Cert-Manager
CNCF-hosted Kubernetes certificate management controller
Cert-Manager is an open-source Kubernetes controller, incubated within the Cloud Native Computing Foundation ecosystem, that automates the issuance, renewal, and lifecycle management of TLS certificates for workloads running inside a…
Definition
Cert-Manager is an open-source Kubernetes controller, incubated within the Cloud Native Computing Foundation ecosystem, that automates the issuance, renewal, and lifecycle management of TLS certificates for workloads running inside a Kubernetes cluster. It extends Kubernetes with custom resources representing certificates and certificate issuers, so requesting a certificate becomes a declarative Kubernetes object rather than a manual or externally scripted process, and it can source certificates from ACME authorities like Let's Encrypt, HashiCorp Vault, or an internal private certificate authority.
Overview
Kubernetes workloads frequently need TLS certificates for ingress controllers, internal service-to-service communication, and API endpoints, but the platform itself has no native concept of certificate issuance or renewal. Before cert-manager, operators either provisioned certificates manually and stored them as Kubernetes secrets, or wrote custom automation scripts to call out to a certificate authority, both of which were fragile approaches that did not fit Kubernetes's declarative, reconciliation-driven model. Cert-manager solves this by introducing several custom resource definitions: an Issuer or ClusterIssuer describes where certificates come from, and a Certificate resource describes what certificate is needed, for which domain names, and which Kubernetes secret should hold the resulting key material. A controller running inside the cluster continuously reconciles these resources, meaning it watches for Certificate objects, requests the corresponding certificate from the configured issuer, handles any required domain-validation challenges automatically, stores the result as a Kubernetes secret, and re-requests a new certificate before the old one expires, all without human intervention. For ACME-based issuers, cert-manager supports both HTTP-01 challenges, which briefly expose a token through an ingress controller, and DNS-01 challenges, which create a temporary DNS record through supported DNS provider integrations. Cert-manager differs from a tool like Certbot primarily in its operating model: rather than running as a periodic script on a single server, it is a long-running controller that follows Kubernetes's reconciliation loop pattern, integrating with ingress controllers and other Kubernetes-native resources rather than modifying files on disk. This makes it a natural fit alongside service meshes like Istio or Linkerd, which often need mutual TLS certificates issued and rotated automatically across many pods. In practice, platform teams deploy cert-manager once per cluster and then let application teams request certificates simply by annotating an Ingress resource or creating a Certificate object, removing certificate management from individual application deployment pipelines. It is widely used with public ACME authorities for internet-facing services and with private issuers such as HashiCorp Vault for internal, mutual-TLS-secured service communication. The main trade-off is operational: cert-manager itself is another cluster-critical component that must be kept healthy, upgraded, and monitored, and a misconfigured issuer or challenge solver can silently fail to renew certificates until an outage occurs. It also assumes workloads run inside Kubernetes; certificate needs for servers or services outside the cluster still require a separate tool such as Certbot or a manual process. Teams also need to plan for issuer outages, since if the configured ACME endpoint or private authority becomes unreachable during a renewal window, cert-manager cannot silently substitute another source, so monitoring renewal success rather than only certificate expiry is considered good practice.
Key Features
- Extends Kubernetes with Certificate and Issuer custom resources
- Automates ACME HTTP-01 and DNS-01 domain validation challenges
- Stores issued certificates as native Kubernetes secrets
- Supports public ACME authorities and private certificate authorities like Vault
- Continuously reconciles certificates to renew before expiration
- Integrates with ingress controllers for automatic TLS termination
- Works alongside service meshes for mutual TLS certificate rotation
- Runs as a long-lived controller rather than a periodic script
Use Cases
Alternatives
Frequently Asked Questions
From the Blog
What Is a Project Manager and What Do They Actually Do?
A project manager plans, coordinates, and keeps a project on track from start to finish. This guide explains the role's core responsibilities, common methodologies, and how to break into the profession.
Read More Career GrowthWhat Is a Financial Risk Manager (FRM)? Role and Career Path Explained
A Financial Risk Manager identifies, measures, and helps control the financial risks an organization faces, from market swings to credit defaults. This guide explains what the role involves, the FRM designation, and how to break into the field.
Read More Career GrowthWhat Does a Marketing Manager Do? A Complete Career Guide
A marketing manager plans and directs campaigns that build brand awareness and drive sales, coordinating research, content, budgets, and teams to hit growth goals. Here is what the role covers day to day and how to move into it.
Read More Career GrowthWhat Does a Product Manager Actually Do?
A product manager decides what a team builds and why, turning customer problems and business goals into a prioritized roadmap. This guide breaks down the daily responsibilities, required skills, and how the role differs from project management.
Read More