cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

This is primarily a security release. It updates github.com/cert-manager/csi-lib to v0.12.0 and bumps all vulnerable dependencies reported by govulncheck, including google.golang.org/x/text (GO-2026-5970), google.golang.org/grpc (GO-2026-6061) and go.opentelemetry.io/otel (GHSA-5wrp-cwcj-q835), and the images are built with Go 1.26.5 to pick up the latest Go standard library security fixes.

The livenessprobe and csi-node-driver-registrar sidecar images have been updated to v2.19.0 and v2.17.0 respectively, and their versions are now kept up to date automatically by Renovate.

This release also adds new --gate-backoff-* flags and Helm values for tuning how csi-driver retries while waiting for pod readiness gates, and the readiness gate feature now reads pods from a node-scoped informer cache.

What's Changed

Important changes

• feat: readinessgate reads pods from a node-scoped informer cache by @patyogesh20 in #663
• wire csi-lib GateBackoffConfig as --gate-backoff-* flags and Helm values by @patyogesh20 in #682
• fix(deps): update misc go deps (includes github.com/cert-manager/csi-lib v0.12.0) by @renovate[bot] in #698
• chore(deps): update module golang.org/x/text to v0.39.0 [security] by @renovate[bot] in #703
• chore(deps): update module google.golang.org/grpc to v1.82.1 [security] by @renovate[bot] in #704
• chore(deps): update module go.opentelemetry.io/otel to v1.44.0 [security] by @renovate[bot] in #706
• chore: let Renovate manage the sidecar image tags in make/00_mod.mk by @wallrj in #715
• chore(deps): update registry.k8s.io/sig-storage/livenessprobe docker tag to v2.19.0 by @renovate[bot] in #718
• chore(deps): update registry.k8s.io/sig-storage/csi-node-driver-registrar docker tag to v2.17.0 by @renovate[bot] in #717

CI / Bumps

• chore(deps): update module golang.org/x/net to v0.55.0 [security] by @renovate[bot] in #653
• chore(deps): update module golang.org/x/crypto to v0.52.0 [security] by @renovate[bot] in #652
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #649
• chore(deps): update docker/login-action action to v4.2.0 by @renovate[bot] in #651
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #654
• chore(deps): update misc github actions to v6.0.3 by @renovate[bot] in #655
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #656
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #657
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #658
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #659
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #660
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #661
• fix(deps): update golang.org/x deps to v0.21.0 by @renovate[bot] in #662
• fix(deps): update misc go deps to v0.7.2 by @renovate[bot] in #664
• fix(deps): update github.com/onsi deps to v2.30.0 by @renovate[bot] in #665
• fix(deps): update kubernetes go patches to v0.36.2 by @renovate[bot] in #666
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #667
• fix(deps): update github.com/onsi deps by @renovate[bot] in #668
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #670
• chore(deps): update makefile modules to 7835ffe by @renovate[bot] in #671
• chore(deps): update makefile modules to 92aeb18 by @renovate[bot] in #673
• chore(deps): update makefile modules to 5d90d75 by @renovate[bot] in #674
• chore(deps): update misc github actions to v7 by @renovate[bot] in #675
• chore(deps): update makefile modules to 3968a05 by @renovate[bot] in #676
• chore(deps): update makefile modules to 6c59e94 by @renovate[bot] in #677
• chore(deps): update makefile modules to 2439727 by @renovate[bot] in #678
• chore(deps): update makefile modules to 5a6dfa5 by @renovate[bot] in #680
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.32.0 by @renovate[bot] in #679
• fix(deps): update module github.com/cert-manager/cert-manager to v1.20.3 by @renovate[bot] in #681
• fix(deps): update module github.com/onsi/gomega to v1.42.1 by @renovate[bot] in #683
• chore(deps): update actions/setup-go action to v6.5.0 by @renovate[bot] in #684
• fix(deps): update module software.sslmate.com/src/go-pkcs12 to v0.7.3 by @renovate[bot] in #686
• chore(deps): update makefile modules to 3475385 by @renovate[bot] in #685
• chore(deps): update makefile modules to fb0281c by @renovate[bot] in #687
• chore(deps): update makefile modules to 72b0d34 by @renovate[bot] in #688
• fix(deps): update module github.com/cert-manager/csi-lib to v0.11.0 by @renovate[bot] in #690
• chore(deps): update makefile modules to c9f456a by @renovate[bot] in #689
• chore(deps): update docker/login-action action to v4.3.0 by @renovate[bot] in #691
• chore(deps): update makefile modules to 6ec965f by @renovate[bot] in #692
• chore(deps): update docker/login-action action to v4.4.0 by @renovate[bot] in #693
• chore(deps): update makefile modules to 1a9e320 by @renovate[bot] in #694
• chore(deps): update makefile modules to e18d942 by @renovate[bot] in #695
• chore(deps): update makefile modules to 80a790b by @renovate[bot] in #696
• fix(deps): update module golang.org/x/sync to v0.22.0 by @renovate[bot] in #697
• chore(deps): update makefile modules to 2f12511 by @renovate[bot] in #699
• chore(deps): update makefile modules to 703bbcc by @renovate[bot] in #701
• fix(deps): update kubernetes go patches to v0.36.3 by @renovate[bot] in #707
• chore(deps): update makefile modules to 57b5681 by @renovate[bot] in #709
• chore(deps): update makefile modules to 21ae050 by @renovate[bot] in #710
• chore(deps): update actions/setup-go action to v7 by @renovate[bot] in #702
• chore(deps): update misc github actions by @renovate[bot] in #705
• chore(deps): update makefile modules to 556e163 by @renovate[bot] in #714
• fix(deps): update module k8s.io/kubectl to v0.36.3 by @renovate[bot] in #708

