Certificate Management for Kubernetes: Complete Guide

The Challenge of Kubernetes Certificate Management

Kubernetes environments present unique challenges for certificate management:

• Dynamic infrastructure: Pods and services are constantly created and destroyed
• Multiple namespaces: Certificates needed across different teams and applications
• Service mesh complexity: mTLS requires certificates for every service
• Scale: Large clusters may have thousands of certificates

Why Kubernetes CLM Matters

Proper certificate management in Kubernetes is essential for:

• Security: Encrypt all cluster communication
• Compliance: Meet regulatory requirements for data protection
• Reliability: Prevent outages from expired certificates
• Zero trust: Enable service-to-service authentication

Kubernetes Certificate Types

Control Plane Certificates

Critical certificates for cluster operation:

• API server TLS certificate
• etcd server and client certificates
• Controller manager certificates
• Scheduler certificates
• Service account signing key

Ingress Certificates

TLS termination at the cluster edge:

• NGINX Ingress TLS
• Traefik certificates
• Istio Gateway certificates
• AWS ALB/NLB certificates

Service Mesh Certificates

mTLS for service-to-service communication:

• Istio workload certificates
• Linkerd identity certificates
• Consul Connect certificates

Application Certificates

Application-specific certificates:

• Database connection TLS
• External API client certificates
• Webhook server certificates

Implementing cert-manager

Installation

Install cert-manager using Helm:

bash
1helm repo add jetstack https://charts.jetstack.io
2helm install cert-manager jetstack/cert-manager \
3  --namespace cert-manager \
4  --create-namespace \
5  --set installCRDs=true

Creating Issuers

Let's Encrypt Issuer

yaml
1apiVersion: cert-manager.io/v1
2kind: ClusterIssuer
3metadata:
4  name: letsencrypt-prod
5spec:
6  acme:
7    server: https://acme-v02.api.letsencrypt.org/directory
8    email: [email protected]
9    privateKeySecretRef:
10      name: letsencrypt-prod-key
11    solvers:
12    - http01:
13        ingress:
14          class: nginx

Internal CA Issuer

yaml
1apiVersion: cert-manager.io/v1
2kind: ClusterIssuer
3metadata:
4  name: internal-ca
5spec:
6  ca:
7    secretName: internal-ca-key-pair

Requesting Certificates

Certificate Resource

yaml
1apiVersion: cert-manager.io/v1
2kind: Certificate
3metadata:
4  name: api-tls
5  namespace: production
6spec:
7  secretName: api-tls-secret
8  issuerRef:
9    name: letsencrypt-prod
10    kind: ClusterIssuer
11  dnsNames:
12  - api.example.com
13  - api-internal.example.com

Ingress Annotations

yaml
1apiVersion: networking.k8s.io/v1
2kind: Ingress
3metadata:
4  name: api-ingress
5  annotations:
6    cert-manager.io/cluster-issuer: letsencrypt-prod
7spec:
8  tls:
9  - hosts:
10    - api.example.com
11    secretName: api-tls-secret

Enterprise Kubernetes CLM with TigerTrust

Integration Architecture

TigerTrust integrates with Kubernetes through:

1. TigerTrust Operator: Kubernetes-native certificate management
2. External Secrets Integration: Sync certificates from TigerTrust vault
3. Webhook Receiver: Real-time certificate updates
4. API Integration: Direct API access for automation

Advanced Features

Multi-Cluster Management

Manage certificates across multiple Kubernetes clusters:

• Centralized policy enforcement
• Consistent certificate issuance
• Cross-cluster certificate synchronization
• Unified monitoring and alerting

Enterprise PKI Integration

Connect to your internal PKI:

• Microsoft ADCS integration
• HashiCorp Vault PKI
• TigerTrust PKI Core
• Custom CA support

Compliance and Governance

Enterprise compliance features:

• Certificate policy enforcement
• Audit logging for all operations
• Role-based access control
• Namespace-level policies

Best Practices

Namespace Isolation

• Use separate issuers per namespace when needed
• Implement RBAC for certificate resources
• Consider certificate quotas per namespace

Certificate Lifecycle

• Set appropriate certificate durations
• Configure renewal windows (default 2/3 of lifetime)
• Monitor certificate health with Prometheus metrics

Secret Management

• Enable secret encryption at rest
• Use external secret stores for sensitive certificates
• Implement secret rotation policies
• Audit secret access

High Availability

• Deploy cert-manager with multiple replicas
• Configure proper resource requests/limits
• Use PodDisruptionBudgets
• Implement health checks and alerts

Monitoring Kubernetes Certificates

Prometheus Metrics

Key metrics to monitor:

yaml
1# Certificate expiry time
2certmanager_certificate_expiration_timestamp_seconds
3
4# Certificate ready status
5certmanager_certificate_ready_status
6
7# ACME client errors
8certmanager_http_acme_client_request_count

Alerting Rules

Example Prometheus alert:

yaml
1- alert: CertificateExpiringSoon
2  expr: certmanager_certificate_expiration_timestamp_seconds - time() < 86400 * 14
3  for: 1h
4  labels:
5    severity: warning
6  annotations:
7    summary: Certificate expiring in less than 14 days

Conclusion

Kubernetes certificate management requires specialized tooling and practices to handle the dynamic, distributed nature of container environments. By implementing cert-manager with proper enterprise integrations, organizations can achieve automated, secure certificate management at scale.

TigerTrust's Kubernetes CLM capabilities provide enterprise-grade certificate management with deep Kubernetes integration, multi-cluster support, and comprehensive compliance features.