cert-manager/cert-manager
Cert Manager
This project is a Kubernetes controller that automates the issuance, renewal, and lifecycle management of TLS certificates. It functions as a native extension to the cluster API, using custom resource definitions and reconciliation loops to maintain the desired state of certificates and trust bundles across distributed services. By integrating directly with the cluster's admission control and secret storage systems, it ensures that cryptographic identities are consistently provisioned and available for application workloads.
The project distinguishes itself through its extensive support for automated domain validation and multi-provider integration. It orchestrates complex challenge processes—including those for private or split-horizon networks—to prove domain ownership without manual intervention. Beyond standard certificate management, it provides granular policy enforcement, allowing administrators to restrict issuance permissions, delegate certificate requests to specific service accounts, and enforce security requirements through custom metadata and issuer configurations.
The platform covers a broad capability surface for securing network traffic and service communication. It supports diverse issuance workflows, ranging from public certificate authorities and ACME-based automation to private internal PKI infrastructures. The system also includes robust observability tools, such as operational metrics and status inspection, alongside administrative features for managing resource configurations, performing API migrations, and scaling controller components for high-availability environments.
Installation and management are facilitated through standard cluster deployment workflows, with comprehensive command-line tools available for troubleshooting, configuration export, and lifecycle verification.
Features
- TLS Certificate Management - Automates the issuance, renewal, and lifecycle management of TLS certificates within Kubernetes clusters.
- Kubernetes Controllers - Provides a Kubernetes controller that automates the issuance, renewal, and lifecycle management of TLS certificates.
- ACME Validation Strategies - Automates domain ownership verification using HTTP or DNS challenges for secure certificate issuance.
- Control Loops - Maintains the desired state of certificates through continuous reconciliation loops within the cluster.
- Ingress Controllers - Applies issued TLS certificates to ingress resources to enable encrypted communication for applications exposed to external traffic.
- Certificate Authority Management - Establishes root certificates using self-signed logic to serve as the foundation for internal certificate authorities.
- Cluster Management - Automates the deployment and lifecycle management of certificate management components in a cluster.
- Custom Resource Definitions - Extends the cluster API with custom resources to manage certificate and issuer lifecycles.
- Admission Webhooks - Intercepts and validates resource creation requests to enforce security policies before persistence.
- ACME Clients - Automates domain validation and certificate issuance using the ACME protocol for secure service communication.
- ACME Implementations - Automates domain validation challenges using the ACME protocol to facilitate secure certificate issuance.
- Certificate Authorities - Connects to external certificate authorities to automate the issuance and renewal of TLS certificates.
- Certificate Issuance Utilities - Defines certificate requirements like DNS names and key usages within resource definitions to drive issuance.
- Certificate Lifecycle Management - Automates the lifecycle of certificates by requesting them from configured issuers and storing keys in secure storage.
- Certificate Signing Request Managers - Validates and authorizes certificate issuance requests before processing to ensure only permitted entities obtain certificates.
- SSL/TLS Certificate Management - Automates the generation and maintenance of TLS certificates for network gateways via resource annotations.
- DNS Validation Tools - Automates domain ownership proof by updating DNS records through external provider APIs.
- Automated Key Rotations - Updates the private key associated with a certificate during reissuance to maintain security and ensure zero-downtime transitions.
- PKI Management - Manages private certificate authorities and issues internal TLS certificates for secure microservice communication.
- Certificate Trust Managers - Synchronizes certificate authority bundles across cluster namespaces to ensure consistent validation environments.
- TLS Certificate Management - Assigns wildcard certificates to ingress controllers to provide automatic TLS termination for services.
- Certificate Request Approvals - Enforces granular access control over who can approve or deny certificate requests based on the specific issuer referenced.
- Cloud Platforms - Listed in the “Cloud Platforms” section of the Awesome Mcp Servers awesome list.
- Configuration and Policy Enforcement - Enforces standardized configurations on certificate requests using admission control policies.
- Ephemeral Volume Mounts - Mounts unique TLS certificates directly into pods as ephemeral volumes, ensuring the certificate lifecycle is tied to the pod.
- Certificate Renewal Managers - Enables manual triggering of certificate renewals to bypass standard automated schedules.
- Key Generation Tools - Stores generated certificates in cluster secrets or provides on-demand key generation to prevent sensitive material from leaving the host.
- DNS Validation Providers - Integrates with external DNS providers via webhooks to perform domain ownership challenges.
- Mutual TLS Authentication - Delivers unique certificates and private keys to pods to enable secure mutual TLS identity verification.
- Infrastructure Policy Enforcement - Standardizes certificate properties and restricts request permissions to ensure consistent infrastructure management.
- Machine Identity Authentication - Uses managed identities and service account credentials to securely authorize DNS record management and certificate signing requests.
- Mutual TLS Configurations - Secures connections between the controller and signing authority by requiring client certificate presentation during the handshake.
- SSL Certificate Issuers - Updates certificate issuer references dynamically via configuration maps without requiring redeployment.
- Component Scaling - Configures multiple controller replicas to ensure high availability and resilience.
- Challenge Delegation - Follows CNAME records to update less-privileged DNS zones, allowing certificate issuance without granting full access to the primary domain.
- Workload Delegations - Authorizes individual service accounts to request their own certificates, enabling granular policy enforcement for specific workloads.
- Automated Certificate Management Systems - Watches ingress resources for annotations and automatically creates or manages certificate resources to secure traffic.
- Certificate Authority Configurations - Populates webhook and API service configurations with certificate authority data for secure verification.
- Issuer Access Controls - Validates user permissions via access reviews before allowing the use of specific certificate issuers.
- CSI Drivers - Injects TLS certificates directly into pod volumes through a storage interface, bypassing manual secret storage.
- PKI Automation - Connects Kubernetes workloads to internal and external certificate authorities for automated identity provisioning.
- Secret Management Integrations - Integrates with external secret management systems to securely request and sign TLS certificates.
- Secret Synchronization Tools - Distributes and synchronizes TLS certificates and trust bundles across multiple namespaces to ensure consistent application security.
- Secret Storage - Uses native cluster secrets to securely store private keys and certificate bundles.
- Extensible Provider Frameworks - Supports registration of custom external controllers to integrate with specialized certificate services.
- Ingress Controllers - Generates and manages certificates for ingress resources by monitoring annotations and applying default issuer configurations.
- ACME Challenge Servers - Customizes execution environments and network settings for processes responsible for solving domain validation challenges.
- Self-Signed Generators - Generates self-signed certificates for bootstrapping local environments and ad-hoc testing.
- Certificate Management - Enables developers to request and maintain TLS certificates independently without administrative gateway access.
- Certificate Verification - Validates system operational status by performing automated test issuance and provisioning.
- Certificate Authority Management - Allows specification of preferred certificate chains to support transitions between root certificate providers.
- Secret Management - Manages and synchronizes TLS certificates and private keys as secure Kubernetes secrets for application use.
- Distribution Restrictions - Limits trust bundle propagation to specific namespaces using label selectors to ensure certificates are only available where required.
- Secret Access Policies - Determines whether cluster-wide issuers can utilize ambient environment credentials or require explicit configuration for authentication.
- Custom - Overrides default system nameservers to ensure domain validation succeeds in private network configurations.
- Service Metrics Monitoring - Publishes internal component health and activity data in a standard format for external monitoring systems.
