v0.17.0

istio-csr integrates cert-manager into Istio, allowing you to issue workload certificates using the power of cert-manager.

Security

This release is built with Go 1.26.6, which fixes six Go standard library vulnerabilities reported by govulncheck against v0.16.0: GO-2026-6218 (net/url), GO-2026-6091 (html/template), GO-2026-6090 (crypto/tls), GO-2026-6089 (net/http), GO-2026-5972 (encoding/asn1) and GO-2026-5026 (net/http). It also picks up security fixes in Go module dependencies, including golang.org/x/mod v0.40.0 (GO-2026-6179), golang.org/x/crypto v0.52.0, golang.org/x/net v0.55.0 and golang.org/x/text v0.39.0.

Highlights

• The Helm chart image helper was renamed to avoid conflicts when istio-csr is used in umbrella charts (#791, @FelixPhipps)
• The Helm chart now supports priorityClassName (#834, @yugstar) and only creates the ServiceMonitor when the metrics service is enabled (#835, @yugstar)
• Fixed a lock contention issue in HasIssuerConfig by using a read lock (#769, @archy-rock3t-cloud)
• Updated Istio APIs to v1.30 and Kubernetes libraries to v0.36.3

What's Changed

• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #761
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #762
• fix(deps): update kubernetes go patches to v0.35.3 by @renovate[bot] in #764
• fix(deps): update istio.io/istio digest to d9ada8a by @renovate[bot] in #765
• fix(deps): update misc go deps by @renovate[bot] in #760
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #766
• chore(deps): update actions/setup-go action to v6.4.0 by @renovate[bot] in #767
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #771
• chore(deps): update docker/login-action action to v4.1.0 by @renovate[bot] in #772
• chore(deps): update module github.com/go-jose/go-jose/v4 to v4.1.4 [security] by @renovate[bot] in #773
• fix(deps): update module google.golang.org/grpc to v1.80.0 by @renovate[bot] in #770
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #774
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #775
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #776
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #778
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #780
• fix(deps): update module github.com/cert-manager/cert-manager to v1.20.2 by @renovate[bot] in #779
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #782
• fix(deps): update kubernetes go patches to v0.35.4 by @renovate[bot] in #783
• fix(deps): update module istio.io/api to v1.29.2 by @renovate[bot] in #781
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #784
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #785
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #789
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.28.2 by @renovate[bot] in #790
• fix(deps): update github.com/onsi deps by @renovate[bot] in #793
• fix: rename image helper to avoid umbrella chart conflicts by @FelixPhipps in #791
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #792
• fix(deps): update module github.com/fsnotify/fsnotify to v1.10.0 by @renovate[bot] in #794
• fix(deps): update istio.io/istio digest to 9c52604 by @renovate[bot] in #795
• fix(deps): update module istio.io/api to v1.30.0-beta.0 by @renovate[bot] in #796
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #797
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #798
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #799
• fix(deps): update misc go deps by @renovate[bot] in #800
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #802
• fix(deps): update module istio.io/api to v1.30.0-rc.0 by @renovate[bot] in #801
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #803
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #804
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #806
• fix(deps): update module google.golang.org/grpc to v1.81.1 by @renovate[bot] in #805
• fix(deps): update github.com/onsi deps by @renovate[bot] in #808
• chore(deps): update module golang.org/x/crypto to v0.52.0 [security] by @renovate[bot] in #812
• Fix pipefail issue by @inteon in #817
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #810
• chore(deps): update module golang.org/x/net to v0.55.0 [security] by @renovate[bot] in #813
• chore(deps): update docker/login-action action to v4.2.0 by @renovate[bot] in #811
• Bump Istio version used in e2e-tests by @erikgb in #815
• fix(deps): update module istio.io/api to v1.30.0 by @renovate[bot] in #809
• fix(deps): update kubernetes go deps by @renovate[bot] in #788
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #819
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #821
