Seven minors behind, and the documentation allows only one minor at a time with
the latest patch of each; skipping is offered solely as uninstall and reinstall.
Measured on the images rather than assumed: v1.14.0 carries 8 critical and 128
high findings across controller, webhook and cainjector; v1.21.1 carries 0 and
24. Both potentially breaking changes on the way were checked against our state
and do not apply — no dashboard or alert uses the ACME metrics whose label
changes, and nothing is bound to the cert-manager-edit ClusterRole whose
permissions narrow.
Fifteen certificates are Ready before this starts; that is the check after every
step.
Thore Cimbal
93155c2f37