diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index 71cee2bd0e..b9aae5119e 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -94,4 +94,4 @@ cert_manager_installer="${REPO_ROOT_DIR}/vendor/knative.dev/eventing/hack/update
 # shellcheck source=/dev/null
 source <(grep -v '^update_cert_manager ' "${cert_manager_installer}")
 
-update_cert_manager "v1.20.3" "v0.24.0"
+update_cert_manager "v1.21.3" "v0.26.0"
diff --git a/third_party/cert-manager/01-cert-manager.yaml b/third_party/cert-manager/01-cert-manager.yaml
index 9b2dc7c27e..52c4f2cacd 100644
--- a/third_party/cert-manager/01-cert-manager.yaml
+++ b/third_party/cert-manager/01-cert-manager.yaml
@@ -11,9 +11,9 @@ metadata:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 ---
 # Source: cert-manager/templates/serviceaccount.yaml
 apiVersion: v1
@@ -27,9 +27,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 ---
 # Source: cert-manager/templates/webhook-serviceaccount.yaml
 apiVersion: v1
@@ -43,9 +43,9 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 ---
 # Source: cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml
 apiVersion: apiextensions.k8s.io/v1
@@ -59,9 +59,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   group: acme.cert-manager.io
   names:
@@ -3268,6 +3268,24 @@ spec:
                             this challenge solver will apply to.
                           type: object
                       type: object
+                    waitInsteadOfSelfCheck:
+                      description: |-
+                        WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+                        instead waits this long after presentation before asking the ACME server
+                        to validate the challenge.
+
+                        This is an advanced escape hatch for environments where cert-manager's
+                        self-check cannot succeed from its own network or DNS viewpoint even
+                        though the ACME server can still validate successfully, for example due
+                        to split-horizon DNS or NAT hairpinning.
+
+                        A value of 0 skips the self-check and asks the ACME server to validate
+                        immediately after presentation, relying on the ACME server's own
+                        validation retries (RFC 8555 section 8.2) to succeed once the challenge
+                        has propagated. A negative duration is rejected.
+                        Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+                        for example `30s` or `2m`.
+                      type: string
                   type: object
                 token:
                   description: |-
@@ -3306,13 +3324,21 @@ spec:
               properties:
                 presented:
                   description: |-
-                    presented will be set to true if the challenge values for this challenge
-                    are currently 'presented'.
-                    This *does not* imply the self check is passing. Only that the values
-                    have been 'submitted' for the appropriate challenge mechanism (i.e. the
-                    DNS01 TXT record has been presented, or the HTTP01 configuration has been
-                    configured).
+                    Presented is true once cert-manager has configured the solver resources
+                    needed to expose this challenge's validation material.
+                    For example, the DNS01 TXT record has been created, or the HTTP01 solver
+                    has been configured to serve the challenge token.
+                    This does not imply the self check is passing, that the ACME server has
+                    validated the challenge, or that cert-manager has already accepted the
+                    challenge with the ACME server.
                   type: boolean
+                presentedAt:
+                  description: |-
+                    PresentedAt records when cert-manager first configured the solver
+                    resources for this challenge. This is used by the optional delay-based
+                    readiness logic.
+                  format: date-time
+                  type: string
                 processing:
                   description: |-
                     Used to denote whether this challenge should be processed or not.
@@ -3366,9 +3392,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   group: acme.cert-manager.io
   names:
@@ -3439,7 +3465,7 @@ spec:
                 duration:
                   description: |-
                     Duration is the duration for the not after date for the requested certificate.
-                    this is set on order creation as pe the ACME spec.
+                    This is set on order creation as per the ACME spec.
                   type: string
                 ipAddresses:
                   description: |-
@@ -3479,6 +3505,15 @@ spec:
                     Profile allows requesting a certificate profile from the ACME server.
                     Supported profiles are listed by the server's ACME directory URL.
                   type: string
+                replaces:
+                  description: |-
+                    Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this
+                    Order is intended to replace. When set, cert-manager will include the
+                    "replaces" field on the newOrder request to the ACME server if and only
+                    if the server advertises ARI support in its directory. The CertID has
+                    the form "base64url(AKI).base64url(serial)" and is derived locally from
+                    the currently issued leaf certificate.
