Cert-manager
lastmod 2025-12-22created 2022-09-2814 edits
Automatically provision and manage TLS certificates in Kubernetes.
Installation
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
Check the latest version and update the URL. For reference, when I installed it on k3s, the following log was printed:
$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
namespace/cert-manager created
customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created
customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created
serviceaccount/cert-manager-cainjector created
serviceaccount/cert-manager created
serviceaccount/cert-manager-webhook created
configmap/cert-manager-webhook created
clusterrole.rbac.authorization.k8s.io/cert-manager-cainjector created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-issuers created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificates created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-orders created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-challenges created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created
clusterrole.rbac.authorization.k8s.io/cert-manager-view created
clusterrole.rbac.authorization.k8s.io/cert-manager-edit created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created
clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created
clusterrole.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-cainjector created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-issuers created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificates created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-orders created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-challenges created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created
clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created
role.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created
role.rbac.authorization.k8s.io/cert-manager:leaderelection created
role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created
rolebinding.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created
rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection created
rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created
service/cert-manager created
service/cert-manager-webhook created
deployment.apps/cert-manager-cainjector created
deployment.apps/cert-manager created
deployment.apps/cert-manager-webhook created
mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created
validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created
You can check the installed pods with the following command.
The output looks like this:
NAME READY STATUS RESTARTS AGE
cert-manager-7476c8fcf4-p6ndk 1/1 Running 0 4m21s
cert-manager-cainjector-bdd866bd4-r7wmp 1/1 Running 4 (2m22s ago) 4m21s
cert-manager-webhook-5655dcfb4b-d2kzz 1/1 Running 4 (2m22s ago) 4m19s
For reference, if you check all pods with the following command:
You get the following:
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system local-path-provisioner-957fdf8bc-jqhnh 1/1 Running 2 (4h22m ago) 4h25m
kube-system helm-install-traefik-crd-w48dv 0/1 Completed 1 4h25m
kube-system helm-install-traefik-58bgc 0/1 Completed 3 4h25m
kube-system svclb-traefik-63314ab5-gfppw 2/2 Running 0 4h20m
cert-manager cert-manager-7476c8fcf4-p6ndk 1/1 Running 0 4m38s
kube-system coredns-77ccd57875-jh9gm 1/1 Running 0 4h25m
kube-system traefik-64f55bb67d-gj8fc 1/1 Running 0 4h20m
cert-manager cert-manager-cainjector-bdd866bd4-r7wmp 1/1 Running 4 (2m39s ago) 4m38s
cert-manager cert-manager-webhook-5655dcfb4b-d2kzz 1/1 Running 4 (2m39s ago) 4m36s
kube-system metrics-server-648b5df564-xm5vs 1/1 Running 3 (2m32s ago) 4h25m
Delete
Just change the apply command above to delete.
kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
Pods
- cert-manager
- Plays the core role of managing certificates. It is responsible for automatically issuing, renewing, and revoking SSL/TLS certificates within the Kubernetes cluster.
- cert-manager-cainjector
- CA Injector - cert-manager Documentation
- This is the CA Injector. It automatically inserts certificates within Kubernetes. This pod dynamically injects certificates from the API server via webhooks.
- cert-manager-webhook
- A webhook server that manages communication between cert-manager and the cluster. It verifies certificates and checks their validity at issuance time. The webhook interacts with the Kubernetes API server and performs dynamic conversion tasks.
cmctl
The CLI command of cert-manager.
CRDs
cert-manager uses Kubernetes Custom Resources to define the resources which users interact with when using cert-manager, such as Certificates and Issuers.
When changes are made to the CRDs in code, there are a couple of extra steps which are required.