OpenShift Routes for cert-manager releases¶

OpenShift Routes for cert-manager provides OpenShift Route support for cert-manager. Learn about current and past releases of OpenShift Routes for cert-manager.

Latest OpenShift Routes for cert-manager release¶

The latest stable release of OpenShift Routes for cert-manager is v0.10.0.

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.10.0
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.10.0
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.10.0
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.10.0

Release 0.10.0¶

OpenShift Routes for cert-manager 0.10.0 was released on 30 July, 2026.

Key features¶

• Stronger ownership verification for route certificates

  OpenShift Routes for cert-manager now runs additional checks to confirm that a certificate belongs to a route before copying its private key into the route's spec.tls.key field. Previously, the ownerReferences field alone could establish trust, so any user or service account able to create certificates in a namespace could forge this field to get a certificate adopted and expose its private key.

  This change is most relevant in clusters where certificate creation permissions are shared by teams or tenants in the same namespace.

  To confirm certificate ownership, the following are now required:

  • Genuine controller reference: The apiVersion, kind, uid, and controller fields (which Kubernetes sets on the certificate's controller reference) must match the route, and controller must be true.

  • Matching Secret name: The certificate's Secret name must match the name OpenShift Routes for cert-manager would generate.

Other¶

• Dependency updates resolving the following high-severity CVEs in the Go standard library and third-party modules: CVE-2026-27145, CVE-2026-29181, CVE-2026-32280, CVE-2026-32283, CVE-2026-32288, CVE-2026-33811, CVE-2026-33814, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-42504, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, and CVE-2026-46598.
• Update github.com/cert-manager/cert-manager to v1.21.1.
• Add documentation to clarify that OpenShift Routes for cert-manager is not designed to be a security boundary between tenants sharing a namespace. See Configuring OpenShift Routes for cert-manager.

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.10.0
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.10.0
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.10.0
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.10.0

Release 0.9.0¶

OpenShift Routes for cert-manager 0.9.0 was released on 9 March, 2026.

Key features¶

• Region-aligned Helm charts

  Helm charts now reference container images from their regional registry instead of the US registry. For example, an EU Helm chart now references images from the EU registry. Previously all Helm charts referenced images from the US registry, which required you to update the Helm values file before installation.

• Dedicated FIPS Helm charts

  The FIPS distribution now has dedicated Helm charts. Previously, you had to use the standard Helm chart and reference the FIPS image in the Helm values file before installation.

  To use FIPS, append -fips to the OCI registry chart URL in the Helm command, for example oci://registry-example.com/charts/component-example-fips.

• Simplified registry configuration

  Helm charts now support installation from your custom OCI registry using new imageRegistry and imageNamespace values in the Helm values file. Previously, you had to specify the full image repository path.

  We'll continue to support the legacy image.repository setting and it will take precedence if you use both methods.

  The following examples show the new and legacy methods.

  New methodLegacy method

  imagePullSecrets:
    - name: venafi-image-pull-secret
  
  imageRegistry: myregistry.example.com # New registry value
  imageNamespace: openshift-routes # New namespace value
  

  image:
    repository: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes
  
  imagePullSecrets:
    - name: venafi-image-pull-secret
  

Other¶

• Address CVE-2026-27138, CVE-2026-27137, CVE-2026-27142, and CVE-2026-25679.
• Update github.com/cert-manager to v1.19.4.

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.9.0
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.9.0
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.9.0
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.9.0

Release 0.8.5¶

OpenShift Routes for cert-manager 0.8.5 was released on 27 February, 2026.

Key features¶

• This patch release includes dependency updates to address CVE-2025-68121.

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.8.5
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.8.5
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.8.5
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.8.5

Release 0.8.4¶

OpenShift Routes for cert-manager 0.8.4 was released on 10 December, 2025.

Key features¶

• The following dependencies were updated in this release:

  • cert-manager was updated to v1.19.2
  • k8s.io/api was updated to v0.34.3
  • k8s.io/apimachinery was updated to v0.34.3
  • k8s.io/cli-runtime was updated to v0.34.3
  • k8s.io/client-go was updated to v0.34.3
  • k8s.io/component-base was updated to v0.34.3
  • github.com/spf13/cobra was updated to v1.10.2
  • github.com/openshift/client-go was updated to 96a6cbc
  • github.com/openshift/api was updated to 5eb46a7
  • sigs.k8s.io/controller-runtime was updated to v0.22.4
  • golang.org/x/crypto was updated to v0.45.0

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.8.4
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.8.4
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.8.4
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.8.4

Release 0.8.3¶

OpenShift Routes for cert-manager 0.8.3 was released on 17 October, 2025.