+                  type: string
                 request:
                   description: |-
                     Certificate signing request bytes in DER encoding.
@@ -3648,9 +3683,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   group: cert-manager.io
   names:
@@ -3975,9 +4010,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   group: cert-manager.io
   names:
@@ -4255,10 +4290,16 @@ spec:
                             `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
                             (e.g., because of company policy). Please note that the security of the algorithm is not that important
                             in reality, because the unencrypted certificate and private key are also stored in the Secret.
+                            `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026.
+                            Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC.
+                            The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256.
+                            Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher,
+                            or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements.
                           enum:
                             - LegacyRC2
                             - LegacyDES
                             - Modern2023
+                            - Modern2026
                           type: string
                       required:
                         - create
@@ -4471,6 +4512,53 @@ spec:
                     Cannot be set if the `renewBefore` field is set.
                   format: int32
                   type: integer
+                renewal:
+                  description: |-
+                    `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is
+                    `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`.
+                  properties:
+                    policy:
+                      description: '`policy` must be one of `Disabled`, `RenewBefore`.'
+                      enum:
+                        - RenewBefore
+                        - Disabled
+                      type: string
+                    windows:
+                      description: '`windows` mentions the behavior of when the renewal must happen.'
+                      items:
+                        description: CertificateRenewalWindows is the definition for renewal windows
+                        properties:
+                          cron:
+                            description: |-
+                              `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below:
+                              * * * * *
+                              | | | | |
+                              | | | | day of the week (0–6) (Sunday to Saturday;
+                              | | | month (1–12)             7 is also Sunday on some systems)
+                              | | day of the month (1–31)
+                              | hour (0–23)
+                              minute (0–59)
+                            minLength: 1
+                            type: string
+                          timezone:
+                            description: |-
+                              `timezone` is IANA compliant timezone. For example America/Denver.
+                              If this field is not set, timezone is treated as UTC.
+                            minLength: 1
+                            type: string
+                          windowDuration:
+                            description: |-
+                              `windowDuration` is how long the cron definition is active for.
+                              Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
+                            pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$
+                            type: string
+                        required:
+                          - cron
+                          - windowDuration
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                  type: object
                 revisionHistoryLimit:
                   description: |-
                     The maximum number of CertificateRequest revisions that are maintained in
@@ -4661,6 +4749,53 @@ spec:
                 Read-only.
                 More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
               properties:
+                acme:
+                  description: ACME stores information that is fetched from the ACME CA server.
+                  properties:
+                    ari:
+                      description: |-
+                        ARI stores the ACME Renewal Information that is fetched from the ACME server
+                        in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled.
+                      properties:
+                        certID:
+                          description: |-
+                            CertID is the ARI CertID (RFC 9773) of the certificate this renewal information was
+                            fetched for. This is used to determine if we need to re-fetch the renewal information
+                            as changed cert id means that ARI fetched before is stale.
+                          type: string
+                        explanationURL:
+                          description: |-
+                            ExplanationURL is a human-readable URL that may explain why the suggested window
+                            has its current value.
+                          type: string
+                        lastChecked:
+                          description: LastChecked is the time at which the ACME server was last checked for renewal information.
+                          format: date-time
+                          type: string
+                        lastError:
+                          description: LastError is the last error encountered when checking the ACME server for renewal information, if any.
+                          type: string
+                        nextCheck:
+                          description: NextCheck is the time at which the ACME server will next be checked for renewal information.
+                          format: date-time
+                          type: string
+                        suggestedWindow:
+                          description: SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773.
+                          properties:
+                            end:
+                              description: End is the end of the suggested renewal window.
+                              format: date-time
+                              type: string
+                            start:
+                              description: Start is the start of the suggested renewal window.
+                              format: date-time
+                              type: string
+                          required:
+                            - end
+                            - start
+                          type: object
+                      type: object
+                  type: object
                 conditions:
                   description: |-
                     List of status conditions to indicate the status of certificates.
@@ -4796,9 +4931,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   group: cert-manager.io
   names:
@@ -8118,6 +8253,24 @@ spec:
                                   this challenge solver will apply to.
