When cert-manager's Ready Condition Runs Past Expiry Until a Reconcile
On cert-manager v1.21.2, a renewal-blocked Certificate kept Ready=True ("Certificate is up to date and has not expired") past notAfter through our 30-minute window, until a restart reconciled it. When It Runs — Run Report #RR10 · Testing what infrastructure actually does. Provider · Component: cert-manager · the Certificate Ready condition (readiness controller) after status.notAfter has passed,…
On September 28, 2026, during testing of cert-manager v1.21.2, a renewal-blocked Certificate remained in the "Ready=True" state, despite its expiration, for the entire 30-minute observation window. The Certificate, with a 1-hour duration and renewBefore set to 55 minutes, was issued by a SelfSigned Issuer and then the Issuer was deleted to block renewal, generating no additional events.
Despite the certificate expiring, the Ready condition remained unchanged until a controller restart occurred, approximately 34 minutes after expiration. The condition message "Certificate is up to date and has not expired" persisted, misleadingly indicating the certificate's validity. This behavior was observed in a single-node kind cluster running cert-manager v1.21.2, using a 1-hour duration, renewalBefore setting of 55 minutes, and a 30-second polling interval for 30 minutes past the certificate's expiration.
The issue, reported as #7895, highlights the discrepancy between the Ready condition and the actual certificate state when renewal is blocked. This behavior was measured in a controlled environment, with the findings published at https://whenitruns.substack.com/p/when-cert-managers-ready-condition and the reproduction repository available at https://github.com/whenitruns/when-cert-managers-ready-condition-runs-past-expiry-until-a-reconcile.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