Full Changelog: v0.15.0...v0.16.0

cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

This release includes some follow up work to deferred issuance from @patyogesh20 including a really cool pod readiness gate mechanic specifying what csi-driver should wait for when issuing.

It also includes some handy new flags for controlling Kubernetes API ratelimiting.

What's Changed

Important changes

• fix: rename image helper to avoid umbrella chart conflicts by @FelixPhipps in #633
• Allow setting hostNetwork values in helm chart by @BojanZelic in #616
• feat: add --kube-api-qps and --kube-api-burst flags to CSI driver by @spuzirev in #627
• feat: add --pod-readiness-gate flag to defer certificate issuance until pod conditions are met by @patyogesh20 in #638

CI / Bumps

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #628
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #631
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.28.2 by @renovate[bot] in #632
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #634
• fix(deps): update github.com/onsi deps by @renovate[bot] in #635
• fix(deps): update kubernetes go deps by @renovate[bot] in #629
• Bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 in the go_modules group across 1 directory by @dependabot[bot] in #630
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #637
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #639
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #640
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #641
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #643
• fix(deps): update module sigs.k8s.io/controller-runtime to v0.24.1 by @renovate[bot] in #644
• fix(deps): update kubernetes go patches to v0.36.1 by @renovate[bot] in #645
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #647
• fix(deps): update github.com/onsi deps by @renovate[bot] in #648

New Contributors

• @BojanZelic made their first contribution in #616
• @spuzirev made their first contribution in #627

Full Changelog: v0.14.0...v0.15.0

cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

This release is primarily for the brilliant contribution by @patyogesh20 in #619 - it's now possible to tell csi-driver to not block pod startup even if the cert being issued is not ready. This requires careful handling in application code, but it allows for new potential such as IP-address certificates in IPv6-only clusters. Many thanks to @patyogesh20 for the patient work on this!

There are also a variety of updated dependencies and fixed CVEs.

What's Changed

• 🚀 feat: add --continue-on-not-ready flag to CSI driver (disabled by default) by @patyogesh20 in #619

• Add 'Preparing for a Release' section to the RELEASE.md docs by @inteon in #599

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #601

• fix(deps): update module github.com/cert-manager/cert-manager to v1.20.0 by @renovate[bot] in #600

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #602

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #603

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #606

• fix(deps): update kubernetes go patches to v0.35.3 by @renovate[bot] in #605

• fix(deps): update module github.com/cert-manager/cert-manager to v1.20.1 by @renovate[bot] in #608

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #609

• chore(deps): update actions/setup-go action to v6.4.0 by @renovate[bot] in #610

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #611

• chore(deps): update docker/login-action action to v4.1.0 by @renovate[bot] in #612

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #614

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #615

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #617

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #621

• fix(deps): update module software.sslmate.com/src/go-pkcs12 to v0.7.1 by @renovate[bot] in #620

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #623

• fix(deps): update module github.com/cert-manager/cert-manager to v1.20.2 by @renovate[bot] in #622

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #624

• fix(deps): update kubernetes go patches to v0.35.4 by @renovate[bot] in #625

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #626

New Contributors

• @patyogesh20 made their first contribution in #619

Full Changelog: v0.13.0...v0.14.0

cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

⚠️ starting from this version, we no longer use the registry.k8s.io/sig-storage/livenessprobe and registry.k8s.io/sig-storage/csi-node-driver-registrar images directly in our Helm chart. We now use our own copies quay.io/jetstack/livenessprobe and quay.io/jetstack/csi-node-driver-registrar instead.

This release includes a change which makes it much simpler to mirror container images to self-hosted registries.

There are also several CVE fixes including CVE-2026-27138, CVE-2026-27137, CVE-2026-27142 and CVE-2026-25679.

