On cert-manager v1.21.2, a renewal-blocked Certificate kept Ready=True ("Certificate is up to date and has not expired") past notAfter through our 30-minute window, until a restart reconciled it.

When It Runs — Run Report #RR10 · Testing what infrastructure actually does.

Provider · Component: cert-manager · the Certificate Ready condition (readiness controller) after status.notAfter has passed, when renewal is blocked

Versions tested: measured — cert-manager v1.21.2 (the latest release as of 2026-09-11; v1.21.3, released on 2026-10-23, was not measured; single version). reported — v1.18.2 (issue #7895; a report-layer detail, not measured here).…