Skip to main content

Install cert-manager

Inspect 1.36

cert-manager requests TLS certificates, stores them in Secrets, and renews them before they expire, so your ingress always has a valid certificate without requiring you to track expiry dates. Syself Autopilot does not provide it; you install it yourself as a normal workload.

Install and verify#

Install the chart with its CRDs #

Install cert-manager and its custom resources into a dedicated namespace:

		$ helm repo add jetstack https://charts.jetstack.io
$ helm repo update
$ helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --set crds.enabled=true

For an ingress that must remain available through node drains, run more than one controller replica and spread them across nodes, the same availability pattern that every platform workload requires.

Verify the webhook is healthy #

cert-manager runs an admission webhook that validates every issuer and Certificate you create, and nothing functions until it is ready. Check that its deployments are available before you create an issuer:

		$ kubectl get pods -n cert-manager
NAME                          READY   STATUS    RESTARTS   AGE
cert-manager-...              1/1     Running   0          2m
cert-manager-cainjector-...   1/1     Running   0          2m
cert-manager-webhook-...      1/1     Running   0          2m

If a Certificate you create later remains without events, check the webhook first.

Issuer or ClusterIssuer#

cert-manager reads two kinds of issuer, and the difference is scope:

  • An Issuer is namespaced: it issues certificates only in its own namespace. Use it to keep one tenant's certificate authority configuration inside that tenant's namespace.
  • A ClusterIssuer is cluster-wide: any namespace can reference it. Use it for a shared Let's Encrypt setup that every application draws on.

Most clusters start with one ClusterIssuer; see .

Prefer not to run it yourself?
cert-manager, a `ClusterIssuer`, and DNS wiring are a small but real operational responsibility. Syself can set this up for you and keep it running, from a one-time setup to a fully managed arrangement. Contact [contact@syself.com](mailto:contact@syself.com).
Note

When you upgrade cert-manager, upgrade its CRDs to match the chart version. A chart running against older CRDs is a common cause of certificates that silently stop reconciling.

Where to go next#

Automate DNS records with external-dns

Let external-dns publish and update A and AAAA records for your Services and Ingresses automatically at your DNS provider.

Set up a Let's Encrypt ClusterIssuer

Create a Let's Encrypt ClusterIssuer and let cert-manager fetch free certificates for every ingress in the cluster.