cert-manager is the standard tool for automating certificate issuance and renewal inside a Kubernetes cluster, commonly paired with Let's Encrypt via ACME, integrating with an Ingress controller to handle TLS termination.
The basic setup
- Install cert-manager into the cluster (typically via its official Helm chart or manifest).
- Create an Issuer or ClusterIssuer resource pointing at your certificate authority (Let's Encrypt's production or staging ACME endpoint).
- Add a
tlssection to your Ingress resource referencing a secret name — cert-manager watches for this and automatically requests and stores the certificate in that Kubernetes secret.
cert-manager then handles renewal automatically in the background, re-issuing before expiry and updating the referenced secret — your Ingress controller picks up the renewed certificate without manual intervention, the cluster-native equivalent of a cron-scheduled Certbot renewal.
What to check if cert-manager isn't issuing certificates as expected
Checking cert-manager's own logs (`kubectl logs -n cert-manager deploy/cert-manager`) and the status of the relevant Certificate and CertificateRequest resources usually reveals the specific validation or configuration issue, rather than needing to guess based on the Ingress resource alone.
How cert-manager handles renewal automatically once initially configured
cert-manager continuously monitors certificate expiry and automatically requests renewal well ahead of expiration, updating the associated Kubernetes secret that your Ingress or service references — no manual intervention or scheduled job is needed beyond the initial ClusterIssuer and Certificate resource configuration.
What ClusterIssuer versus Issuer resources mean for certificate scope
A ClusterIssuer is available cluster-wide across all namespaces, while a plain Issuer is scoped to a single namespace — choosing ClusterIssuer for a shared, general-purpose CA configuration (like Let's Encrypt) is typical, reserving namespace-scoped Issuers for more specialized, team-specific configurations.
How cert-manager integrates with common Ingress controllers
cert-manager works alongside popular Ingress controllers (nginx-ingress, Traefik, and others) by watching Ingress resources with specific annotations, automatically creating and managing the Certificate resources needed to satisfy the TLS configuration those Ingress resources specify.
Why checking cert-manager's CRD version compatibility matters during cluster upgrades
cert-manager's Custom Resource Definitions occasionally introduce breaking changes between major versions — checking cert-manager's own upgrade documentation before a cluster or cert-manager version upgrade avoids an unexpected certificate management disruption during routine cluster maintenance.
What RBAC permissions cert-manager needs to function correctly in a cluster
cert-manager requires specific Kubernetes RBAC permissions to create and manage its Custom Resources, along with permissions relevant to whatever validation method you're using (like modifying Ingress resources for HTTP-01, or accessing DNS provider credentials for DNS-01) — a permissions issue is a common cause of cert-manager failing silently in a newly set up cluster.
How to handle certificate renewal monitoring specifically within a Kubernetes environment
Beyond cert-manager's own automatic renewal, monitoring the Certificate resource's status condition through your cluster's standard monitoring tooling (Prometheus and similar) gives visibility into renewal health consistent with how you already monitor other cluster resources, rather than requiring a separate, Kubernetes-external monitoring approach.
A closing note on cert-manager's role within the broader Kubernetes ecosystem
cert-manager has become close to a de facto standard for certificate automation in Kubernetes specifically because it integrates cleanly with the platform's existing declarative, resource-based configuration model — a natural fit rather than a bolted-on afterthought.
A final thought on cert-manager's scalability as your cluster grows
As your cluster grows to host more services each needing HTTPS, cert-manager's declarative approach scales cleanly — adding TLS to a new Ingress resource is simply a matter of adding the appropriate annotation, rather than requiring a separate manual certificate request process each time.