Marc Vornetran

Support Let's Encrypt Certificate Profile Selection

4

**What would you like to be added**: On 2025-01-09 Let's Encrypt announced an extension to the ACME protocol named [Certificate Profile Selection](https://letsencrypt.org/2025/01/09/acme-profiles/). It allows users to specify a profile to...

☂️-Issue for "Support for Kubernetes v1.33”

2

/area open-source /kind enhancement /priority 3 /topology garden seed shoot Kubernetes v1.33 has been released on the 23rd of April 2025: * [CHANGELOG](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.33.md) * [Blog post](https://kubernetes.io/blog/2025/04/23/kubernetes-v1-33-release/) There is [this guide](https://github.com/gardener/gardener/blob/master/docs/development/new-kubernetes-version.md)...

**How to categorize this issue?** /area usability /area os /kind bug **What happened**: The following issue and PR introduced a fallback for machine image versions in worker groups that allows...

Relate renewal window to provisioned `Certificate` lifetime

5

e.g. ACME server provisions for 7d but renewal window is 30d by default

Investigate and document mTLS usage

4

1. Investigate using `cert-management` for generating and managing mTLS certificates. 2. Document the mTLS usage scenario if no roadblocks are discovered during the investigation.

Check whether nameserver logic from `external-dns-management` can be reused

4

**Relevant source code:** https://github.com/gardener/external-dns-management/blob/master/pkg/dnsman2/dns/utils/nameservers.go

Support for multiple providers per domain name when using `DNSRecord`s

4

_tbd_

Support for ACME Renewal Information (ARI) – Revocation check

4

**Relevant blog post:** https://letsencrypt.org/2023/03/23/improving-resliiency-and-reliability-with-ari/

Allow configuration of DNS challenge TTL per `Certificate`

4

_tbd_

Set serial number annotation for self-signed `Certificate`s

4

_tbd_