cert-manager Components

cert-manager Components An architecture diagram generated by Archify. cert-manager-controller · Certificate lifecycle management · cert-manager Control Plane cert-manager-controller Certificate lifecycle management cert-manager-webhook · Validates / mutates resources · cert-manager Control Plane cert-manager-webhook Validates / mutates resources cert-manager-cainjector · Automatic CA bundle injection · cert-manager Control Plane cert-manager-cainjector Automatic CA bundle injection Certificate · Desired certificate spec · Custom Resources Certificate Desired certificate spec CertificateRequest · Auto-created issuance request · Custom Resources CertificateRequest Auto-created issuance request Issuer / ClusterIssuer · Defines how to issue · Custom Resources Issuer / ClusterIssuer Defines how to issue Order / Challenge · ACME domain validation · Custom Resources Order / Challenge ACME domain validation Issuer implementations · ACME · Vault · AWS PCA · CA · SelfSigned · Architecture component Issuer implementations ACME · Vault · AWS PCA · CA · SelfSigned Secret · tls.crt · tls.key · Kubernetes Resources Secret tls.crt · tls.key Ingress / Gateway · TLS termination resources · Kubernetes Resources Ingress / Gateway TLS termination resources watches / reconciles controller creates issuerRef signing request controller stores result ACME issuers only validates config CA bundle references TLS Secret cert-manager Control Plane Custom Resources Kubernetes Resources Legend TLS termination resources cert-manager Control Plane Kubernetes Secret Custom resources (CRs) Issuer implementations

Control plane components

  • • controller: watches Certificate and Issuer resources and manages the certificate lifecycle
  • • webhook: validates custom resources, sets defaults, converts versions
  • • cainjector: injects CA bundles into ValidatingWebhookConfiguration and MutatingWebhookConfiguration

Issuance flow

  • • Default renewal: 2/3 of actual issued lifetime; configuration and ARI may change timing
  • • Multiple issuers: Let's Encrypt, Vault, AWS Private CA, Self-Signed
  • • Result stored as a Secret holding tls.crt and tls.key
  • • Consumers must reload updated Secrets; CA trust rollout is managed separately