From 44a884062d879d6974b5ec84d34ec90bec05a0b5 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Fri, 21 Aug 2026 12:00:00 +0000
Subject: [PATCH] =?UTF-8?q?cert-manager:=20step=206=20of=207=20=E2=80=94?=
 =?UTF-8?q?=20v1.19.6=20to=20v1.20.3=20(#0051)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is the step with the RBAC narrowing: the cert-manager-edit aggregate
ClusterRole no longer grants create on challenges or create, patch and update on
orders. Those resources belong to cert-manager's own ACME workflow. Nothing here
is bound to that ClusterRole — zero bindings across all namespaces — so no
tooling loses a permission it was using.

Previous step verified: three deployments on v1.19.6, fifteen certificates
Ready.
---
 apps/base/infra/cert-manager.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/base/infra/cert-manager.yaml b/apps/base/infra/cert-manager.yaml
index 11eb170..423f330 100644
--- a/apps/base/infra/cert-manager.yaml
+++ b/apps/base/infra/cert-manager.yaml
@@ -15,7 +15,7 @@ spec:
       # Weg: 1.15.5 -> 1.16.5 -> 1.17.4 -> 1.18.6 -> 1.19.6 -> 1.20.3 -> 1.21.1
       # Am Zielimage gemessen: v1.14.0 traegt 8 CRITICAL und 128 HIGH ueber die
       # drei Images, v1.21.1 traegt 0 und 24.
-      version: "v1.19.6"
+      version: "v1.20.3"
       sourceRef:
         kind: HelmRepository
         name: jetstack