Skip to content

OpenShift Routes for cert-manager releases

Learn about current and past releases of OpenShift Routes for cert-manager.

Helm charts are public, but container images require a pull secret. See Configuring access to the NGTS registry.

The latest stable version is v0.10.0
  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.10.0
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes-fips:v0.10.0
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.10.0
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.10.0

Release 0.10.0

OpenShift Routes for cert-manager 0.10.0 was released on 30 July, 2026.

Key features

  • Stronger ownership verification for route certificates

    OpenShift Routes for cert-manager now runs additional checks to confirm that a certificate belongs to a route before copying its private key into the route's spec.tls.key field. Previously, the ownerReferences field alone could establish trust, so any user or service account able to create certificates in a namespace could forge this field to get a certificate adopted and expose its private key.

    This change is most relevant in clusters where certificate creation permissions are shared by teams or tenants in the same namespace.

    To confirm certificate ownership, the following are now required:

    • Genuine controller reference: The apiVersion, kind, uid, and controller fields (which Kubernetes sets on the certificate's controller reference) must match the route, and controller must be true.

    • Matching Secret name: The certificate's Secret name must match the name OpenShift Routes for cert-manager would generate.

Other

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.10.0
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes-fips:v0.10.0
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.10.0
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.10.0

Release 0.9.0

OpenShift Routes for cert-manager 0.9.0 was released on 9 March, 2026.

Key features

  • Region-aligned Helm charts

    Helm charts now reference container images from their regional registry instead of the US registry. For example, an EU Helm chart now references images from the EU registry. Previously all Helm charts referenced images from the US registry, which required you to update the Helm values file before installation.

  • Dedicated FIPS Helm charts

    The FIPS distribution now has dedicated Helm charts. Previously, you had to use the standard Helm chart and reference the FIPS image in the Helm values file before installation.

    To use FIPS, append -fips to the OCI registry chart URL in the Helm command, for example oci://registry-example.com/charts/component-example-fips.

  • Simplified registry configuration

    Helm charts now support installation from your custom OCI registry using new imageRegistry and imageNamespace values in the Helm values file. Previously, you had to specify the full image repository path.

    We'll continue to support the legacy image.repository setting and it will take precedence if you use both methods.

    The following examples show the new and legacy methods.

    imagePullSecrets:
  - name: ngts-image-pull-secret

imageRegistry: myregistry.example.com # New registry value
imageNamespace: openshift-routes # New namespace value

    image:
  repository: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes

imagePullSecrets:
  - name: ngts-image-pull-secret

Fixes and updates

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.9.0
  • Helm chart (FIPS): oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes-fips:v0.9.0
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.9.0
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.9.0

Release 0.8.5

OpenShift Routes for cert-manager 0.8.5 was released on 27 February, 2026.

Fixes and updates

  • This patch release includes dependency updates to address CVE-2025-68121.

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.8.5
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.8.5
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.8.5

Release 0.8.4

OpenShift Routes for cert-manager 0.8.4 was released on 10 December, 2025.

Fixes and updates

  • The following dependencies were updated in this release:

    • cert-manager was updated to v1.19.2
    • k8s.io/api was updated to v0.34.3
    • k8s.io/apimachinery was updated to v0.34.3
    • k8s.io/cli-runtime was updated to v0.34.3
    • k8s.io/client-go was updated to v0.34.3
    • k8s.io/component-base was updated to v0.34.3
    • github.com/spf13/cobra was updated to v1.10.2
    • github.com/openshift/client-go was updated to 96a6cbc
    • github.com/openshift/api was updated to 5eb46a7
    • sigs.k8s.io/controller-runtime was updated to v0.22.4
    • golang.org/x/crypto was updated to v0.45.0

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.8.4
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.8.4
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.8.4

Release 0.8.3

OpenShift Routes for cert-manager 0.8.3 was released on 17 October, 2025.

Fixes and updates

  • This patch release upgrades the version of Go used to 1.25.3 in order to address the following non-critical CVEs: CVE-2025-61724, CVE-2025-58187, CVE-2025-47912, CVE-2025-58183, CVE-2025-61723, CVE-2025-58186, CVE-2025-58185, CVE-2025-58188, and CVE-2025-61725.

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.8.3
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.8.3
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.8.3

Release 0.8.2

OpenShift Routes for cert-manager 0.8.2 was released on 20 August, 2025.

Fixes and updates

  • The following dependencies were updated in this release:

    • cert-manager was updated to v1.18.2
    • github.com/spf13/pflag was updated to v1.0.7
    • k8s.io/api was updated to v0.33.4
    • k8s.io/apimachinery was updated to v0.33.4
    • k8s.io/client-go was updated to v0.33.4
    • k8s.io/cli-runtime was updated to v0.33.4
    • k8s.io/component-base was updated to v0.33.4

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.8.2
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.8.2
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.8.2

Release 0.8.1

OpenShift Routes for cert-manager 0.8.1 was released on 17 June, 2025.

Fixes and updates

  • The following dependencies were updated in this release:

    • cert-manager was updated to v1.18.0
    • github.com/go-logr/logr was updated to v1.4.3
    • github.com/spf13/cobra was updated to v1.9.1
    • github.com/spf13/pflag was updated to v1.0.6
    • k8s.io/api was updated to v0.33.1
    • k8s.io/apimachinery was updated to v0.33.0
    • k8s.io/client-go was updated to v0.33.0
    • k8s.io/cli-runtime was updated to v0.33.1
    • k8s.io/component-base was updated to v0.33.1
    • sigs.k8s.io/controller-runtime was updated to v0.21.0
    • golang.org/x/net was updated to v0.36.0

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.8.1
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.8.1
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.8.1

Release 0.8.0

OpenShift Routes for cert-manager 0.8.0 was released on 17 January, 2025.

