OSDOCS#14771: Updated cert-manager release note text for 1.16

[subhtk]

Version(s): 4.14+

Issue: https://issues.redhat.com/browse/OSDOCS-14771

Link to docs preview:

QE review:

• QE has approved this change.

Additional information:

[ocpdocs-previewbot]

🤖 Mon May 26 08:25:20 - Prow CI generated the docs preview:

https://93727--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/cert_manager_operator/cert-manager-operator-release-notes.html

[openshift-ci]

@subhtk: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/validate-asciidoc	c06491a	link	true	/test validate-asciidoc
ci/prow/validate-portal	c06491a	link	true	/test validate-portal

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[swghosh]

We also need to add a new section for cainjector and webhook metrics in the existing monitoring pages of our operator (upstream 1.16 introduced it).

/cc @lunarwhite

[swghosh]

@lunarwhite would it be needful to mention that we tested on Private ACME?

I think the Issuer list table that we have.

[lunarwhite]

Disconnected environment support

With this release, the cert-manager operator has been verified to install and function in disconnected clusters with the following issuer types: ACME, CA, Self-signed, and Vault. Specifically, private or self-hosted ACME servers have been validated, as Let's Encrypt or other public ACME services are not feasible options in air-gapped environments. To mirror operator images, the preferred method is using the oc-mirror plugin v2, for more infomation, please see: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/disconnected_environments/mirroring-in-disconnected-environments#about-installing-oc-mirror-v2

[swghosh]

based on the upstream cert-manager version `v1.16.4`

and link it to: https://cert-manager.io/docs/releases/release-notes/release-notes-1.16/#v1164
like we did in all previous versions.

[swghosh]

Suggested change

	== {cert-manager-operator} 1.16
	== {cert-manager-operator} 1.16.0

please find other version refs if present too.

[swghosh]

+ CVE-2025-22866
+  CVE-2024-45337 
+ CVE-2024-45338

[swghosh]

Plus, we want to add about the following in release notes:

cert-manager now uses the new upstream WatchListClient feature which enables use of Streaming Lists feature of the Kubernetes API server reducing the load on the Kubernetes API server. The peak memory use of the cert-manager components when they startup is optimized on Kubernetes 1.27+ (i.e. OpenShift 4.14+).

[lunarwhite]

Adding

Extended operand metrics support

With this release, cert-manager webhook and cainjector operands now expose Prometheus metrics on port 9402 by default via the /metrics service endpoint. You can configure OpenShift Monitoring to collect metrics from all cert-manager operands by enabling the built-in user workload monitoring stack. For more information, see <the link to the existing monitoring page>

For the doc section to modify/create, you could refer to https://github.com/openshift/cert-manager-operator/blob/52b0de67fc0fa8a3b3602ffa0785bd95b403585c/docs/operand_metrics.md

[lunarwhite]

Disconnected environment support

With this release, the cert-manager operator has been verified to install and function in disconnected clusters with the following issuer types: ACME, CA, Self-signed, and Vault. Specifically, private or self-hosted ACME servers have been validated, as Let's Encrypt or other public ACME services are not feasible options in air-gapped environments. To mirror operator images, the preferred method is using the oc-mirror plugin v2, for more infomation, please see: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/disconnected_environments/mirroring-in-disconnected-environments#about-installing-oc-mirror-v2

[lunarwhite]

And please note that this PR is applicable to OCP v4.14+

[lunarwhite]

Would it be helpful to mention the route feature GA-ed in OCP v4.19? (perhaps could do it in a separate followup PR, since it only applicable to 4.19+) Just like something we did for v1.13.0: #78572

cc @swghosh @chiragkyal

Adding something like #93202:

Securing routes with cert-manager managed certificates

...

And make changes to the corresponding section, similar to what we're doing in #92978

[chiragkyal]

SGTM. We just need to clarify that the feature is applicable for OCP 4.19+, and not actually mapped to cert-manager release.

[subhtk]

Let me create the follow up PR for the same.

[openshift-merge-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.