Deploying cert-manager and Managing SSL Certificates in Kubernetes

cert-manager is the standard Kubernetes add-on for automated TLS certificate issuance and renewal. It integrates with ACME-based authorities such as Let's Encrypt and exposes Certificates, Issuers, and ClusterIssuers as native Kubernetes resources. This guide installs cert-manager on a multi-node Kubernetes cluster, configures a Let's Encrypt ClusterIssuer, and issues a renewing certificate for a sample Traefik-routed application. By the end, you'll have cert-manager managing trusted HTTPS for any Ingress in your cluster.

Prerequisite: Kubernetes cluster (v1.31+) with 3+ nodes and at least 4 GB RAM per node. kubectl, helm, and cmctl installed on your workstation. A registered domain you can point at the cluster's LoadBalancer.

Install cert-manager

1. Apply the cert-manager CRDs:

$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.crds.yaml