Key features¶

• This patch release upgrades the version of Go used to 1.25.3 in order to address the following non-critical CVEs: CVE-2025-61724, CVE-2025-58187, CVE-2025-47912, CVE-2025-58183, CVE-2025-61723, CVE-2025-58186, CVE-2025-58185, CVE-2025-58188, and CVE-2025-61725.

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.8.3
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.8.3
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.8.3
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.8.3

Release 0.8.2¶

OpenShift Routes for cert-manager 0.8.2 was released on 20 August, 2025.

Key features¶

• The following dependencies were updated in this release:

  • cert-manager was updated to v1.18.2
  • github.com/spf13/pflag was updated to v1.0.7
  • k8s.io/api was updated to v0.33.4
  • k8s.io/apimachinery was updated to v0.33.4
  • k8s.io/client-go was updated to v0.33.4
  • k8s.io/cli-runtime was updated to v0.33.4
  • k8s.io/component-base was updated to v0.33.4

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.8.2
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.8.2
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.8.2
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.8.2

Release 0.8.1¶

OpenShift Routes for cert-manager 0.8.1 was released on 17 June, 2025.

Key features¶

• The following dependencies were updated in this release:

  • cert-manager was updated to v1.18.0
  • github.com/go-logr/logr was updated to v1.4.3
  • github.com/spf13/cobra was updated to v1.9.1
  • github.com/spf13/pflag was updated to v1.0.6
  • k8s.io/api was updated to v0.33.1
  • k8s.io/apimachinery was updated to v0.33.0
  • k8s.io/client-go was updated to v0.33.0
  • k8s.io/cli-runtime was updated to v0.33.1
  • k8s.io/component-base was updated to v0.33.1
  • sigs.k8s.io/controller-runtime was updated to v0.21.0
  • golang.org/x/net was updated to v0.36.0

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.8.1
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.8.1
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.8.1
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.8.1

Release 0.8.0¶

OpenShift Routes for cert-manager 0.8.0 was released on January 17, 2025.

Key features¶

• This release of OpenShift Routes for cert-manager fixes an issue affecting routes with certificate chains containing more than two certificates.

• The following dependencies were updated in this release:

  • cert-manager was updated to v1.16.3
  • k8s.io/api was updated to v0.32.1
  • k8s.io/apimachinery was updated to v0.32.1
  • k8s.io/cli-runtime was updated to v0.32.1
  • k8s.io/client-go was updated to v0.32.1
  • k8s.io/component-base was updated to v0.32.1
  • sigs.k8s.io/controller-runtime was updated to v0.20.0
  • golang.org/x/crypto was updated to v0.32.0
  • golang.org/x/net was updated to v0.34.0
  • golang.org/x/sys was updated to v0.29.0
  • golang.org/x/term was updated to v0.28.0

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.8.0
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.8.0
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.8.0
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.8.0

Release 0.7.1¶

OpenShift Routes for cert-manager 0.7.1 was released on 24 October 2024.

Key features¶

• This patch release fixes an issue where the renew-before annotation was being set on certificates with a value of zero.

• The following dependencies were updated in this release:

  • cert-manager was updated to v0.16.1
  • k8s.io/api was updated to v0.31.2
  • k8s.io/apimachinery was updated to v0.31.2
  • k8s.io/cli-runtime was updated to v0.31.2
  • k8s.io/client-go was updated to v0.31.2
  • k8s.io/component-base was updated to v0.31.2

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.7.1
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.7.1
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.7.1
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.7.1

Release 0.7.0¶

OpenShift Routes for cert-manager 0.7.0 was released on 3 October 2024.

Key features¶

• Issuing via Certificate Resources

  Previously, OpenShift Routes for cert-manager worked by creating cert-manager CertificateRequest resources based on the annotations added to OpenShift Route resources.

