cert-manager Resource Relationships

cert-manager Resource Relationships An architecture diagram generated by Archify. Issuer · Namespace scoped · User-defined · CR Issuer Namespace scoped CR Certificate · Desired certificate spec · User-defined · CR Certificate Desired certificate spec CR ClusterIssuer · Cluster scoped · User-defined · CR ClusterIssuer Cluster scoped CR CertificateRequest · Issuance request · Auto-created CertificateRequest Issuance request Order · ACME order · Auto-created · ACME Order ACME order ACME Challenge · Domain validation · Auto-created · ACME Challenge Domain validation ACME Secret · tls.crt + tls.key · Result Secret tls.crt + tls.key references references controller creates issues issues if ACME issuer creates controller stores User-defined Auto-created Result Legend Backend Database Security

Issuer vs ClusterIssuer

  • • Issuer: a per-team/app issuer usable only within a single namespace
  • • ClusterIssuer: a shared, cluster-wide issuer (for example Let's Encrypt)
  • • A Certificate selects one of them with issuerRef.kind

Resulting Secret

  • • The certificate is stored in the Secret named by spec.secretName
  • • It holds tls.crt and tls.key, referenced by Ingress and others
  • • Renewal uses actual lifetime and policy; Secret consumers must reload the update