cert-manager is a Kubernetes-native project written in Go that automates the provisioning, renewal, and management of TLS certificates within Kubernetes clusters. It extends Kubernetes by adding certificates and certificate issuers as custom resource types, allowing operators to define and manage certificate lifecycles declaratively alongside other cluster resources.
The project supports multiple certificate sources including Let's Encrypt via ACME protocol, HashiCorp Vault, CyberArk Certificate Manager, and local in-cluster issuance. This flexibility enables organizations to integrate cert-manager with their existing PKI infrastructure or use public certificate authorities. Beyond initial certificate issuance, cert-manager continuously monitors certificate validity and automatically renews certificates before expiry, reducing operational toil and the risk of service outages caused by expired certificates.
A primary use case documented in the project is automatic TLS certificate provisioning for Kubernetes Ingress resources, particularly with nginx-ingress controllers. This allows teams to secure HTTP traffic to their applications without manual certificate management. The project provides comprehensive documentation at cert-manager.io covering installation across various supported methods, getting started guides, troubleshooting resources, and contribution guidelines.
According to GitGenius activity tracking across 710 issues and pull requests, the project maintains a median response latency of 39.9 hours, indicating active community engagement. The most frequently labeled issues fall into three categories: kind/bug with 301 occurrences, lifecycle/rotten with 228, and kind/feature with 226, reflecting ongoing maintenance and feature development. The core contributor team includes maelvls, wallrj, and inteon as the most active triagers and contributors, each with over 250 tracked events. The project shares contributors with other significant Kubernetes ecosystem projects including argoproj/argo-cd, knative/eventing, and keycloak/keycloak, indicating its importance within the broader cloud-native community.
The codebase is actively developed with support for both Linux and macOS development environments, though macOS requires additional tooling setup. The project explicitly notes that while it provides API version guarantees under the Kubernetes Deprecation Policy, most code under pkg/ is not subject to Go module compatibility guarantees and may change in breaking ways between releases. This design choice prioritizes API stability for end users while maintaining development flexibility.
cert-manager evolved from earlier projects including kube-lego and incorporated lessons from similar certificate management tools. The project prioritizes security as its top concern and provides a dedicated security reporting process. It is distributed through multiple channels including Helm charts and Artifact Hub, with active community engagement through a Google Group, public meetings, and Kubernetes Slack channels dedicated to both user support and development discussion.
