cert-manager

cert-manager adds certificates and certificate issuers as native resource types inside Kubernetes clusters, turning certificate lifecycle management into a declarative, controller-driven process instead of a manual chore. It watches Certificate and Issuer custom resources, requests certificates from a configured source, and keeps them renewed automatically before they expire.

It supports issuance from a wide range of sources out of the box: Let’s Encrypt and other ACME providers, HashiCorp Vault, Venafi/CyberArk Certificate Manager, and self-signed or private in-cluster CAs. Deployed as a set of controllers (the core controller, a webhook for validation/mutation, cainjector for injecting CA bundles, and acmesolver for ACME HTTP01 challenges), it has become the de facto standard for TLS automation on Kubernetes and is a CNCF-graduated project.

What You Get

• Custom Resource Definitions (Certificate, Issuer, ClusterIssuer, CertificateRequest) that make certificate lifecycle declarative and GitOps-friendly
• Automatic renewal well before expiry, removing a common cause of production outages
• Built-in ACME support for Let’s Encrypt (HTTP01 and DNS01 challenges across major DNS providers)
• Pluggable issuer backends: HashiCorp Vault, Venafi/CyberArk, self-signed and private CA hierarchies
• A validating/mutating webhook that catches misconfigured resources before they’re applied
• cainjector for automatically injecting CA bundles into webhook configs, API services, and CRD conversion webhooks

Common Use Cases

• Automatically issuing and renewing TLS certificates for Ingress resources so HTTPS ‘just works’ on new hosts
• Running an internal private CA to issue mTLS certificates between in-cluster services
• Integrating existing enterprise PKI (Vault, Venafi) into Kubernetes without hand-rolled cert rotation scripts
• Meeting compliance requirements for short-lived certificates via automated, unattended renewal
• Backing service mesh mTLS or API gateway TLS termination with centrally managed certificate issuance

Under The Hood

Architecture cert-manager is organized as several independently deployable controller binaries under cmd/ (controller, webhook, cainjector, acmesolver, startupapicheck), each with a thin main.go that wires a Cobra command from internal/cmd into a long-running process; the actual reconciliation logic lives in pkg/controller and internal/controller, split by resource type (certificates, certificaterequests, issuers, acmeorders, acmechallenges, clusterissuers), each following the standard Kubernetes controller-runtime pattern of watching CRDs and applying focused reconcile loops. Certificate issuance itself is abstracted behind pluggable issuer implementations, so ACME, Vault, Venafi, and self-signed all satisfy the same interface, keeping the core reconciliation logic decoupled from any single certificate source; the webhook and cainjector binaries exist purely to keep validation and CA-bundle injection isolated from the main control loop for security and blast-radius reasons.

Tech Stack Written in Go against Kubernetes 1.37-era client libraries (k8s.io/client-go, k8s.io/apiserver, k8s.io/apiextensions-apiserver, k8s.io/component-base), with a generated typed clientset, informers, and listers under pkg/client for programmatic consumption of its CRDs. CLI plumbing runs on spf13/cobra/pflag; issuer backends pull in hashicorp/vault/api, Venafi/vcert, aws-sdk-go-v2, Azure and Akamai/DigitalOcean DNS SDKs, and go-acme-style ACME handling via nrdcg/goacmedns and hand-rolled ACME logic; observability runs through prometheus/client_golang and structured logging via go-logr/logr. Build and release tooling is Make-based with klone.yaml/hack/ scripts driving code generation for the CRDs and clientset.

Code Quality The project ships an extensive test suite (over 200 _test.go files) covering controllers, issuer implementations, and CLI options, using stretchr/testify for assertions and the standard controller-runtime fake-client patterns for reconciler tests; error handling consistently distinguishes expected Kubernetes API conditions (e.g. apierrors.IsNotFound) from unexpected failures rather than swallowing errors generically. Linting is enforced via a fairly strict .golangci.yaml (custom forbidigo rules banning stray debug prints, exhaustive switch checks, dogsled limits), and CI runs govulncheck and OpenSSF Scorecard scanning, indicating an actively maintained quality bar for a CNCF-graduated project.

What Makes It Unique cert-manager’s distinguishing choice is treating certificates as a first-class, declarative Kubernetes resource type rather than a side effect of an ingress controller or a manually-run script, which lets any tool in the cluster (Ingress controllers, service meshes, custom operators) request certificates through a uniform CRD-based API regardless of which backend actually issues them. The separation of the CA-injection concern (cainjector) from the main controller is a comprehensive answer to a chicken-and-egg bootstrapping problem — injecting webhook CA bundles before the webhook itself can serve traffic — that many home-grown certificate automation approaches don’t handle safely.