cert-manager
cert-manager is a Kubernetes add-on that automates the issuance and renewal of TLS certificates from authorities like Let's Encrypt. It watches certificate resources, handles ACME challenges, and stores the resulting certificates as Kubernetes secrets.
itCloud native tools and technologies | OpenSkills.info
Intro
cert-manager
cert-manager automates certificate issuance and renewal inside Kubernetes. You declare the certificate you want. Controllers obtain it from a configured issuer, store it in a Kubernetes Secret, and keep it renewed.
The central mental model is a certificate control loop.
Certificate -> CertificateRequest -> Issuer -> certificate authority
^ |
| v
+----------- TLS Secret <--- signed certificate
This model replaces a manual sequence with declared intent and observed status. It does not replace public key infrastructure, choose trust policy, or make every workload reload renewed certificates.
Why cert-manager exists
TLS certificates expire. Issuing them by hand creates recurring work and failure risk. Kubernetes also encourages short-lived, declarative workloads, while traditional certificate processes often depend on tickets, copied files, and long-lived credentials.
cert-manager connects these worlds. It adds custom resource definitions to the Kubernetes API. Its controllers watch those resources and reconcile them with certificate authorities.
A platform team can define approved issuers. An application team can request a certificate through a Kubernetes resource or an annotated Ingress. cert-manager then tracks issuance, writes the result to a Secret, and renews it before expiry.
This makes the certificate lifecycle visible through familiar Kubernetes tools. It also places certificate operations in the cluster control plane. Permissions, network paths, upgrades, and Secret handling therefore matter.
The core resources
Four resource types explain most cert-manager behavior.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://cert-manager.io/docs/
Supports
- cert-manager documentation scope across installation, issuing, requesting, trust, policy, and troubleshooting
- official learning progression and component reference routes
- https://cert-manager.io/docs/usage/certificate/
Supports
- Certificate as the human-readable desired certificate definition
- private-key and CertificateRequest creation during issuance
- signed certificate and private key storage in the named Secret
- automatic renewal and reissuance behavior
- current private-key rotation behavior and application reload limitation
- https://cert-manager.io/docs/concepts/issuer/
Supports
- Issuer and ClusterIssuer as certificate authority configurations
- issuer ready condition requirement
- Issuer namespace restriction
- ClusterIssuer availability across namespaces
- built-in and external issuer families
- https://cert-manager.io/docs/configuration/
Supports
- issuer setup as the first configuration step after installation
- built-in and external issuer configuration model
- default cluster resource namespace for ClusterIssuer Secret references
- https://cert-manager.io/docs/usage/ingress/
Supports
- ingress-shim watching annotated Ingress resources
- generation of Certificate resources from annotations and TLS configuration
- TLS hosts and Secret name mapping
- Issuer and ClusterIssuer annotation scope
- https://cert-manager.io/docs/configuration/acme/
Supports
- ACME issuer accounts, solvers, Orders, and Challenges
- solver selection and self-check behavior
- staging-oriented configuration and advanced solver options
- https://cert-manager.io/docs/configuration/acme/http01/
Supports
- HTTP-01 use of Ingress or Gateway configuration
- temporary solver Pods, Services, and routing resources
- ingress class options and their compatibility
- self-check resolver behavior and network-policy requirements
- https://cert-manager.io/docs/configuration/acme/dns01/
Supports
- DNS-01 provider configuration and TXT-record workflow
- DNS self-check and resolver controls
- multiple solvers and provider options
- delegated challenge domains and external webhooks
- https://cert-manager.io/docs/troubleshooting/
Supports
- diagnosis from Certificate through CertificateRequest
- conditions, events, issuer readiness, and controller logs
- recommended resource-first troubleshooting sequence
- https://cert-manager.io/docs/troubleshooting/acme/
Supports
- Order and Challenge inspection
- HTTP-01 public and in-cluster reachability checks
- DNS-01 TXT record, propagation, zone, and resolver diagnosis
- ACME self-check behavior
- https://cert-manager.io/docs/installation/best-practice/
Supports
- controller, webhook, and cainjector as long-running components
- network paths among components, API server, DNS, solvers, and issuers
- least-privilege network policy and trusted scheduling guidance
- leader election and replica behavior
- webhook availability and horizontal scaling behavior
- cert-manager as a cluster control-plane service handling private-key Secrets
- https://cert-manager.io/docs/installation/upgrade/
Supports
- backup before upgrade
- one-minor-version-at-a-time guidance
- selection of current patch releases and release-note review
- Helm and separately managed CRD upgrade paths
- installation verification after upgrade
- https://cert-manager.io/docs/releases/
Supports
- current supported cert-manager release window
- Kubernetes and OpenShift compatibility table
- absence of project-maintained long-term-support releases
- https://cert-manager.io/docs/policy/approval/
Supports
- CertificateRequest approval and denial conditions
- separation of request creation, approval, and issuing policy