert-manager ServiceMonitor: cert-manager/cert-manager

+++ HelmRelease: cert-manager/cert-manager ServiceMonitor: cert-manager/cert-manager

@@ -1,27 +0,0 @@

----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/managed-by: Helm
-    prometheus: monitoring
-spec:
-  jobLabel: cert-manager
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: cert-manager
-      app.kubernetes.io/instance: cert-manager
-      app.kubernetes.io/component: controller
-  endpoints:
-  - targetPort: 9402
-    path: /metrics
-    interval: 60s
-    scrapeTimeout: 30s
-    honorLabels: false
-
--- HelmRelease: cert-manager/cert-manager Role: cert-manager/cert-manager-startupapicheck:create-cert

+++ HelmRelease: cert-manager/cert-manager Role: cert-manager/cert-manager-startupapicheck:create-cert

@@ -15,10 +15,10 @@

     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
     helm.sh/hook-weight: '-5'
 rules:
 - apiGroups:
   - cert-manager.io
   resources:
-  - certificates
+  - certificaterequests
   verbs:
   - create
 
--- HelmRelease: cert-manager/cert-manager Job: cert-manager/cert-manager-startupapicheck

+++ HelmRelease: cert-manager/cert-manager Job: cert-manager/cert-manager-startupapicheck

@@ -31,22 +31,27 @@

       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cert-manager-startupapicheck
-        image: quay.io/jetstack/cert-manager-startupapicheck:v1.15.3
+        image: quay.io/jetstack/cert-manager-startupapicheck:v1.16.0
         imagePullPolicy: IfNotPresent
         args:
         - check
         - api
         - --wait=1m
         - -v
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
       nodeSelector:
         kubernetes.io/os: linux
 
--- HelmRelease: cert-manager/cert-manager Role: cert-manager/cert-manager-tokenrequest

+++ HelmRelease: cert-manager/cert-manager Role: cert-manager/cert-manager-tokenrequest

@@ -0,0 +1,22 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cert-manager-tokenrequest
+  namespace: cert-manager
+  labels:
+    app: cert-manager
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts/token
+  resourceNames:
+  - cert-manager
+  verbs:
+  - create
+
--- HelmRelease: cert-manager/cert-manager RoleBinding: cert-manager/cert-manager-cert-manager-tokenrequest

+++ HelmRelease: cert-manager/cert-manager RoleBinding: cert-manager/cert-manager-cert-manager-tokenrequest

@@ -0,0 +1,21 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cert-manager-cert-manager-tokenrequest
+  namespace: cert-manager
+  labels:
+    app: cert-manager
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cert-manager-tokenrequest
+subjects:
+- kind: ServiceAccount
+  name: cert-manager
+  namespace: cert-manager
+
--- HelmRelease: cert-manager/cert-manager PodMonitor: cert-manager/cert-manager

+++ HelmRelease: cert-manager/cert-manager PodMonitor: cert-manager/cert-manager

@@ -0,0 +1,40 @@

+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+  labels:
+    app: cert-manager
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/managed-by: Helm
+    prometheus: monitoring
+spec:
+  jobLabel: cert-manager
+  selector:
+    matchExpressions:
+    - key: app.kubernetes.io/name
+      operator: In
+      values:
+      - cainjector
+      - cert-manager
+      - webhook
+    - key: app.kubernetes.io/instance
+      operator: In
+      values:
+      - cert-manager
+    - key: app.kubernetes.io/component
+      operator: In
+      values:
+      - cainjector
+      - controller
+      - webhook
+  podMetricsEndpoints:
+  - port: http-metrics
+    path: /metrics
+    interval: 60s
+    scrapeTimeout: 30s
+    honorLabels: false
+