                                 type: object
                             type: object
+                          waitInsteadOfSelfCheck:
+                            description: |-
+                              WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+                              instead waits this long after presentation before asking the ACME server
+                              to validate the challenge.
+
+                              This is an advanced escape hatch for environments where cert-manager's
+                              self-check cannot succeed from its own network or DNS viewpoint even
+                              though the ACME server can still validate successfully, for example due
+                              to split-horizon DNS or NAT hairpinning.
+
+                              A value of 0 skips the self-check and asks the ACME server to validate
+                              immediately after presentation, relying on the ACME server's own
+                              validation retries (RFC 8555 section 8.2) to succeed once the challenge
+                              has propagated. A negative duration is rejected.
+                              Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+                              for example `30s` or `2m`.
+                            type: string
                         type: object
                       type: array
                       x-kubernetes-list-type: atomic
@@ -8232,6 +8385,62 @@ spec:
                             - roleId
                             - secretRef
                           type: object
+                        aws:
+                          description: |-
+                            AWS authenticates with Vault using AWS IAM authentication.
+                            This allows authentication using IAM roles for service accounts (IRSA),
+                            EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+                          properties:
+                            iamRoleArn:
+                              description: |-
+                                The ARN of the AWS IAM role to assume using the Kubernetes service account
+                                token. Required when using IRSA (serviceAccountRef is set).
+                                This role must have a trust policy that allows the OIDC provider to assume it.
+                              type: string
+                            mountPath:
+                              description: |-
+                                The Vault mountPath here is the mount path to use when authenticating with
+                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+                                default value "/v1/auth/aws" will be used.
+                              type: string
+                            region:
+                              description: |-
+                                The AWS region to use for authentication. If not specified, the region
+                                will be determined from AWS_REGION or AWS_DEFAULT_REGION environment
+                                variables, falling back to "us-east-1" if not set.
+                              type: string
+                            role:
+                              description: A required field containing the Vault Role to assume when authenticating.
+                              minLength: 1
+                              type: string
+                            serviceAccountRef:
+                              description: |-
+                                A reference to a service account that will be used to request a web identity
+                                token for IRSA (IAM Roles for Service Accounts) authentication.
+                              properties:
+                                audiences:
+                                  description: |-
+                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+                                    The default audiences are always included in the token.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  description: Name of the ServiceAccount used to request a token.
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            vaultHeaderValue:
+                              description: |-
+                                The Vault header value to include in the STS signing request.
+                                This is used to prevent replay attacks.
+                              type: string
+                          required:
+                            - role
+                          type: object
                         clientCertificate:
                           description: |-
                             ClientCertificate authenticates with Vault by presenting a client
@@ -8466,6 +8675,46 @@ spec:
                       required:
                         - apiTokenSecretRef
                       type: object
+                    ngts:
+                      description: |-
+                        NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration
+                        using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+                      properties:
+                        credentialsRef:
+                          description: |-
+                            CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0
+                            Client ID and Client Secret. The secret must contain the keys 'client-id' and
+                            'client-secret'.
+                          properties:
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        tokenEndpoint:
+                          description: |-
+                            TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,
+                            for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token".
+                            Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set.
+                          type: string
+                        tsgID:
+                          description: |-
+                            TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,
+                            for example "1234567890". The tsg_id: prefix is added automatically.
+                            This field is required.
+                          type: string
+                        url:
+                          description: |-
+                            URL is the base URL for the NGTS API endpoint.
+                            Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set.
+                          type: string
+                      required:
+                        - credentialsRef
+                        - tsgID
+                      type: object
                     tpp:
                       description: |-
                         TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
@@ -8534,6 +8783,9 @@ spec:
                   required:
                     - zone
                   type: object
+                  x-kubernetes-validations:
+                    - message: exactly one of tpp, cloud, or ngts must be configured
+                      rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1'
               type: object
             status:
               description: Status of the ClusterIssuer. This is set and managed automatically.
@@ -8633,9 +8885,9 @@ metadata:
     app.kubernetes.io/name: "cert-manager"
     app.kubernetes.io/instance: "cert-manager"
     app.kubernetes.io/component: "crds"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   group: cert-manager.io
   names:
@@ -11954,6 +12206,24 @@ spec:
                                   this challenge solver will apply to.