What's Changed

Features

• Add imageRegistry/imageNamespace to Helm chart image settings by @FelixPhipps in #586

Bugfixes

• Update Go documentation badge from godoc.org to pkg.go.dev by @archy-rock3t-cloud in #591
• Fix typo in crane cp command by @inteon in #598

Bumps / CI

• chore(deps): update actions/setup-go action to v6.3.0 by @renovate[bot] in #587
• fix(deps): update module github.com/cert-manager/cert-manager to v1.19.4 by @renovate[bot] in #585
• fix(deps): update kubernetes go patches to v0.35.2 by @renovate[bot] in #588
• fix(deps): update module sigs.k8s.io/controller-runtime to v0.23.2 by @renovate[bot] in #593
• fix(deps): update module sigs.k8s.io/controller-runtime to v0.23.3 by @renovate[bot] in #594
• fix(deps): update module golang.org/x/sync to v0.20.0 by @renovate[bot] in #596
• chore(deps): update docker/login-action action to v4 by @renovate[bot] in #592
• fix(deps): update module k8s.io/klog/v2 to v2.140.0 by @renovate[bot] in #595
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #584
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #589
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #590
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #597

New Contributors

• @FelixPhipps made their first contribution in #586
• @archy-rock3t-cloud made their first contribution in #591

Full Changelog: v0.12.1...v0.13.0

cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

This is a patch release mainly to address CVE-2025-68121 and other reported vulnerabilities. All users should upgrade.

What's Changed

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #541
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #542
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #543
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #544
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #546
• fix(deps): update kubernetes go deps to v0.35.0 by @renovate[bot] in #545
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #548
• fix(deps): update module software.sslmate.com/src/go-pkcs12 to v0.7.0 by @renovate[bot] in #547
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #549
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #550
• fix(deps): update github.com/onsi deps by @renovate[bot] in #551
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #552
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #553
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #554
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.27.5 by @renovate[bot] in #555
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #557
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #559
• fix(deps): update module sigs.k8s.io/controller-runtime to v0.23.0 by @renovate[bot] in #558
• chore(deps): update actions/setup-go action to v6.2.0 by @renovate[bot] in #556
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #560
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #562
• chore(deps): update actions/checkout action to v6.0.2 by @renovate[bot] in #561
• fix(deps): update module sigs.k8s.io/controller-runtime to v0.23.1 by @renovate[bot] in #563
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #564
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.28.0 by @renovate[bot] in #566
• fix(deps): update github.com/onsi deps by @renovate[bot] in #567
• chore(deps): update docker/login-action digest to c94ce9f by @renovate[bot] in #565
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #568
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #571
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #572
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #573
• fix(deps): update module github.com/cert-manager/cert-manager to v1.19.3 by @renovate[bot] in #569
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #574
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #575
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #577
• fix(deps): update kubernetes go patches to v0.35.1 by @renovate[bot] in #576
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #578
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #579
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #580
• chore(deps): update registry.k8s.io/sig-storage/livenessprobe docker tag to v2.18.0 by @renovate[bot] in #582
• chore(deps): update registry.k8s.io/sig-storage/csi-node-driver-registrar docker tag to v2.16.0 by @renovate[bot] in #581

Full Changelog: v0.12.0...v0.12.1

cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

This release has been built using Go v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.
This release also includes multiple dependency upgrades for improved security and stability, including updates to Kubernetes utilities, controller-runtime, CSI libraries, and key Go modules (ginkgo, cobra, sync, crypto, and runc).
Thanks to @erikgb for setting up Renovate to automate all the dependency upgrades.
Additionally, Helm packaging has been migrated from legacy charts to OCI format.

⚠️ csi-driver depends on two Kubernetes maintained side-car containers: kubernetes-csi/node-driver-registrar, and kubernetes-csi/livenessprobe, which had not been updated at the time of this release.

OCI_MANAGER_IMAGE: quay.io/jetstack/cert-manager-csi-driver
OCI_MANAGER_TAG: v0.12.0
HELM_CHART_IMAGE: quay.io/jetstack/charts/cert-manager-csi-driver
HELM_CHART_VERSION: v0.12.0

New Contributors

• @wallrj-cyberark made their first contribution in #540

Full Changelog: v0.11.1...v0.12.0

cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

This release is a patch release, upgrading Go from 1.25.1 to 1.25.3, fixing a range of CVEs: CVE-2025-61724, CVE-2025-58187, CVE-2025-47912, CVE-2025-58183, CVE-2025-61723, CVE-2025-58186, CVE-2025-58185, CVE-2025-58188, and CVE-2025-61725.

Furthermore, additional go dependencies were upgraded where possible.

