cert-manager
cert-manager is a Kubernetes add-on that automates the issuance and renewal of TLS certificates from authorities like Let's Encrypt. It watches certificate resources, handles ACME challenges, and stores the resulting certificates as Kubernetes secrets.
itCloud native tools and technologies | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - cert-manager
cert-manager centers on cert-manager. cert-manager automates certificate issuance and renewal inside Kubernetes. You declare the certificate you want.
Operate from the project's own resources and APIs. Learn how desired state becomes running state, which status conditions matter, and which dependencies (network, storage, identity, certificates) the control plane assumes.
Upgrades, backups, and credential rotation are part of the product, not optional aftercare. Version skew between clients and servers creates failures that look like application bugs. Pin versions and rehearse rollback.
Convenience features reduce boilerplate and widen blast radius. Enable them when you can observe and reverse the expanded surface. Defaults from quickstarts are starting points, not production policy.
Name owners for upgrades, credentials, and disaster recovery before traffic arrives. Unowned control-plane state becomes an outage with no clear pager. Prefer explicit version pins and tested rollback over floating tags that quietly change behavior between deploys.
Name owners for upgrades, credentials, and disaster recovery before traffic arrives. Unowned control-plane state becomes an outage with no clear pager. Prefer explicit version pins and tested rollback over floating tags that quietly change behavior between deploys.
Name owners for upgrades, credentials, and disaster recovery before traffic arrives. Unowned control-plane state becomes an outage with no clear pager. Prefer explicit version pins and tested rollback over floating tags that quietly change behavior between deploys.
Read the Intro for the mental model. Use the Cheatsheet when you need the resource map. Updates and Upstream track the cert-manager release line that changes these APIs.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://cert-manager.io/docs/
Supports
- cert-manager documentation scope across installation, issuing, requesting, trust, policy, and troubleshooting
- official learning progression and component reference routes
- https://cert-manager.io/docs/usage/certificate/
Supports
- Certificate as the human-readable desired certificate definition
- private-key and CertificateRequest creation during issuance
- signed certificate and private key storage in the named Secret
- automatic renewal and reissuance behavior
- current private-key rotation behavior and application reload limitation
- https://cert-manager.io/docs/concepts/issuer/
Supports
- Issuer and ClusterIssuer as certificate authority configurations
- issuer ready condition requirement
- Issuer namespace restriction
- ClusterIssuer availability across namespaces
- built-in and external issuer families
- https://cert-manager.io/docs/configuration/
Supports
- issuer setup as the first configuration step after installation
- built-in and external issuer configuration model
- default cluster resource namespace for ClusterIssuer Secret references
- https://cert-manager.io/docs/usage/ingress/
Supports
- ingress-shim watching annotated Ingress resources
- generation of Certificate resources from annotations and TLS configuration
- TLS hosts and Secret name mapping
- Issuer and ClusterIssuer annotation scope
- https://cert-manager.io/docs/configuration/acme/
Supports
- ACME issuer accounts, solvers, Orders, and Challenges
- solver selection and self-check behavior
- staging-oriented configuration and advanced solver options
- https://cert-manager.io/docs/configuration/acme/http01/
Supports
- HTTP-01 use of Ingress or Gateway configuration
- temporary solver Pods, Services, and routing resources
- ingress class options and their compatibility
- self-check resolver behavior and network-policy requirements
- https://cert-manager.io/docs/configuration/acme/dns01/
Supports
- DNS-01 provider configuration and TXT-record workflow
- DNS self-check and resolver controls
- multiple solvers and provider options
- delegated challenge domains and external webhooks
- https://cert-manager.io/docs/troubleshooting/
Supports
- diagnosis from Certificate through CertificateRequest
- conditions, events, issuer readiness, and controller logs
- recommended resource-first troubleshooting sequence
- https://cert-manager.io/docs/troubleshooting/acme/
Supports
- Order and Challenge inspection
- HTTP-01 public and in-cluster reachability checks
- DNS-01 TXT record, propagation, zone, and resolver diagnosis
- ACME self-check behavior
- https://cert-manager.io/docs/installation/best-practice/
Supports
- controller, webhook, and cainjector as long-running components
- network paths among components, API server, DNS, solvers, and issuers
- least-privilege network policy and trusted scheduling guidance
- leader election and replica behavior
- webhook availability and horizontal scaling behavior
- cert-manager as a cluster control-plane service handling private-key Secrets
- https://cert-manager.io/docs/installation/upgrade/
Supports
- backup before upgrade
- one-minor-version-at-a-time guidance
- selection of current patch releases and release-note review
- Helm and separately managed CRD upgrade paths
- installation verification after upgrade
- https://cert-manager.io/docs/releases/
Supports
- current supported cert-manager release window
- Kubernetes and OpenShift compatibility table
- absence of project-maintained long-term-support releases
- https://cert-manager.io/docs/policy/approval/
Supports
- CertificateRequest approval and denial conditions
- separation of request creation, approval, and issuing policy