Skip to main content

cert-manager

Edit on GitHubStar

📚 Learning Resources​

📖 Essential Documentation​

📝 Specialized Guides​

🎥 Video Tutorials​

🎓 Professional Courses​

📚 Books​

🛠️ Interactive Tools​

🚀 Ecosystem Tools​

🌐 Community & Support​

Understanding cert-manager: Kubernetes-Native Certificate Management​

cert-manager is a Kubernetes-native certificate management controller that automates the provisioning and management of TLS certificates. It integrates with various certificate authorities and provides a declarative approach to certificate lifecycle management.

How cert-manager Works​

cert-manager extends Kubernetes with custom resources (CRDs) that represent certificates, certificate issuers, and certificate requests. It continuously monitors these resources and automatically provisions, renews, and manages TLS certificates from various sources including Let's Encrypt, HashiCorp Vault, Venafi, and self-signed certificates.

The controller watches for Certificate resources and creates CertificateRequest objects, which are processed by configured Issuers or ClusterIssuers. These issuers handle the certificate authority communication, ACME challenges, and certificate delivery back to Kubernetes secrets.

The cert-manager Ecosystem​

cert-manager integrates with major certificate authorities and cloud providers through its issuer plugins. It supports ACME protocols for Let's Encrypt, Vault PKI backends, Venafi Trust Protection Platform, and external issuers through webhooks. The ecosystem includes CSI drivers for mounting certificates as volumes, external DNS integration for automated challenge records, and monitoring tools for certificate expiry tracking.

Cloud-specific integrations include AWS Certificate Manager, Google Certificate Authority Service, and Azure Key Vault, enabling hybrid certificate management strategies across on-premises and cloud environments.

Why cert-manager Dominates Kubernetes Security​

cert-manager solves the critical problem of certificate lifecycle management in dynamic Kubernetes environments. Manual certificate management doesn't scale with ephemeral workloads, frequent deployments, and microservices architectures.

It provides automated renewal before expiration, preventing outages caused by expired certificates. The declarative approach means certificate configuration lives alongside application manifests, enabling GitOps workflows and consistent certificate policies across environments.

Mental Model for Success​

Think of cert-manager like an automated office building security system. Just as the system automatically issues access cards (certificates) to employees, manages their expiration dates, and renews them before they expire, cert-manager handles TLS certificates for your applications. The Issuers are like different departments that approve access cards - some strict (production CA), others lenient (development self-signed). Certificate resources are like access card requests with specific requirements (domains, validity period), and the system ensures everyone has valid, up-to-date access without manual intervention.

Where to Start Your Journey​

  1. Deploy cert-manager - Install cert-manager in a development cluster using Helm
  2. Create your first Issuer - Set up a ClusterIssuer for Let's Encrypt staging environment
  3. Request a certificate - Create a Certificate resource for a test application
  4. Configure DNS challenges - Set up automated DNS-01 challenges for wildcard certificates
  5. Integrate with ingress - Use annotations to automatically request certificates for ingress resources
  6. Monitor certificate health - Set up alerts for certificate expiry and renewal failures

Key Concepts to Master​

  • Issuers vs ClusterIssuers - Namespace-scoped vs cluster-wide certificate authorities
  • ACME challenge types - HTTP-01 for single domains vs DNS-01 for wildcards
  • Certificate lifecycle - Issuance, renewal, revocation, and rotation processes
  • Resource hierarchy - Certificates → CertificateRequests → Orders → Challenges
  • Webhook configuration - External issuers and custom certificate authorities
  • Security considerations - Private key storage, CA trust chains, and access controls
  • Integration patterns - Ingress annotations, CSI driver usage, and application consumption
  • Troubleshooting techniques - Debugging failed issuances and renewal issues

Start with simple self-signed certificates in development, progress to Let's Encrypt staging, then production certificates with proper monitoring. Understanding the ACME protocol and Kubernetes RBAC will help you design secure, scalable certificate management solutions.

📡 Stay Updated​

Release Notes: cert-manager Releases • Jetstack Updates • Let's Encrypt News

Project News: cert-manager Blog • CNCF Security • Kubernetes SIG Security

Community: KubeCon Talks • cert-manager Office Hours • Security Conferences