Full Changelog: v0.11.0...v0.11.1

cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

v0.11.0 is a feature release containing the ability to specify a key type for the certificate you're mounting with csi-driver, allowing
the use of ECDSA and Ed25519 certs using csi-driver.

To generate a P-256 certificate, try the following:

apiVersion: v1
kind: Pod
metadata:
  name: my-csi-app
  namespace: sandbox
  labels:
    app: my-csi-app
spec:
  containers:
    - name: my-frontend
      image: busybox
      volumeMounts:
      - mountPath: "/tls"
        name: tls
      command: [ "sleep", "1000000" ]
  volumes:
    - name: tls
      csi:
        driver: csi.cert-manager.io
        readOnly: true
        volumeAttributes:
          csi.cert-manager.io/issuer-name: my-issuer
          csi.cert-manager.io/issuer-kind: Issuer
          csi.cert-manager.io/dns-names: ${POD_NAME}.${POD_NAMESPACE}.svc.cluster.local
          csi.cert-manager.io/key-algorithm: ECDSA

Huge thanks to @matthewpi for the awesome contribution!

What's Changed

Features

• 🚀 Add support for ECDSA and Ed25519 algorithms, make key size configurable by @matthewpi in #404

Dependency Bumps

• Bump the all group across 1 directory with 2 updates by @dependabot[bot] in #422
• Bump the all group across 1 directory with 8 updates by @dependabot[bot] in #428
• Bump the all group with 2 updates by @dependabot[bot] in #431

Makefile Modules Updates

• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #420
• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #423
• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #424
• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #426
• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #429
• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #430
• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #432
• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #433
• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #434
• [CI] Merge self-upgrade-main into main by @github-actions[bot] in #435
• [CI] Merge self-upgrade-main into main by @github-actions[bot] (and @SgtCoDFish) in #436

New Contributors

• @matthewpi made their first contribution in #404 ⭐

Full Changelog: v0.10.4...v0.11.0

cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

This release contains miscellaneous bug fixes and dependency updates.
It is built with Go 1.24.4 which fixes the following vulnerabilities: CVE-2025-22874, CVE-2025-0913, and CVE-2025-4673.

helm inspect chart cert-manager-csi-driver --repo https://charts.jetstack.io --version v0.10.4

What's Changed

• Bump sidecar images in preparation for release by @wallrj in #419

Dependabot

• Bump the all group across 1 directory with 10 updates by @dependabot in #415
• Bump the all group with 7 updates by @dependabot in #418

makefile-modules

• [CI] Merge self-upgrade-main into main by @github-actions in #407
• [CI] Merge self-upgrade-main into main by @github-actions in #408
• [CI] Merge self-upgrade-main into main by @github-actions in #409
• [CI] Merge self-upgrade-main into main by @github-actions in #411
• [CI] Merge self-upgrade-main into main by @github-actions in #414
• [CI] Merge self-upgrade-main into main by @github-actions in #416
• [CI] Merge self-upgrade-main into main by @github-actions in #417

Full Changelog: v0.10.3...v0.10.4

cert-manager-csi-driver enables issuing secretless X.509 certificates for pods using cert-manager!

This is a patch release with dependency bumps, aiming to fix "vulnerabilities" reported by scanners. We don't know of any specific vulnerability in csi-driver, but we think it's important to make occasional releases with patched dependencies.

This new version can be installed as follows:

helm upgrade cert-manager-csi-driver jetstack/cert-manager-csi-driver \
  --install \
  --version v0.10.3 \
  --namespace cert-manager \
  --wait

What's Changed

Features

• Add dependency licenses to repo and OCI image by @inteon in #398

Dependency upgrades

• Bump sigs.k8s.io/controller-runtime from 0.19.4 to 0.20.0 in the all group by @dependabot in #356
• Bump other images, add note to release process about checking them by @SgtCoDFish in #357
• Bump the all group across 1 directory with 4 updates by @dependabot in #365
• Bump golang.org/x/sync from 0.10.0 to 0.11.0 in the all group by @dependabot in #367
• Bump the all group across 1 directory with 11 updates by @dependabot in #377
• Bump golang.org/x/net from 0.35.0 to 0.36.0 in the go_modules group by @dependabot in #381
• Bump the all group across 1 directory with 10 updates by @dependabot in #386
• Bump github.com/onsi/gomega from 1.36.3 to 1.37.0 in the all group by @dependabot in #387
• Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group by @dependabot in #392
• Bump the all group across 1 directory with 7 updates by @dependabot in #396

Makefile module upgrades

#358, #360, #361, #363, #364, #366, #368, #369, #373, #375, #376, #378, #388, #389, #390, #391, #393, #395, #397, #399, #400, #401, #402, #403, #405

Full Changelog: v0.10.2...v0.10.3