cert-manager — Kubernetes-native certificate management

cert-manager is the standard for Kubernetes certificate management. This lesson walks the framework, the ACME integration, the internal CA, Vault PKI, and the operational discipline.

The cert-manager architecture

flowchart LR
    A[cert-manager controller] --> B["Issuer / ClusterIssuer"]
    A --> C[Certificate]
    A --> D[Secret with TLS material]
    B -->|ACME| E[Let's Encrypt]
    B -->|CA| F["Internal CA / Vault PKI"]
    B -->|Self-signed| G[Test only]
    C -->|requested| A
    A -->|issues| B
    A -->|stores in| D

The components:

• cert-manager controller. Deployment that watches Certificate CRs and reconciles them.
• Issuer / ClusterIssuer. Defines the CA (ACME, internal, Vault, self-signed).
• Certificate. Declares a desired certificate.
• Secret. Stores the TLS material (cert, key, CA).

The controller issues certificates when a Certificate is created and renews them before expiry.

An ACME issuer (Let’s Encrypt)

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ops@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-account
    solvers:
      - http01:
          ingress:
            class: nginx
      - dns01:
        route53:
          region: us-east-1
          accessKeyIDSecretRef:
            name: aws-credentials
            key: access-key-id
          secretAccessKeySecretRef:
            name: aws-credentials
            key: secret-access-key

The ACME issuer:

• server. The ACME server URL (Let’s Encrypt production).
• email. Contact for the ACME account.
• privateKeySecretRef. The Secret that stores the ACME account key.
• solvers. The challenge solvers (http-01 for Ingress, dns-01 for DNS).

An internal CA issuer

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: internal-ca
  namespace: prod-app
spec:
  ca:
    secretName: internal-ca-key-pair

The internal CA issuer:

• ca. The Secret containing the CA’s certificate and private key.
• cert-manager signs the issued certificate with the CA.

The CA can be generated by cfssl, easyrsa, openssl, or cert-manager itself with the cert-manager.io/issuer-ca annotation.

A Vault PKI issuer

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: vault-pki
  namespace: prod-app
spec:
  vault:
    server: https://vault.example.com
    path: pki/sign/prod-app
    auth:
      kubernetes:
        role: cert-manager
        mountPath: /v1/auth/kubernetes
        secretRef:
          name: vault-token
          key: token

The Vault PKI issuer:

• server. Vault URL.
• path. The PKI secrets engine path.
• auth.kubernetes. Vault authenticates via Kubernetes ServiceAccount; cert-manager presents a token.

Vault PKI is the enterprise choice for managed PKI with audit trail.

A Certificate request

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: myapp-cert
  namespace: prod-app
spec:
  secretName: myapp-tls
  dnsNames:
    - myapp.example.com
    - myapp.prod-app.svc.cluster.local
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  duration: 2160h  # 90 days
  renewBefore: 720h  # renew 30 days before expiry

The Certificate:

• secretName. The Secret to store the TLS material.
• dnsNames. The SANs (Subject Alternative Names).
• issuerRef. The Issuer or ClusterIssuer to use.
• duration. The validity period (default 90 days).
• renewBefore. How long before expiry to renew (default 30 days).

cert-manager issues the certificate, stores it in the Secret, and renews it before expiry.

The certificate lifecycle

flowchart LR
    A[Certificate CRD created] --> B[cert-manager resolves]
    B --> C[Issue via Issuer]
    C --> D[Store in Secret]
    D --> E["Renewal check: 30 days before"]
    E -->|expiring| C
    E -->|not expiring| F[Done]

The lifecycle:

1. The Certificate CR is created.
2. cert-manager resolves the Issuer and creates a CertificateRequest.
3. The Issuer signs the certificate (via ACME, CA, Vault).
4. cert-manager stores the certificate in the Secret.
5. cert-manager monitors the certificate’s expiry.
6. Before renewBefore, cert-manager renews the certificate.

Quiz

The operational discipline

cert-manager in production rests on five non-negotiable elements:

• Install cert-manager before any Ingress. TLS is automatic.
• Use the right issuer. ACME for public certs; internal CA or Vault for private.
• Set sensible renewal. 30 days before expiry is a good default.
• Monitor certificate expiry. Alert on certificates expiring soon.
• Document the issuer setup. The runbook lists which issuer serves which namespace.

cert-manager is production TLS management. The discipline is to install, configure, and monitor.