[release-next] (release 1.20) Version Bumps by maelvls · Pull Request #2007 · cert-manager/website

maelvls · 2026-03-11T14:04:24Z

This is part of the "release 1.20" series of PRs, see Slack thread. Here is the series of PRs for this release:

What I've done

I've used an edited version of the instructions from https://cert-manager.io/docs/contributing/release-process/ (section "Prepare the "Bump Versions" PR.). Here is the edited version of the release process I used (I've opened #2008 with these updated instructions):

(final + patch releases) Prepare the "Version Bumps" PR:

⚠️ This step can be done ahead of time.

Create a PR on the website titled something like "Bump versions".

If you are doing a final release, then this PR's base must be the release-next branch.

If you are doing a patch release, then this PR's base must be master.

In this PR:
Update the CRD and CLI docs with the following instructions:

Imagining that you are about to release v1.20.0, edit scripts/gendocs/generate-new-import-path-docs to change CM_BRANCH and DOCS_FOLDER to:
CM_BRANCH="release-1.20"
DOCS_FOLDER="docs"
Then, run:
./scripts/gendocs/generate
(final + patch release of the latest minor version) Bump the latest
cert-manager version variable in the content/docs/variables.json file.
For example, if you are releasing v1.20.0:
{"cert_manager_latest_version": "v1.20.0"}
(final release) Edit content/docs/releases/README.md and:

update the section "Supported releases",

update the section "How we determine supported Kubernetes versions".

netlify · 2026-03-11T14:06:41Z

✅ Deploy Preview for cert-manager ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`90cb77c`
🔍 Latest deploy log	https://app.netlify.com/projects/cert-manager/deploys/69b1937b09398c00085ef999
😎 Deploy Preview	https://deploy-preview-2007--cert-manager.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

wallrj-cyberark

Revert all the whitespace changes in the generate-... script.

The PR description gives the impression that this is mechanical change, but in fact you've fixed or improved something in one of the scripts too. Explain why.

I also don't understand why this PR depends on #2006

Please merge #2006 first.

...but that's a change to the master branch and this is a change to the release-next branch.

Copilot

Pull request overview

Part of the cert-manager website release process to update the site content for cert-manager v1.20, including regenerated API/CLI reference material and updated release support tables (per the release-next workflow).

Changes:

Update the gendocs helper script to target the release-1.20 branch.
Update release/support tables to include 1.20 as released and adjust EOL/support metadata.
Regenerate published reference docs (API docs + controller/webhook CLI reference output) for v1.20.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
scripts/gendocs/generate-new-import-path-docs	Switches docs generation target to `release-1.20` and refactors version variables.
content/docs/releases/README.md	Updates the releases matrix for 1.20 and shifts 1.18 into the EOL’d list.
content/docs/reference/api-docs.md	Regenerated API reference docs with new/updated fields and descriptions.
content/docs/cli/webhook.md	Regenerated webhook CLI reference, including new client-verification flags.
content/docs/cli/controller.md	Regenerated controller CLI reference, including new sizing/backoff/listenerset flags.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

content/docs/reference/api-docs.md

scripts/gendocs/generate-new-import-path-docs

content/docs/reference/api-docs.md

content/docs/cli/webhook.md

scripts/gendocs/generate-new-import-path-docs

content/docs/reference/api-docs.md

maelvls · 2026-03-11T16:07:26Z

content/docs/releases/README.md


 | Release  | Release Date | End of Life     | [Supported Kubernetes / OpenShift Versions][s] | [Tested Kubernetes Versions][test] |
 |:--------:|:------------:|:---------------:|:----------------------------------------------:|:----------------------------------:|
+| [1.20][] | Mar 10, 2026 | Release of 1.22 | 1.32 → 1.35 / 4.19 → 4.21                      | 1.32 → 1.35                        |


1.32 to 1.35 are the versions of Kubernetes we currently test at https://github.com/cert-manager/testing/blob/d7e8d653c9a24584e33df8cd214171fa77239154/config/prowgen/prowspecs/specs.go#L95-L96.

I guess I can add 1.31 and 4.18 to the "Supported Kubernetes versions" list...

I'm not sure. It looks like OpenShift 4.18 is supported by RedHat until 25 Feb 2027, and it's based on Kubernetes 1.31.

https://endoflife.date/red-hat-openshift

Happy to leave it like this unless some OpenShift user complains.

Signed-off-by: Maël Valais <mael@vls.dev>

maelvls · 2026-03-11T16:12:39Z

Revert all the whitespace changes in the generate-... script.

Done.