Fixes and updates

  • This release of OpenShift Routes for cert-manager fixes an issue affecting routes with certificate chains containing more than two certificates.

  • The following dependencies were updated in this release:

    • cert-manager was updated to v1.16.3
    • k8s.io/api was updated to v0.32.1
    • k8s.io/apimachinery was updated to v0.32.1
    • k8s.io/cli-runtime was updated to v0.32.1
    • k8s.io/client-go was updated to v0.32.1
    • k8s.io/component-base was updated to v0.32.1
    • sigs.k8s.io/controller-runtime was updated to v0.20.0
    • golang.org/x/crypto was updated to v0.32.0
    • golang.org/x/net was updated to v0.34.0
    • golang.org/x/sys was updated to v0.29.0
    • golang.org/x/term was updated to v0.28.0

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.8.0
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.8.0
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.8.0

Release 0.7.1

OpenShift Routes for cert-manager 0.7.1 was released on 24 October, 2024.

Fixes and updates

  • This patch release fixes an issue where the renew-before annotation was being set on certificates with a value of zero.

  • The following dependencies were updated in this release:

    • cert-manager was updated to v0.16.1
    • k8s.io/api was updated to v0.31.2
    • k8s.io/apimachinery was updated to v0.31.2
    • k8s.io/cli-runtime was updated to v0.31.2
    • k8s.io/client-go was updated to v0.31.2
    • k8s.io/component-base was updated to v0.31.2

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.7.1
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.7.1
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.7.1

Release 0.7.0

OpenShift Routes for cert-manager 0.7.0 was released on 3 October, 2024.

Key features

  • Issuing via Certificate Resources

    Previously, OpenShift Routes for cert-manager worked by creating cert-manager CertificateRequest resources based on the annotations added to OpenShift Route resources.

    To address issues this caused, OpenShift Routes for cert-manager will now create cert-manager Certificate resources instead, which dramatically simplifies the logic in OpenShift Routes for cert-manager and provides several benefits:

    • Metrics are exposed by cert-manager for Certificate resources, improving observability.
    • Certificate resources are much more user friendly to read and understand.
    • Issued certificates are also stored in Kubernetes Secret resources, allowing use in your applications as well as on Routes.
    Read before upgrading

    Most users should be able to upgrade using Helm without seeing much difference in behaviour. Existing annotated Routes with certificates will continue to function as before. When reissuance is triggered, the Route should be updated using a Certificate with no user interaction.

    Given the nature of the change, however, it's advisable to check the state of issued certificates on your Route resources to be sure that they're being renewed. If you find any problems, please contact CyberArk.

    It's important to note that:

    • You must upgrade properly. There are important RBAC changes which come with the upgrade. Without those changes, OpenShift Routes for cert-manager will fail to issue any certificate.
    • If you're using cert-manager's approval mechanism, the CertificateRequest resources will have different names to those they had before. The names now will be deterministic per-route.

  • New annotations supported

    OpenShift Routes for cert-manager now supports more annotations on routes, allowing greater flexibility in issuing certificates:

    • cert-manager.io/private-key-algorithm now supports Ed25519 keys.
    • cert-manager.io/private-key-rotation-policy allows specifying how private keys should be rotated. Set this to Always unless you've got a good reason not to.
    • cert-manager.io/revision-history-limit controls how many CertificateRequests should be preserved when Certificates are (re-)issued. Set this to a low number to reduce cluster clutter.

Fixes and updates

  • A logging issue was fixed where %s is presented.

  • The following dependencies were updated in this release:

    • k8s.io/api was updated to v0.31.1
    • k8s.io/apimachinery was updated to v0.31.1
    • k8s.io/cli-runtime was updated to v0.31.1
    • k8s.io/client-go was updated to v0.31.1
    • k8s.io/component-base was updated to v0.31.1

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.7.0
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.7.0
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.7.0

Release 0.6.1

OpenShift Routes for cert-manager 0.6.1 was released on 12 September, 2024.

Fixes and updates

  • A v-prefixed value is now used for appVersion in the Helm chart to match the controller's image tag. No user action is required.
  • New fields, such as RouteHTTPHeaders, were added to Routes, which are affected by OpenShift Routes for cert-manager during synchronization and updates. Dependencies were updated to accommodate these changes.

  • The following dependencies were updated in this release:

    • cert-manager was updated to v1.15.3
    • k8s.io/api was updated to 0.31.0
    • k8s.io/apimachinery was updated to v0.31.0
    • k8s.io/cli-runtime was updated to v0.31.0
    • k8s.io/client-go was updated to v0.31.0
    • sigs.k8s.io/controller-runtime was updated to 0.19.0

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.6.1
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.6.1
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.6.1

Release 0.6.0

OpenShift Routes for cert-manager 0.6.0 was released on 13 August, 2024.

Key features

  • New Helm fields

    You can now use the namespace field in values.yaml for configuring the destination namespace. This is useful in the context of Helm subcharts.

    A new omitHelmLabels field was also added so that users can generate static manifests without Helm-specific labels.

  • Release process changes

    The project now relies on Makefile modules like the other projects under the cert-manager org. The changes are:

    The file static/cert-manager-openshift-routes.yaml is no longer present in the repository. You now have to template your own manifests, for example:

    oc apply -f <(helm template openshift-routes -n cert-manager oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes --set omitHelmLabels=true --version 0.6.0)

Downloads

  • Helm chart: oci://registry.ngts.paloaltonetworks.com/charts/openshift-routes:v0.6.0
  • Container image: registry.ngts.paloaltonetworks.com/openshift-routes/cert-manager-openshift-routes:v0.6.0
  • FIPS image: registry.ngts.paloaltonetworks.com/openshift-routes/openshift-routes-fips:v0.6.0