                                 type: object
                             type: object
+                          waitInsteadOfSelfCheck:
+                            description: |-
+                              WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and
+                              instead waits this long after presentation before asking the ACME server
+                              to validate the challenge.
+
+                              This is an advanced escape hatch for environments where cert-manager's
+                              self-check cannot succeed from its own network or DNS viewpoint even
+                              though the ACME server can still validate successfully, for example due
+                              to split-horizon DNS or NAT hairpinning.
+
+                              A value of 0 skips the self-check and asks the ACME server to validate
+                              immediately after presentation, relying on the ACME server's own
+                              validation retries (RFC 8555 section 8.2) to succeed once the challenge
+                              has propagated. A negative duration is rejected.
+                              Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,
+                              for example `30s` or `2m`.
+                            type: string
                         type: object
                       type: array
                       x-kubernetes-list-type: atomic
@@ -12068,6 +12338,62 @@ spec:
                             - roleId
                             - secretRef
                           type: object
+                        aws:
+                          description: |-
+                            AWS authenticates with Vault using AWS IAM authentication.
+                            This allows authentication using IAM roles for service accounts (IRSA),
+                            EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).
+                          properties:
+                            iamRoleArn:
+                              description: |-
+                                The ARN of the AWS IAM role to assume using the Kubernetes service account
+                                token. Required when using IRSA (serviceAccountRef is set).
+                                This role must have a trust policy that allows the OIDC provider to assume it.
+                              type: string
+                            mountPath:
+                              description: |-
+                                The Vault mountPath here is the mount path to use when authenticating with
+                                Vault. For example, setting a value to `/v1/auth/foo`, will use the path
+                                `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the
+                                default value "/v1/auth/aws" will be used.
+                              type: string
+                            region:
+                              description: |-
+                                The AWS region to use for authentication. If not specified, the region
+                                will be determined from AWS_REGION or AWS_DEFAULT_REGION environment
+                                variables, falling back to "us-east-1" if not set.
+                              type: string
+                            role:
+                              description: A required field containing the Vault Role to assume when authenticating.
+                              minLength: 1
+                              type: string
+                            serviceAccountRef:
+                              description: |-
+                                A reference to a service account that will be used to request a web identity
+                                token for IRSA (IAM Roles for Service Accounts) authentication.
+                              properties:
+                                audiences:
+                                  description: |-
+                                    TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.
+                                    The default audiences are always included in the token.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  description: Name of the ServiceAccount used to request a token.
+                                  type: string
+                              required:
+                                - name
+                              type: object
+                            vaultHeaderValue:
+                              description: |-
+                                The Vault header value to include in the STS signing request.
+                                This is used to prevent replay attacks.
+                              type: string
+                          required:
+                            - role
+                          type: object
                         clientCertificate:
                           description: |-
                             ClientCertificate authenticates with Vault by presenting a client
@@ -12302,6 +12628,46 @@ spec:
                       required:
                         - apiTokenSecretRef
                       type: object
+                    ngts:
+                      description: |-
+                        NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration
+                        using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.
+                      properties:
+                        credentialsRef:
+                          description: |-
+                            CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0
+                            Client ID and Client Secret. The secret must contain the keys 'client-id' and
+                            'client-secret'.
+                          properties:
+                            name:
+                              description: |-
+                                Name of the resource being referred to.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                          required:
+                            - name
+                          type: object
+                        tokenEndpoint:
+                          description: |-
+                            TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,
+                            for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token".
+                            Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set.
+                          type: string
+                        tsgID:
+                          description: |-
+                            TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,
+                            for example "1234567890". The tsg_id: prefix is added automatically.
+                            This field is required.
+                          type: string
+                        url:
+                          description: |-
+                            URL is the base URL for the NGTS API endpoint.
+                            Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set.
+                          type: string
+                      required:
+                        - credentialsRef
+                        - tsgID
+                      type: object
                     tpp:
                       description: |-
                         TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.