The PR description gives the impression that this is mechanical change, but in fact you've fixed or improved something in one of the scripts too. Explain why.

Thanks for pointing that out. I added a comment on that file to explain why I made that change.

I also don't understand why this PR depends on #2006

That was wrong, I removed this mention. What I should have written is that "You must merge #2006 before merging release-next into master".

PTAL @wallrj-cyberark

maelvls · 2026-03-11T16:17:28Z

scripts/gendocs/generate-new-import-path-docs

+# For final releases such as v1.20.0, DOCS_FOLDER should be `docs` (or a
+# versioned docs folder name such as `v1.20-docs`), and CM_BRANCH should be
+# the release branch, e.g. `release-1.20`.
+CM_BRANCH="release-1.20"
+DOCS_FOLDER="docs"
+
+genversionwithcli "$CM_BRANCH" "$DOCS_FOLDER"


The LATEST_VERSION made little sense to me. I've thus renamed it and also gave a name the second param.

This way, it is a little easier to explain what to do in the release process document.

wallrj-cyberark · 2026-03-11T16:24:38Z

content/docs/cli/controller.md

+      --acme-http01-solver-resource-request-memory string       Defines the resource request Memory size when spawning new ACME HTTP01 challenge solver pods. (default "64Mi")
+      --acme-http01-solver-run-as-non-root                      Defines the ability to run the http01 solver as root for troubleshooting issues (default true)
+      --auto-certificate-annotations strings                    The annotation consumed by the ingress-shim controller to indicate an ingress is requesting a certificate (default [kubernetes.io/tls-acme])
+      --certificate-request-minimum-backoff-duration duration   Duration of the initial certificate request backoff when a certificate request fails. The backoff duration is exponentially increased based on consecutive failures, up to a maximum of 32 hours. (default 1h0m0s)


New CLI option

wallrj-cyberark · 2026-03-11T16:24:48Z

content/docs/cli/controller.md

+      --dns01-recursive-nameservers-only                        When true, cert-manager will only ever query the configured DNS resolvers to perform the ACME DNS01 self check. This is useful in DNS constrained environments, where access to authoritative nameservers is restricted. Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers.
+      --enable-certificate-owner-ref                            Whether to set the certificate resource as an owner of secret where the tls certificate is stored. When this flag is enabled, the secret will be automatically removed when the certificate resource is deleted.
+      --enable-gateway-api                                      Whether gateway API integration is enabled within cert-manager. The ExperimentalGatewayAPISupport feature gate must also be enabled (default as of 1.15).
+      --enable-gateway-api-listenerset                          Whether ListenerSets support is enabled within cert-manager. The ListenerSet feature gate must also be enabled.


New option.

wallrj-cyberark · 2026-03-11T16:25:16Z

content/docs/cli/controller.md

+      --master string                                           Optional apiserver host address to connect to. If not specified, autoconfiguration will be attempted.
+      --max-certificate-bundle-size int                         Maximum size in bytes for PEM-encoded certificate bundles. (default 330000)
+      --max-certificate-chain-length int                        Maximum size in bytes for a PEM-encoded certificate chain. (default 95000)
+      --max-certificate-size int                                Maximum size in bytes for a single PEM-encoded certificate. Large certificates with many DNS names may need larger values. (default 36500)


New Options.

wallrj-cyberark · 2026-03-11T16:25:40Z

content/docs/cli/controller.md

+      --max-certificate-chain-length int                        Maximum size in bytes for a PEM-encoded certificate chain. (default 95000)
+      --max-certificate-size int                                Maximum size in bytes for a single PEM-encoded certificate. Large certificates with many DNS names may need larger values. (default 36500)
+      --max-concurrent-challenges int                           The maximum number of challenges that can be scheduled as 'processing' at once. (default 60)
+      --max-private-key-size int                                Maximum size in bytes for a single PEM-encoded private key. (default 13000)


wallrj-cyberark · 2026-03-11T16:25:53Z

content/docs/cli/webhook.md

 Flags:
      --api-server-host string                               Optional apiserver host address to connect to. If not specified, autoconfiguration will be attempted.
+      --client-ca-path string                                The client cert CA used to verify clients contacting webhooks.
+      --client-subject-names strings                         One or more client certificate subject names (CN or DNS SAN) that the apiserver may present when contacting the webhook. Should be a comma-separated list.


New options.

wallrj-cyberark · 2026-03-11T16:30:27Z

content/docs/reference/api-docs.md

    <tr>
      <td>
-        <code>ingressShimConfig</code>
+        <code>ingressShimConfig,omitzero</code>


Is this because the API docs generator doesn't understand omitzero?

