Cert-Manager Beyond Ingress – Exploring the Variety of Use Cases
summary
Cert-manager v1.0 (donated to CNCF Sandbox) automates X.509 lifecycle via CRDs like Certificate and CertificateRequest and has ~280 contributors. It issues ACME certs (example: Let's Encrypt staging), supports built‑in self‑signed and CA issuers and external issuers (Vault, Smallstep, Google CAS, AWS PCA, Venafi). Practical builds include pod‑to‑pod mTLS using secrets or the CSI driver to keep private keys node‑local, integrations with Linkerd/Istio/OSM, kubeadm external‑CA workflows, and upcoming support for the Kubernetes CSR API in 1.3.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:28CertManager Overview
- 2:07TLS Certificate
- 2:45How does it work
- 3:48Ingress shim
- 4:41Other certificates
- 5:31Microservices
- 6:13Example
- 8:02Private CA
- 12:49CSI Driver
- 13:08Private Keys
- 14:16csiDriver
- 16:04Webhooks
- 17:05Annotations
- 18:02Cluster API
- 18:50Service Mesh
- 20:33Integrations
- 23:44Kubernetes Control Plane
- 24:05CubeAdam
- 27:53Summary
related talks
26mcert-manager - Past, Present and Future
15mCertificates in Kubernetes
38mImplementing Cert-manager in K8s
31mHow We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-manager
10mLightning Talk: Your Wish Is Our Command: Declarative Certificate Management in a...
38mSecuring Edge Workloads With Cert-Manager And SPIFFE
36mCertifik8s: All You Need to Know About Certificates in Kubernetes
36mYou Like It Or Not; You Need It! - PKI And Certificate Management