• chore(deps): update misc github actions to v6.0.3 by @renovate[bot] in #820
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #823
• fix(deps): update misc go deps to v1.30.1 by @renovate[bot] in #822
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #824
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #825
• fix(deps): update github.com/onsi deps to v2.30.0 by @renovate[bot] in #827
• fix(deps): update kubernetes go patches to v0.36.2 by @renovate[bot] in #828
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #829
• [CI] Merge self-upgrade-main into main by @octo-sts[bot] in #832
• fix(deps): update github.com/onsi deps by @renovate[bot] in #830
• chore(deps): update makefile modules to 7835ffe by @renovate[bot] in #833
• chore(deps): update makefile modules to 92aeb18 by @renovate[bot] in #836
• chore(deps): update makefile modules to 5d90d75 by @renovate[bot] in #837
• chore(deps): update misc github actions to v7 by @renovate[bot] in #838
• chore(deps): update makefile modules to 3968a05 by @renovate[bot] in #839
• chore(deps): update makefile modules to e249911 by @renovate[bot] in #840
• chore(deps): update makefile modules to 2439727 by @renovate[bot] in #841
• fix(deps): update github.com/onsi deps by @renovate[bot] in #842
• Fix HasIssuerConfig to use RLock instead of Lock by @archy-rock3t-cloud in #769
• feat(chart): expose priorityClassName in the istio-csr chart by @yugstar in #834
• fix(istio-csr): gate ServiceMonitor on metrics service being enabled by @yugstar in #835
• chore(deps): update makefile modules to 5a6dfa5 by @renovate[bot] in #843
• fix(deps): update module istio.io/api to v1.30.2 by @renovate[bot] in #844
• fix(deps): update module github.com/cert-manager/cert-manager to v1.20.3 by @renovate[bot] in #845
• chore(deps): update actions/setup-go action to v6.5.0 by @renovate[bot] in #847
• chore(deps): update makefile modules to 3475385 by @renovate[bot] in #848
• fix(deps): update module github.com/onsi/gomega to v1.42.1 by @renovate[bot] in #846
• chore(deps): update makefile modules to fb0281c by @renovate[bot] in #849
• chore(deps): update makefile modules to 72b0d34 by @renovate[bot] in #850
• chore(deps): update makefile modules to c9f456a by @renovate[bot] in #851
• chore(deps): update docker/login-action action to v4.3.0 by @renovate[bot] in #854
• fix(deps): update module google.golang.org/grpc to v1.82.0 by @renovate[bot] in #853
• chore(deps): update makefile modules to 6ec965f by @renovate[bot] in #855
• chore(deps): update docker/login-action action to v4.4.0 by @renovate[bot] in #856
• chore(deps): update makefile modules to e18d942 by @renovate[bot] in #857
• chore(deps): update makefile modules to 2f12511 by @renovate[bot] in #858
• chore(deps): update makefile modules to b7c9d73 by @renovate[bot] in #861
• chore(deps): update makefile modules to 703bbcc by @renovate[bot] in #862
• fix(deps): update misc go deps by @renovate[bot] in #859
• chore(deps): update module golang.org/x/text to v0.39.0 [security] by @renovate[bot] in #867
• chore(deps): update makefile modules to 57b5681 by @renovate[bot] in #872
• chore(deps): update makefile modules to e0878ff by @renovate[bot] in #873
• chore(deps): update makefile modules to 556e163 by @renovate[bot] in #874
• fix(deps): update kubernetes go patches to v0.36.3 by @renovate[bot] in #871
• chore(deps): update actions/setup-go action to v7 by @renovate[bot] in #865
• chore(deps): update makefile modules to b41c15b by @renovate[bot] in #877
• fix(deps): update misc go deps by @renovate[bot] in #864
• fix(deps): update module google.golang.org/grpc to v1.83.0 by @renovate[bot] in #878
• chore(deps): update misc github actions by @renovate[bot] in #868
• fix(deps): update google.golang.org/protobuf digest to 644d026 by @renovate[bot] in #879
• chore(deps): update makefile modules to a09232d by @renovate[bot] in #880
• chore(deps): update makefile modules to 2c4a3b8 by @renovate[bot] in #881
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.32.1 by @renovate[bot] in #884
• fix(deps): update module google.golang.org/protobuf to v1.36.12 by @renovate[bot] in #882
• chore(deps): update module golang.org/x/mod to v0.40.0 [security] by @renovate[bot] in #883
• chore(deps): update makefile modules to b514cb5 by @renovate[bot] in #888

New Contributors

• @archy-rock3t-cloud made their first contribution in #769
• @yugstar made their first contribution in #834

Full Changelog: v0.16.0...v0.17.0

Artifacts

• Container image: quay.io/jetstack/cert-manager-istio-csr:v0.17.0
• Helm chart (OCI): quay.io/jetstack/charts/cert-manager-istio-csr:v0.17.0