Is omitzero a standard Go feature? Or is it part of the GOEXPERIMENT=jsonv2 feature.

wallrj-cyberark · 2026-03-11T16:37:50Z

content/docs/releases/README.md


 | Release  | Release Date | End of Life     | [Supported Kubernetes / OpenShift Versions][s] | [Tested Kubernetes Versions][test] |
 |:--------:|:------------:|:---------------:|:----------------------------------------------:|:----------------------------------:|
+| [1.20][] | Mar 10, 2026 | Release of 1.22 | 1.32 → 1.35 / 4.19 → 4.21                      | 1.32 → 1.35                        |


I'm not sure. It looks like OpenShift 4.18 is supported by RedHat until 25 Feb 2027, and it's based on Kubernetes 1.31.

https://endoflife.date/red-hat-openshift

Happy to leave it like this unless some OpenShift user complains.

wallrj-cyberark · 2026-03-11T16:39:04Z

cc @wallrj

wallrj · 2026-03-11T16:40:02Z

/approve
/lgtm

cert-manager-prow · 2026-03-11T16:40:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wallrj, wallrj-cyberark

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [wallrj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot AI review requested due to automatic review settings March 11, 2026 14:04

cert-manager-prow bot added dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Mar 11, 2026

maelvls changed the base branch from master to release-next March 11, 2026 14:05

cert-manager-prow bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Mar 11, 2026

Copilot started reviewing on behalf of maelvls March 11, 2026 14:10 View session

wallrj-cyberark requested changes Mar 11, 2026

View reviewed changes

Copilot AI reviewed Mar 11, 2026

View reviewed changes

maelvls mentioned this pull request Mar 11, 2026

[master] (release 1.20) Freeze 1.19 #2006

Merged

maelvls changed the title ~~[release-next] Bump versions to 1.20~~ [release-next] Bump Versions to 1.20 Mar 11, 2026

maelvls changed the title ~~[release-next] Bump Versions to 1.20~~ [release-next] Bump Version to 1.20 Mar 11, 2026

maelvls mentioned this pull request Mar 11, 2026

[release-next] (release 1.20) Release Notes #1997

Merged

maelvls changed the title ~~[release-next] Bump Version to 1.20~~ [release-next] (release 1.20) Bump Versions Mar 11, 2026

maelvls changed the title ~~[release-next] (release 1.20) Bump Versions~~ [release-next] (release 1.20) Version Bumps Mar 11, 2026

This was referenced Mar 11, 2026

[release-next] (release 1.20) Supported Releases #2005

Closed

[master] (release 1.20) Merge release-next into master #2001

Merged

maelvls force-pushed the bump-versions-to-1.20 branch from 487f640 to f9e9cb7 Compare March 11, 2026 16:03

cert-manager-prow bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Mar 11, 2026

maelvls force-pushed the bump-versions-to-1.20 branch from f9e9cb7 to aeff39f Compare March 11, 2026 16:05

cert-manager-prow bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Mar 11, 2026

maelvls commented Mar 11, 2026

View reviewed changes

maelvls added 2 commits March 11, 2026 17:08

bump supported releases

64342e0

Signed-off-by: Maël Valais <mael@vls.dev>

ran ./scripts/gendocs/generate-new-import-path-docs

90cb77c

Signed-off-by: Maël Valais <mael@vls.dev>

maelvls force-pushed the bump-versions-to-1.20 branch from aeff39f to 90cb77c Compare March 11, 2026 16:08

cert-manager-prow bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Mar 11, 2026

maelvls commented Mar 11, 2026

View reviewed changes

wallrj-cyberark approved these changes Mar 11, 2026

View reviewed changes

cert-manager-prow bot added the lgtm Indicates that a PR is ready to be merged. label Mar 11, 2026

cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 11, 2026

cert-manager-prow bot merged commit 1c95724 into cert-manager:release-next Mar 11, 2026
7 checks passed

Conversation

maelvls commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What I've done

Uh oh!

netlify bot commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cert-manager ready!

Uh oh!

wallrj-cyberark left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

maelvls commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maelvls Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wallrj-cyberark commented Mar 11, 2026

Uh oh!

wallrj commented Mar 11, 2026

Uh oh!

cert-manager-prow bot commented Mar 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

maelvls commented Mar 11, 2026 •

edited

Loading

netlify bot commented Mar 11, 2026 •

edited

Loading

maelvls commented Mar 11, 2026 •

edited

Loading

maelvls Mar 11, 2026 •

edited

Loading