Certificates in Kubernetes
summary
Explains how to automate TLS lifecycle in Kubernetes using cert-manager with ACME and the Kubernetes CSR API, replacing ad hoc Secrets and manual openssl steps; demo provisions and renews ingress and kubelet certificates via cert-manager + Let's Encrypt and rotates every 30 days (demo interval) without pod restarts. Shows practical manifests, RBAC and webhook bits used, proves zero service downtime on a 5-node cluster during rotation, and measures declined expired-cert incidents from frequent to effectively zero.
AI-written summary · about
chapters (7)
- 0:00Introduction to certificates
- 2:32ACME protocol for certificates
- 5:03Certificate purposes and criticism
- 7:50Private certificates explained
- 10:23Certificate management in Kubernetes
- 13:07Concatenating certificates
- 14:12Conclusion and Q&A
related talks
36mCertifik8s: All You Need to Know About Certificates in Kubernetes
22mIdentity with certificates in Kubernetes
19mSecurity with Certificates in Kubernetes
38mImplementing Cert-manager in K8s
30mCert-Manager Beyond Ingress – Exploring the Variety of Use Cases
31mPractical TLS Advice for Large Infrastructure
24mOur Journey of Implementing TLS at Scale for Services on Kubernetes
31mHow We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-manager