@@ -12370,6 +12736,9 @@ spec:
                   required:
                     - zone
                   type: object
+                  x-kubernetes-validations:
+                    - message: exactly one of tpp, cloud, or ngts must be configured
+                      rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1'
               type: object
             status:
               description: Status of the Issuer. This is set and managed automatically.
@@ -12467,9 +12836,9 @@ metadata:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   - apiGroups: ["cert-manager.io"]
     resources: ["certificates"]
@@ -12501,9 +12870,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   - apiGroups: ["cert-manager.io"]
     resources: ["issuers", "issuers/status"]
@@ -12529,9 +12898,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   - apiGroups: ["cert-manager.io"]
     resources: ["clusterissuers", "clusterissuers/status"]
@@ -12557,9 +12926,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   - apiGroups: ["cert-manager.io"]
     resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
@@ -12594,9 +12963,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   - apiGroups: ["acme.cert-manager.io"]
     resources: ["orders", "orders/status"]
@@ -12637,9 +13006,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   # Use to update challenge resource status
   - apiGroups: ["acme.cert-manager.io"]
@@ -12699,9 +13068,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   - apiGroups: ["cert-manager.io"]
     resources: ["certificates", "certificaterequests"]
@@ -12738,9 +13107,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
     rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
 rules:
   - apiGroups: ["cert-manager.io"]
@@ -12757,9 +13126,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
     rbac.authorization.k8s.io/aggregate-to-view: "true"
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
@@ -12782,9 +13151,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
     rbac.authorization.k8s.io/aggregate-to-admin: "true"
 rules:
@@ -12812,9 +13181,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cert-manager"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   - apiGroups: ["cert-manager.io"]
     resources: ["signers"]
@@ -12836,9 +13205,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cert-manager"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   - apiGroups: ["certificates.k8s.io"]
     resources: ["certificatesigningrequests"]
@@ -12864,9 +13233,9 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
 - apiGroups: ["authorization.k8s.io"]
   resources: ["subjectaccessreviews"]
@@ -12882,9 +13251,9 @@ metadata:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -12904,9 +13273,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -12926,9 +13295,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -12948,9 +13317,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -12970,9 +13339,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -12992,9 +13361,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -13014,9 +13383,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -13036,9 +13405,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cert-manager"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -13058,9 +13427,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cert-manager"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -13080,9 +13449,9 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -13104,9 +13473,9 @@ metadata:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   # Used for leader election by the controller
   # cert-manager-cainjector-leader-election is used by the CertificateBased injector controller
@@ -13132,9 +13501,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
@@ -13144,26 +13513,6 @@ rules:
     resources: ["leases"]
     verbs: ["create"]
 ---
-# Source: cert-manager/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: cert-manager-tokenrequest
-  namespace: cert-manager
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
-    app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
-rules:
-  - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
-    resourceNames: ["cert-manager"]
-    verbs: ["create"]
----
 # Source: cert-manager/templates/webhook-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -13175,9 +13524,9 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 rules:
 - apiGroups: [""]
   resources: ["secrets"]
