jetstack/cert-manager
Cert Manager
cert-manager is a Kubernetes TLS certificate manager and cluster add-on that automates the issuance and renewal of TLS certificates. It functions as a certificate lifecycle automator, managing certificates as native Kubernetes resources to secure internal and external network traffic.
The project includes an ACME protocol client to automate certificate requests and validations from providers. It utilizes a controller to synchronize the desired state of certificates with responses from various certificate authorities.
The system covers certificate provisioning from external issuers and vault systems, tracking expiration dates, and performing automatic renewals to prevent service outages. It integrates with Kubernetes secrets to store certificates and private keys for use by cluster workloads.
Features
- Certificate Lifecycle Management - Automates the full lifecycle of security certificates, including issuance, rotation, and revocation.
- Declarative Certificate Resources - Allows certificates and issuers to be defined as native Kubernetes resources for simplified deployment and tracking.
- Resource Controllers - Provides a custom controller that synchronizes the state of certificate resources within the Kubernetes cluster.
- ACME Implementations - Implements the ACME protocol to automate certificate requests and validations from providers like Let's Encrypt.
- Certificate Lifecycle Managers - Acts as a background service that automates the ongoing maintenance and renewal of security certificates.
- Certificate Renewal Managers - Automatically monitors expiration dates and requests new certificates to ensure continuous service availability.
- SSL/TLS Certificate Management - Provisions TLS certificates from external issuers and vault systems to secure internal and external network traffic.
- Certificate Expiry Tracking - Periodically scans stored certificates to identify those nearing expiration and trigger automatic renewal workflows.
- Kubernetes Security - Secures Kubernetes network traffic by automating the provisioning of TLS certificates for cluster workloads.
- Infrastructure Add-ons - Functions as a cluster-level add-on that extends Kubernetes with native certificate management capabilities.
- Declarative Security Configurations - Defines certificates and issuers as cluster resources to enable infrastructure-as-code security management.
- Secret Management Integrations - Integrates with Kubernetes secrets to store issued TLS certificates and private keys for workload consumption.
- Plugin-Based Architectures - Employs a plugin-based architecture to support diverse certificate authorities via a common abstraction layer.
- State Reconciliation - Uses a reconciliation loop to continuously synchronize the current certificate status with the desired specification.
- Networking - Automates TLS certificate management and issuance.
- Security and Compliance - Automated TLS certificate management for Kubernetes.
- SSL Management - Kubernetes-native controller for automated TLS certificate management.
