Luca BertonIn Kubernetes, certificates multiply fast: ingress endpoints, service mesh mTLS, webhook TLS, API server certificates, etcd encryption. Managing these manually is impossible at scale. cert-manager automates the entire lifecycle — from issuance to renewal to rotation.
cert-manager Architecture
cert-manager is a Kubernetes-native certificate controller:
- Issuer/ClusterIssuer — Configures certificate authority (Let's Encrypt, Vault, self-signed, Venafi)
- Certificate resource — Declares desired certificate with subject, SANs, duration, renewal window
- Automated renewal — Renews certificates before expiration (configurable threshold, default 2/3 of lifetime)
- Secret management — Stores certificates as Kubernetes Secrets, available to pods and ingress controllers
Production Patterns
Pattern 1: Let's Encrypt for Public Endpoints
ACME HTTP-01 or DNS-01 challenge for public-facing ingress. Automatic 90-day certificate issuance and renewal. Staging issuer for testing, production issuer for live traffic. Rate limit awareness with certificate caching.
Pattern 2: Vault PKI for Internal Services
HashiCorp Vault as ClusterIssuer for internal mTLS certificates. Short-lived certificates (1-24 hours). Role-based policies controlling which namespaces can request which certificate types. Audit logging of all issuance events.
Pattern 3: Multi-Cluster Certificate Management
For multi-cluster deployments: shared CA across clusters for cross-cluster mTLS, per-cluster intermediate CAs for isolation, centralized certificate policy with distributed enforcement.
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Monitoring cert-manager
- Prometheus metrics:
certmanager_certificate_expiration_timestamp_seconds - Alert on certificates expiring within threshold
- Alert on failed issuance or renewal attempts
- Dashboard showing certificate inventory, health, and renewal status
Common Pitfalls
- Let's Encrypt rate limits — Use staging for testing; implement certificate caching for ephemeral environments
- DNS propagation delays — DNS-01 challenges can fail if DNS propagation is slow; configure appropriate wait times
- Secret rotation lag — Applications must reload certificates on renewal; use file-based mounts or sidecar reloaders
- Cluster recovery — Backup cert-manager CRDs and secrets; lost certificates during recovery cause outages
Automating Azure DevTest Labs
Automate lab management and integrate with CI/CD pipelines.
Start on Pluralsight →