@@ -13202,9 +13551,9 @@ metadata:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -13227,9 +13576,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -13239,30 +13588,6 @@ subjects:
     name: cert-manager
     namespace: cert-manager
 ---
-# Source: cert-manager/templates/rbac.yaml
-# grant cert-manager permission to create tokens for the serviceaccount
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: cert-manager-tokenrequest
-  namespace: cert-manager
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
-    app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: cert-manager-tokenrequest
-subjects:
-  - kind: ServiceAccount
-    name: cert-manager
-    namespace: cert-manager
----
 # Source: cert-manager/templates/webhook-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -13274,9 +13599,9 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -13297,9 +13622,9 @@ metadata:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   type: ClusterIP
   ports:
@@ -13322,16 +13647,15 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   type: ClusterIP
   ports:
   - protocol: TCP
     port: 9402
-    name: tcp-prometheus-servicemonitor
-    targetPort: http-metrics
+    name: http-metrics
   selector:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
@@ -13348,9 +13672,9 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   type: ClusterIP
   ports:
@@ -13378,9 +13702,9 @@ metadata:
     app.kubernetes.io/name: cainjector
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "cainjector"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   replicas: 1
   selector:
@@ -13395,9 +13719,9 @@ spec:
         app.kubernetes.io/name: cainjector
         app.kubernetes.io/instance: cert-manager
         app.kubernetes.io/component: "cainjector"
-        app.kubernetes.io/version: "v1.20.3"
+        app.kubernetes.io/version: "v1.21.3"
         app.kubernetes.io/managed-by: Helm
-        helm.sh/chart: cert-manager-v1.20.3
+        helm.sh/chart: cert-manager-v1.21.3
       annotations:
         prometheus.io/path: "/metrics"
         prometheus.io/scrape: 'true'
@@ -13411,7 +13735,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cert-manager-cainjector
-          image: "quay.io/jetstack/cert-manager-cainjector:v1.20.3"
+          image: "quay.io/jetstack/cert-manager-cainjector:v1.21.3"
           imagePullPolicy: IfNotPresent
           args:
           - --v=2
@@ -13445,9 +13769,9 @@ metadata:
     app.kubernetes.io/name: cert-manager
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "controller"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   replicas: 1
   selector:
@@ -13462,9 +13786,9 @@ spec:
         app.kubernetes.io/name: cert-manager
         app.kubernetes.io/instance: cert-manager
         app.kubernetes.io/component: "controller"
-        app.kubernetes.io/version: "v1.20.3"
+        app.kubernetes.io/version: "v1.21.3"
         app.kubernetes.io/managed-by: Helm
-        helm.sh/chart: cert-manager-v1.20.3
+        helm.sh/chart: cert-manager-v1.21.3
       annotations:
         prometheus.io/path: "/metrics"
         prometheus.io/scrape: 'true'
@@ -13478,13 +13802,13 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cert-manager-controller
-          image: "quay.io/jetstack/cert-manager-controller:v1.20.3"
+          image: "quay.io/jetstack/cert-manager-controller:v1.21.3"
           imagePullPolicy: IfNotPresent
           args:
           - --v=2
           - --cluster-resource-namespace=$(POD_NAMESPACE)
           - --leader-election-namespace=kube-system
-          - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.20.3
+          - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.21.3
           - --max-concurrent-challenges=60
           ports:
           - containerPort: 9402
@@ -13531,9 +13855,9 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 spec:
   replicas: 1
   selector:
@@ -13548,9 +13872,9 @@ spec:
         app.kubernetes.io/name: webhook
         app.kubernetes.io/instance: cert-manager
         app.kubernetes.io/component: "webhook"
-        app.kubernetes.io/version: "v1.20.3"
+        app.kubernetes.io/version: "v1.21.3"
         app.kubernetes.io/managed-by: Helm
-        helm.sh/chart: cert-manager-v1.20.3
+        helm.sh/chart: cert-manager-v1.21.3
       annotations:
         prometheus.io/path: "/metrics"
         prometheus.io/scrape: 'true'
@@ -13564,7 +13888,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cert-manager-webhook
-          image: "quay.io/jetstack/cert-manager-webhook:v1.20.3"
+          image: "quay.io/jetstack/cert-manager-webhook:v1.21.3"
           imagePullPolicy: IfNotPresent
