cert-manager v1.21.0

cert-manager v1.21 focuses on security hardening and advanced ACME features. It introduces support for ACME Renewal Information (ARI) for proactive renewals and AWS IAM authentication for Vault. This release also includes significant breaking changes to Helm RBAC and metrics configurations that require manual intervention during upgrade.

Default tokenrequest RBAC removed from Helm chart — Users who rely on cert-manager to automatically create tokens for its own ServiceAccount (e.g., in specific Vault or Route53 setups) must now create these RBAC rules manually or migrate to recommended authentication patterns. This prevents security over-privilege.

Metrics port name and path Helm values removed — You must remove 'prometheus.servicemonitor.targetPort', 'prometheus.servicemonitor.path', and 'prometheus.podmonitor.path' from your Helm values overrides before upgrading, or the upgrade will fail due to schema validation.

Experimental ACME Renewal Information (ARI) support — Enables cert-manager to renew certificates during mass revocations or CA key rollovers by following the ACME server's recommended renewal window, ensuring uninterrupted service during security incidents.

AWS IAM authentication for Vault issuer — Vault users on AWS can now use IAM Roles for Service Accounts (IRSA) or Pod Identity instead of managing long-lived static secrets, significantly improving the security posture of the Vault issuer.

Hardened RBAC for Challenges and Orders — Reduces the attack surface by preventing users with the 'edit' role from directly manipulating internal ACME resources, while still allowing them to manage the lifecycle of finalizers if needed.