Skip to content

cert-manager Overview

This package wraps the upstream cert-manager chart with Big Bang images, hardening, mesh/network integration, optional managed issuers, and issuance tests. Use the cert-manager documentation for general product behavior and the v1.20.3 chart and upstream values for the bundled configuration surface. Match the upstream ref to the dependency in Chart.yaml when using another package version.

Configuration ownership

The package values contain Big Bang overrides, not the complete upstream schema. Pass native chart configuration through upstream; keep Big Bang-managed issuers, bb-common, and bbtests at the package root. Use the generated README for package metadata and values.

In Big Bang, the canonical package name is certManager, not cert-manager:

Entry point Purpose
packages.certManager.enabled Enable the package with packageConfiguration.version: v1.
packages.certManager.values Pass package overrides, including upstream, issuers, and bb-common.
certManager Legacy top-level configuration used by the package’s test selections.

The umbrella owns the configuration contract, release source, Values Secret, registry credentials, namespace, and Flux dependencies. Consult its package-management guide and cert-manager HelmRelease at the Big Bang release used by your environment. When enabled, the release depends on Istio, Kyverno Policies, and Prometheus Operator CRDs as applicable. Workloads use namespace cert-manager by default; the umbrella keeps it outside ambient enrollment. CRDs and admission webhook configurations are cluster-wide, not resources confined to that namespace.

Big Bang package defaults

  • Iron Bank images for the controller, webhook, cainjector, ACME solver, and startup API check; the test runner also uses an approved image. The image inventory is in Chart.yaml.
  • Non-root pod identities, RuntimeDefault seccomp, and explicit projected API credentials instead of automatic service-account-token mounting for the controller, webhook, cainjector, and startup check.
  • Two controller replicas, three webhook replicas, and two cainjector replicas, with disruption budgets retaining at least one pod for each. Review scheduling and disruption settings against cluster availability requirements; the startup API check is a Helm hook Job, not another replicated controller.
  • bb-common mesh and NetworkPolicies plus webhook port 10250 exceptions for kube-apiserver admission. Keep the capture bypass, permissive port-level mTLS, and API-server ingress path aligned; see installation notes.
  • A ServiceMonitor enabled by default in the package. The umbrella controls its enablement and changes scrape transport; see monitoring.
  • Optional self-signed and Let’s Encrypt issuers, disabled by default and normally rendered only on upgrade after webhook readiness. See the managed-issuer lifecycle.

Storage, credentials, and routing

cert-manager requires no database or object store and has no built-in user login or package UI. Access is governed by Kubernetes authorization. Certificate keys, issuer credentials, and ACME account state are sensitive Kubernetes Secrets. Plan backup and namespace retention before disabling or uninstalling the package; see account-key lifecycle.

The package does not provide CA issuers, provider credentials, public ingress or Gateway resources, or trust distribution. Trust Manager and Approver Policy are separate packages; deploying cert-manager alone does not configure either. HTTP-01 uses the operator’s public FQDN and temporary solver resources, not a fixed cert-manager development subdomain. Issuing a certificate does not install it into the Big Bang public gateway; see the ACME test plan.