           args:
           - --v=2
@@ -13628,9 +13952,9 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
   annotations:
     cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca"
 webhooks:
@@ -13669,9 +13993,9 @@ metadata:
     app.kubernetes.io/name: webhook
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "webhook"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
   annotations:
     cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca"
 webhooks:
@@ -13723,9 +14047,9 @@ metadata:
     app.kubernetes.io/name: startupapicheck
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "startupapicheck"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
 ---
 # Source: cert-manager/templates/startupapicheck-rbac.yaml
 # create certificate role
@@ -13739,9 +14063,9 @@ metadata:
     app.kubernetes.io/name: startupapicheck
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "startupapicheck"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
   annotations:
     helm.sh/hook: post-install
     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
@@ -13762,9 +14086,9 @@ metadata:
     app.kubernetes.io/name: startupapicheck
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "startupapicheck"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
   annotations:
     helm.sh/hook: post-install
     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
@@ -13789,9 +14113,9 @@ metadata:
     app.kubernetes.io/name: startupapicheck
     app.kubernetes.io/instance: cert-manager
     app.kubernetes.io/component: "startupapicheck"
-    app.kubernetes.io/version: "v1.20.3"
+    app.kubernetes.io/version: "v1.21.3"
     app.kubernetes.io/managed-by: Helm
-    helm.sh/chart: cert-manager-v1.20.3
+    helm.sh/chart: cert-manager-v1.21.3
   annotations:
     helm.sh/hook: post-install
     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
@@ -13805,9 +14129,9 @@ spec:
         app.kubernetes.io/name: startupapicheck
         app.kubernetes.io/instance: cert-manager
         app.kubernetes.io/component: "startupapicheck"
-        app.kubernetes.io/version: "v1.20.3"
+        app.kubernetes.io/version: "v1.21.3"
         app.kubernetes.io/managed-by: Helm
-        helm.sh/chart: cert-manager-v1.20.3
+        helm.sh/chart: cert-manager-v1.21.3
     spec:
       restartPolicy: OnFailure
       serviceAccountName: cert-manager-startupapicheck
@@ -13818,7 +14142,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cert-manager-startupapicheck
-          image: "quay.io/jetstack/cert-manager-startupapicheck:v1.20.3"
+          image: "quay.io/jetstack/cert-manager-startupapicheck:v1.21.3"
           imagePullPolicy: IfNotPresent
           args:
           - check
diff --git a/third_party/cert-manager/02-trust-manager.yaml b/third_party/cert-manager/02-trust-manager.yaml
index 8600e1e3ed..df3d8bc134 100644
--- a/third_party/cert-manager/02-trust-manager.yaml
+++ b/third_party/cert-manager/02-trust-manager.yaml
@@ -7,11 +7,11 @@ metadata:
   name: trust-manager
   namespace: cert-manager
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 ---
 # Source: trust-manager/templates/crd-trust.cert-manager.io_bundles.yaml
 apiVersion: apiextensions.k8s.io/v1
@@ -21,11 +21,11 @@ metadata:
   annotations:
     helm.sh/resource-policy: keep
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 spec:
   group: trust.cert-manager.io
   names:
@@ -159,7 +159,7 @@ spec:
                         x-kubernetes-map-type: atomic
                         x-kubernetes-validations:
                           - message: exactly one of the fields in [name selector] must be set
-                            rule: '[has(self.name),has(self.selector)].filter(x,x==true).size() == 1'
+                            rule: (has(self.name)?1:0)+(has(self.selector)?1:0) == 1
                       inLine:
                         description: inLine is a simple string to append as the source data.
                         maxLength: 1048576
@@ -237,7 +237,7 @@ spec:
                         x-kubernetes-map-type: atomic
                         x-kubernetes-validations:
                           - message: exactly one of the fields in [name selector] must be set
-                            rule: '[has(self.name),has(self.selector)].filter(x,x==true).size() == 1'
+                            rule: (has(self.name)?1:0)+(has(self.selector)?1:0) == 1
                       useDefaultCAs:
                         description: |-
                           useDefaultCAs indicates whether the default CA bundle should be used as a source.