  To address issues this caused, OpenShift Routes for cert-manager will now create cert-manager Certificate resources instead, which dramatically simplifies the login in OpenShift Routes for cert-manager and provides several benefits:

  • Metrics are exposed by cert-manager for Certificate resources, improving observability.
  • Certificate resources are much more user friendly to read and understand.
  • Issued certificates are also stored in Kubernetes Secret resources, allowing use in your applications as well as on Routes.

  Read before upgrading

  Most users should be able to upgrade using Helm without seeing much difference in behaviour. Existing annotated Routes with certificates will continue to function as before. When reissuance is triggered, the Route should be updated using a Certificate with no user interaction.

  Given the nature of the change, however, it's advisable to check the state of issued certificates on your Route resources to be sure that they're being renewed. If you find any problems, please contact CyberArk.

  It's important to note that:

  • You must upgrade properly. There are important RBAC changes which come with the upgrade. Without those changes, OpenShift Routes for cert-manager will fail to issue any certificate.
  • If you're using cert-manager's approval mechanism, the CertificateRequest resources will have different names to those they had before. The names now will be deterministic per-route.

• New annotations supported

  OpenShift Routes for cert-manager now supports more annotations on routes, allowing greater flexibility in issuing certificates:

  • cert-manager.io/private-key-algorithm now now supports Ed25519 keys.
  • cert-manager.io/private-key-rotation-policy allows specifying how private keys should be rotated. Set this to Always unless you've got a good reason not to.
  • cert-manager.io/revision-history-limit controls how many CertificateRequests should be preserved when Certificates are (re-)issued. Set this to a low number to reduce cluster clutter.

• Dependency updates

  The following dependencies were updated in this release:

  • k8s.io/api was updated to v0.31.1
  • k8s.io/apimachinery was updated to v0.31.1
  • k8s.io/cli-runtime was updated to v0.31.1
  • k8s.io/client-go was updated to v0.31.1
  • k8s.io/component-base was updated to v0.31.1

Bug fixes¶

• A logging issue was fixed where %s is presented.

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.7.0
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.7.0
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.7.0
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.7.0

Release 0.6.1¶

OpenShift Routes for cert-manager 0.6.1 was released on 12 September 2024.

Key features¶

• Helm chart updates A v-prefixed value is now used for appVersion in the Helm chart to match the controller's image tag. No user action is required.

• Dependency updates

  New fields, such as RouteHTTPHeaders, were added to Routes, which are affected by OpenShift Routes for cert-manager during synchronization and updates. Dependencies were updated to accommodate these changes.

  The following dependencies were updated in this release:

  • cert-manager was updated to v1.15.3
  • k8s.io/api was updated to 0.31.0
  • k8s.io/apimachinery was updated to v0.31.0
  • k8s.io/cli-runtime was updated to v0.31.0
  • k8s.io/client-go was updated to v0.31.0
  • sigs.k8s.io/controller-runtime was updated to 0.19.0

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.6.1
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.6.1
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.6.1
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.6.1

Release 0.6.0¶

OpenShift Routes for cert-manager 0.6.0 was released on 13 August 2024.

Key features¶

• New Helm fields

  You can now use the namespace field in values.yaml for configuring the destination namespace. This is useful in the context of Helm subcharts.

  A new omitHelmLabels field was also added so that users can generate static manifests without Helm-specific labels.

• Release process changes

  The project now relies on Makefile modules like the other projects under the cert-manager org. The changes are:

  The file static/cert-manager-openshift-routes.yaml is no longer present in the repository. You now have to template your own manifests, for example:

  oc apply -f <(helm template openshift-routes -n cert-manager oci://private-registry.venafi.eu/openshift-routes/cert-manager-openshift-routes --set omitHelmLabels=true --version 0.6.0)
  

Downloads¶

• Container Image: private-registry.venafi.cloud/openshift-routes/cert-manager-openshift-routes:v0.6.0
• FIPS Image: private-registry.venafi.cloud/openshift-routes/openshift-routes-fips:v0.6.0
• Helm Chart: oci://registry.venafi.cloud/charts/openshift-routes:v0.6.0
• Helm Chart: oci://private-registry.venafi.cloud/charts/openshift-routes:v0.6.0