chore(deps): update dependency cert-manager/cert-manager to v1.20.3

[scality-renovate]

This PR contains the following updates:

Package	Update	Change	Pending
cert-manager/cert-manager	patch	v1.20.2 → v1.20.3	v1.21.0

---

Release Notes

cert-manager/cert-manager (cert-manager/cert-manager)

v1.20.3

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release fixes a security issue (GHSA-8rvj-mm4h-c258, HIGH) where the default cert-manager-edit aggregate ClusterRole granted namespace users permission to create ACME Challenge and Order resources directly. A user who could create a Challenge referencing a ClusterIssuer could supply attacker-controlled solver configuration while cert-manager loaded credentials from the ClusterIssuer's namespace, bypassing Issuer solver selectors (dnsZones, dnsNames, matchLabels). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.

This release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs.

All users should upgrade.

[!WARNING]
Potentially breaking change: The cert-manager-edit aggregate ClusterRole no longer grants create for challenges.acme.cert-manager.io or create, patch, update for orders.acme.cert-manager.io. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate → CertificateRequest → Order → Challenge flow), you will need to grant those permissions explicitly.

Changes by Kind

Bug or Regression

• Security (HIGH): Remove Challenge create and Order create, patch, update verbs from the cert-manager-edit aggregate ClusterRole (GHSA-8rvj-mm4h-c258). (#​8940, @​wallrj-cyberark)
• Remove issuer owner reference from challenges blocking challenge garbage collection (#​8759, @​cert-manager-bot)

Other (Cleanup or Flake)

• Bump go to 1.26.3, other deps to fix several govulncheck issues (#​8789, @​SgtCoDFish)
• Update Go to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 (#​8926, @​wallrj-cyberark)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

Dependency Bump Evaluation

Version change: cert-manager/cert-manager v1.20.2 → v1.20.3 (patch)

Changes:

• Security fix (HIGH): GHSA-8rvj-mm4h-c258 — cert-manager-edit ClusterRole granted namespace users permission to create ACME Challenge/Order resources directly, potentially disclosing DNS credentials to attacker-controlled endpoints
• Bug fix: Remove issuer owner reference from Challenges that blocked garbage collection
• Go update: Bumps to Go 1.26.4 fixing CVE-2026-27145, CVE-2026-42504, CVE-2026-42507

Breaking changes: The cert-manager-edit aggregate ClusterRole no longer grants create for Challenges or create/patch/update for Orders. Not applicable to this project — node-warden-operator uses cert-manager solely for webhook certificate issuance and never creates Challenge or Order resources directly.

Security concerns: None introduced. This release fixes a HIGH severity security issue. Upgrading is recommended.

Impact on codebase: Minimal — the only change is the certmanagerVersion constant in test/utils/utils.go, which controls which cert-manager version is installed in the test cluster. No operator code or deployment manifests are affected.

CI status: Pre Merge checks (build, lint, test, test-e2e) are still in progress. Verify they pass before merging.

Recommendation: SAFE TO MERGE (after CI passes)

Notes: This is a security patch that all cert-manager users are advised to apply. The RBAC change is a hardening measure that does not affect this operator's usage pattern.

— Claude Code