cert-manager

What cert-manager is

cert-manager is a free tool for obtaining and maintaining X.509 certificates from public and private issuers. It keeps certificates current and attempts renewal before expiry, including automating issuance and renewal for Kubernetes Ingress TLS. Private PKI issuers can also provide certificates for pod-to-pod mTLS. The project describes use for web-facing and internal workloads on Kubernetes and OpenShift. Documented issuer choices include Let's Encrypt, HashiCorp Vault, CyberArk Certificate Manager and private PKI. Installation options include static manifests applied with kubectl, Helm, and continuous deployment tools such as Flux and Argo CD. Related projects include istio-csr, approver-policy, Kubernetes CSI drivers, csi-driver-spiffe and trust-manager. The latter distributes X.509 trust bundles across Kubernetes and OpenShift clusters and can operate independently. The project publishes a threat model and hardening guide covering topics such as secrets, RBAC, networking and Kubernetes configuration. That guidance notes that default Helm chart settings prioritize ease of installation and backward compatibility over production-grade hardened security. The open-source project does not maintain LTS releases; each release is supported at least until the second subsequent version is released.

Who it suits

It is intended for teams running Kubernetes or OpenShift workloads that need managed certificates for public-facing or internal services. It can also suit teams using public or private certificate issuers and automated deployment tools.

Limits

The open-source project supports each release at least until the second subsequent version is released and does not maintain LTS releases. The default Helm chart values prioritize ease of installation and backward compatibility over production-grade hardened security practices.

Getting started

1. Visit https://cert-manager.io/.
2. Choose an installation route: static manifests with kubectl, Helm, Flux, or Argo CD.
3. Select a public or private issuer, such as Let's Encrypt, HashiCorp Vault, CyberArk Certificate Manager, or private PKI.
4. Use cert-manager to manage certificates for Kubernetes or OpenShift workloads.

Verdict

cert-manager handles certificate lifecycle work for Kubernetes and OpenShift, with options for TLS and private-PKI mTLS. Teams should review the hardening guidance and account for the project's release support policy.