Skip to content
Release Radar

trust-manager

Security

Distributes trust bundles across Kubernetes clusters

cert-manager/trust-managerWebsiteDocumentation
v0.25.076 days after v0.24.0
View on GitHub

Part of cert-manager

Release history

v0.25.0

CompareGitHub

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

What's Changed

This release is a feature release, but as usual, it contains various patches/fixes, test improvements, and dependency bumps.

⚠️ Since Debian Bullseye is now EOL, we've stopped pushing updates to our trust bundle based on Debian Bullseye. If you are still using this bundle, you should migrate to our currently supported bundle images based on public CA certificates in Debian Bookworm or Trixie (the current default).

Thanks to all contributors! ❤️ 🚀

Features

Fixes

Other

New Contributors

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.24.0...v0.25.0

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

This release is a feature release, but as usual, it contains various patches/fixes and dependency bumps.

Notable changes include a fix by @yugstar avoiding reconciling loops by ensuring the calculated trust bundle hash is deterministic when adding labels/annotations to the target configmaps/secrets. 💯 And trust-manager can now source CA certificates from configmap binaryData. 🚀

Our Helm chart now supports configuration of securityContexts for pods and containers, which has been highly requested by the community. A big thanks goes out to @MarcAntoineRaymond! ❤️

⚠️ Possibly breaking change in Helm chart values: if you currently set app.securityContext.seccompProfileEnabled, this value has been removed and replaced with a more generic mechanism for setting securityContexts.

What's Changed

Features

Fixes

Bumps / CI

New Contributors

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.23.0...v0.24.0

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

This release is a feature release, but as usual, it contains various patches/fixes and dependency bumps.

The most notable feature in this release is probably that trust-manager now provides a new trust-package bundle based on Debian Trixie. 💡 Note that the new trust-pkg-debian-trixie bundle is now the default trust package emitted by the Helm chart. For those of you still using our trust packages built from Debian Bullseye/Bookworm, we've just published new releases to fix vulnerabilites reported by scanners.

Our Helm chart has a new feature that allows a user to override the default webhook TLS certificate duration. We've also got a fix making it easier to use the trust-manager chart in an umbrella chart together with other cert-manager projects. This release also includes multiple fixes/inconsistencies in the Helm chart when using non-default values.

What's Changed

Features

Fixes

Bumps / CI

New Contributors

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.22.1...v0.23.0

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

This release is a patch release, bumping dependencies, Go version, and base images to address vulnerabilities reported by scanners.

The release also contains various non-user-facing changes, preparing for the migration from Bundle to ClusterBundle.

What's Changed

New Contributors

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.22.0...v0.22.1

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

This release includes a change which makes it much simpler to mirror container images to self-hosted registries.

There are also several CVE fixes including CVE-2026-27138, CVE-2026-27137, CVE-2026-27142 and CVE-2026-25679.

What's Changed

Features

Internal

Bumps / CI

New Contributors

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.21.1...v0.22.0

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

This release is primarily intended to fix CVE-2025-68121, but it includes several changes which have trickled in since v0.20.3

Notable Changes

Filter Non-CA Certs in Sources

There's a new .filterNonCACerts.enabled value available in the Helm chart, which will cause trust-manager to filter any non-CA certs found in sources. This logic relies on the isCa field of the basicConstraints X.509 extension only. The feature defaults to "off".

CRD Changes

The ClusterBundle CRD got a little stricter, to pass the Kube API Linter checks which we've enabled. We don't expect that this will change the use of the CRD for anyone, since the limits we've added are very permissive.

What's Changed

Functional / CRD Changes

Trust Packages

Tests / Docs

Upcoming Bundle Resource

Automated / CI

New Contributors

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.20.3...v0.21.0

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

This is a dependency bump update with a few vulnerabilities reported by various tools that have been fixed. Notably, this bump will fix CVE-2025-61729.

What's Changed

New Contributors

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.20.2...v0.20.3

trust-manager is the easiest way to manage security-critical TLS trust bundles in Kubernetes and OpenShift clusters.

This release is a patch release, upgrading Go from 1.25.1 to 1.25.3, fixing a range of CVEs: CVE-2025-61724, CVE-2025-58187, CVE-2025-47912, CVE-2025-58183, CVE-2025-61723, CVE-2025-58186, CVE-2025-58185, CVE-2025-58188, and CVE-2025-61725.

Furthermore, additional go dependencies were upgraded where possible.

What's Changed

Full Changelog: https://github.com/cert-manager/trust-manager/compare/v0.20.1...v0.20.2