@@ -253,7 +253,7 @@ spec:
                     x-kubernetes-map-type: atomic
                     x-kubernetes-validations:
                       - message: exactly one of the fields in [configMap secret inLine useDefaultCAs] must be set
-                        rule: '[has(self.configMap),has(self.secret),has(self.inLine),has(self.useDefaultCAs)].filter(x,x==true).size() == 1'
+                        rule: (has(self.configMap)?1:0)+(has(self.secret)?1:0)+(has(self.inLine)?1:0)+(has(self.useDefaultCAs)?1:0) == 1
                   maxItems: 100
                   minItems: 1
                   type: array
@@ -330,7 +330,7 @@ spec:
                       type: object
                       x-kubernetes-validations:
                         - message: at least one of the fields in [jks pkcs12] must be set
-                          rule: '[has(self.jks),has(self.pkcs12)].filter(x,x==true).size() >= 1'
+                          rule: has(self.jks)||has(self.pkcs12)
                     configMap:
                       description: |-
                         configMap is the target ConfigMap in Namespaces that all Bundle source
@@ -441,7 +441,7 @@ spec:
                   type: object
                   x-kubernetes-validations:
                     - message: at least one of the fields in [configMap secret] must be set
-                      rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size() >= 1'
+                      rule: has(self.configMap)||has(self.secret)
               required:
                 - sources
               type: object
@@ -538,11 +538,11 @@ kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
     rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
   name: trust-manager-cluster-view
 rules:
@@ -557,11 +557,11 @@ kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
   name: trust-manager
 rules:
 - apiGroups:
@@ -607,11 +607,11 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
   name: trust-manager
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -629,11 +629,11 @@ metadata:
   name: trust-manager
   namespace: cert-manager
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 rules:
 - apiGroups:
   - ""
@@ -651,11 +651,11 @@ metadata:
   name: trust-manager:leaderelection
   namespace: cert-manager
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 rules:
 - apiGroups:
   - "coordination.k8s.io"
@@ -675,11 +675,11 @@ metadata:
   name: trust-manager
   namespace: cert-manager
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -696,11 +696,11 @@ metadata:
   name: trust-manager:leaderelection
   namespace: cert-manager
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -719,11 +719,11 @@ metadata:
   labels:
     app: trust-manager
     app.kubernetes.io/component: metrics
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 spec:
   type: ClusterIP
   ports:
@@ -742,11 +742,11 @@ metadata:
   namespace: cert-manager
   labels:
     app: trust-manager
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 spec:
   type: ClusterIP
   ports:
@@ -764,11 +764,11 @@ metadata:
   name: trust-manager
   namespace: cert-manager
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 spec:
   replicas: 1
   revisionHistoryLimit: 10
@@ -779,17 +779,17 @@ spec:
     metadata:
       labels:
         app: trust-manager
-        app.kubernetes.io/name: trust-manager
-        helm.sh/chart: trust-manager-v0.24.0
         app.kubernetes.io/instance: cert-manager
-        app.kubernetes.io/version: "v0.24.0"
         app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: trust-manager
+        app.kubernetes.io/version: v0.26.0
+        helm.sh/chart: trust-manager-v0.26.0
     spec:
       serviceAccountName: trust-manager
       automountServiceAccountToken: true
       initContainers:
       - name: cert-manager-package-debian
-        image: "quay.io/jetstack/trust-pkg-debian-trixie:20250419.1"
+        image: "quay.io/jetstack/trust-pkg-debian-trixie:20250419-deb13u1.1"
         imagePullPolicy: IfNotPresent
         args:
           - "/copyandmaybepause"
@@ -810,7 +810,7 @@ spec:
             type: RuntimeDefault
       containers:
       - name: trust-manager
-        image: "quay.io/jetstack/trust-manager:v0.24.0"
+        image: "quay.io/jetstack/trust-manager:v0.26.0"
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 6443
@@ -875,16 +875,19 @@ metadata:
   name: trust-manager
   namespace: cert-manager
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 spec:
   commonName: "trust-manager.cert-manager.svc"
   dnsNames:
   - "trust-manager.cert-manager.svc"
   secretName: trust-manager-tls
+  secretTemplate:
+    annotations:
+      cert-manager.io/allow-direct-injection: "true"
   privateKey:
     rotationPolicy: Always
   revisionHistoryLimit: 1
@@ -900,11 +903,11 @@ metadata:
   name: trust-manager
   namespace: cert-manager
   labels:
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
 spec:
   selfSigned: {}
 ---
@@ -915,13 +918,13 @@ metadata:
   name: trust-manager
   labels:
     app: trust-manager
-    app.kubernetes.io/name: trust-manager
-    helm.sh/chart: trust-manager-v0.24.0
     app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/version: "v0.24.0"
     app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: trust-manager
+    app.kubernetes.io/version: v0.26.0
+    helm.sh/chart: trust-manager-v0.26.0
   annotations:
-    cert-manager.io/inject-ca-from: "cert-manager/trust-manager"
+    cert-manager.io/inject-ca-from-secret: "cert-manager/trust-manager-tls"
 webhooks:
   - name: trust.cert-manager.io
     rules: