feat(helm): update cert-manager ( v1.13.3 → v1.14.1 )

[smurf-bot]

This PR contains the following updates:

Package	Update	Change
cert-manager	minor	v1.13.3 -> v1.14.1

---

Release Notes

cert-manager/cert-manager (cert-manager)

v1.14.1

Compare Source

v1.14.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[smurf-bot]

--- kubernetes/teyvat/apps/cert-manager/cert-manager/app Kustomization: flux-system/cert-manager HelmRelease: cert-manager/cert-manager

+++ kubernetes/teyvat/apps/cert-manager/cert-manager/app Kustomization: flux-system/cert-manager HelmRelease: cert-manager/cert-manager

@@ -13,13 +13,13 @@

     spec:
       chart: cert-manager
       sourceRef:
         kind: HelmRepository
         name: jetstack
         namespace: flux-system
-      version: v1.13.3
+      version: v1.14.1
   install:
     remediation:
       retries: 3
   interval: 30m
   maxHistory: 2
   uninstall:

[smurf-bot]

--- HelmRelease: cert-manager/cert-manager ConfigMap: cert-manager/cert-manager

+++ HelmRelease: cert-manager/cert-manager ConfigMap: cert-manager/cert-manager

@@ -1,14 +0,0 @@

----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/managed-by: Helm
-data: null
-
--- HelmRelease: cert-manager/cert-manager ConfigMap: cert-manager/cert-manager-webhook

+++ HelmRelease: cert-manager/cert-manager ConfigMap: cert-manager/cert-manager-webhook

@@ -1,14 +0,0 @@

----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cert-manager-webhook
-  namespace: cert-manager
-  labels:
-    app: webhook
-    app.kubernetes.io/name: webhook
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/component: webhook
-    app.kubernetes.io/managed-by: Helm
-data: null
-
--- HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-cainjector

+++ HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-cainjector

@@ -9,12 +9,13 @@

     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: cainjector
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 2
+  revisionHistoryLimit: null
   selector:
     matchLabels:
       app.kubernetes.io/name: cainjector
       app.kubernetes.io/instance: cert-manager
       app.kubernetes.io/component: cainjector
   template:
@@ -31,13 +32,13 @@

       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cert-manager-cainjector
-        image: quay.io/jetstack/cert-manager-cainjector:v1.13.3
+        image: quay.io/jetstack/cert-manager-cainjector:v1.14.1
         imagePullPolicy: IfNotPresent
         args:
         - --v=2
         - --leader-election-namespace=kube-system
         env:
         - name: POD_NAMESPACE
@@ -46,9 +47,10 @@

               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
       nodeSelector:
         kubernetes.io/os: linux
 
--- HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager

+++ HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager

@@ -9,12 +9,13 @@

     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: controller
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 2
+  revisionHistoryLimit: null
   selector:
     matchLabels:
       app.kubernetes.io/name: cert-manager
       app.kubernetes.io/instance: cert-manager
       app.kubernetes.io/component: controller
   template:
@@ -31,19 +32,19 @@

       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cert-manager-controller
-        image: quay.io/jetstack/cert-manager-controller:v1.13.3
+        image: quay.io/jetstack/cert-manager-controller:v1.14.1
         imagePullPolicy: IfNotPresent
         args:
         - --v=2
         - --cluster-resource-namespace=$(POD_NAMESPACE)
         - --leader-election-namespace=kube-system
-        - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.13.3
+        - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.14.1
         - --max-concurrent-challenges=60
         - --dns01-recursive-nameservers-only=true
         - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
         ports:
         - containerPort: 9402
           name: http-metrics
@@ -53,17 +54,28 @@

           protocol: TCP
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
         env:
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        livenessProbe:
+          httpGet:
+            port: http-healthz
+            path: /livez
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 15
+          successThreshold: 1
+          failureThreshold: 8
       nodeSelector:
         kubernetes.io/os: linux
       dnsPolicy: None
       dnsConfig:
         nameservers:
         - 1.1.1.1
--- HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-webhook

+++ HelmRelease: cert-manager/cert-manager Deployment: cert-manager/cert-manager-webhook

@@ -9,12 +9,13 @@

     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: webhook
     app.kubernetes.io/managed-by: Helm
 spec:
   replicas: 2
+  revisionHistoryLimit: null
   selector:
     matchLabels:
       app.kubernetes.io/name: webhook
       app.kubernetes.io/instance: cert-manager
       app.kubernetes.io/component: webhook
   template:
@@ -31,13 +32,13 @@

       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cert-manager-webhook
-        image: quay.io/jetstack/cert-manager-webhook:v1.13.3
+        image: quay.io/jetstack/cert-manager-webhook:v1.14.1
         imagePullPolicy: IfNotPresent
         args:
         - --v=2
         - --secure-port=10250
         - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
         - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
@@ -73,12 +74,13 @@

           failureThreshold: 3
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
         env:
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
       nodeSelector:
--- HelmRelease: cert-manager/cert-manager MutatingWebhookConfiguration: cert-manager/cert-manager-webhook

+++ HelmRelease: cert-manager/cert-manager MutatingWebhookConfiguration: cert-manager/cert-manager-webhook

@@ -13,24 +13,22 @@

     cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-ca
 webhooks:
 - name: webhook.cert-manager.io
   rules:
   - apiGroups:
     - cert-manager.io
-    - acme.cert-manager.io
     apiVersions:
     - v1
     operations:
     - CREATE
-    - UPDATE
     resources:
-    - '*/*'
+    - certificaterequests
   admissionReviewVersions:
   - v1
   matchPolicy: Equivalent
-  timeoutSeconds: 10
+  timeoutSeconds: 30
   failurePolicy: Fail
   sideEffects: None
   clientConfig:
     service:
       name: cert-manager-webhook
       namespace: cert-manager
--- HelmRelease: cert-manager/cert-manager ValidatingWebhookConfiguration: cert-manager/cert-manager-webhook

+++ HelmRelease: cert-manager/cert-manager ValidatingWebhookConfiguration: cert-manager/cert-manager-webhook

@@ -30,13 +30,13 @@

     - UPDATE
     resources:
     - '*/*'
   admissionReviewVersions:
   - v1
   matchPolicy: Equivalent
-  timeoutSeconds: 10
+  timeoutSeconds: 30
   failurePolicy: Fail
   sideEffects: None
   clientConfig:
     service:
       name: cert-manager-webhook
       namespace: cert-manager
--- HelmRelease: cert-manager/cert-manager Job: cert-manager/cert-manager-startupapicheck

+++ HelmRelease: cert-manager/cert-manager Job: cert-manager/cert-manager-startupapicheck

@@ -31,20 +31,22 @@

       securityContext:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
       - name: cert-manager-startupapicheck
-        image: quay.io/jetstack/cert-manager-ctl:v1.13.3
+        image: quay.io/jetstack/cert-manager-startupapicheck:v1.14.1
         imagePullPolicy: IfNotPresent
         args:
         - check
         - api
         - --wait=1m
+        - -v
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
       nodeSelector:
         kubernetes.io/os: linux