cert-manager

Kubernetes-native TLS certificate lifecycle management. Automates issuance, renewal, and rotation from private CAs.

Debugging Workflow

When certificates fail, debug the resource chain in order:

Certificate → CertificateRequest → Issuer/ClusterIssuer

First commands to run:

kubectl get certificate,certificaterequest,issuer,clusterissuer -A
kubectl describe certificate <name> -n <namespace>

For detailed debugging steps, see references/troubleshooting-workflow.md.

Private CA Configuration

This skill focuses on self-hosted issuers (no Let's Encrypt):

Issuer Type	Use Case
SelfSigned	Bootstrap CA hierarchy, testing
CA	Sign with existing CA credentials in Secret
Vault	Sign via HashiCorp Vault PKI engine

Quick Bootstrap (SelfSigned → CA)

# Creates self-signed root, then CA issuer for leaf certs
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-issuer
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: root-ca
  namespace: cert-manager
spec:
  isCA: true
  commonName: root-ca
  secretName: root-ca-secret
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: ca-issuer
spec:
  ca:
    secretName: root-ca-secret

For complete issuer configuration, see references/private-ca-issuers.md.

Traefik Integration

Create Certificate resource, reference secret in IngressRoute:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: myapp-tls
spec:
  secretName: myapp-tls-secret
  dnsNames: ["myapp.example.com"]
  issuerRef:
    name: ca-issuer
    kind: ClusterIssuer
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
spec:
  entryPoints: [websecure]
  routes:
    - match: Host(`myapp.example.com`)
      kind: Rule
      services:
        - name: myapp-service
          port: 80
  tls:
    secretName: myapp-tls-secret

For wildcard certs and Ingress annotations, see references/traefik-integration.md.

Common Issues

Symptom	Likely Cause	Reference
Certificate stuck Pending	Issuer not ready, CertificateRequest failed	troubleshooting-workflow.md
Webhook connection refused	Pod not running, network policy	webhook-issues.md
x509 unknown authority	CA bundle not injected	webhook-issues.md
Secret not created	Issuer configuration error	troubleshooting-workflow.md
Vault permission denied	Vault policy/role misconfigured	private-ca-issuers.md

References

• references/troubleshooting-workflow.md - Step-by-step debugging
• references/private-ca-issuers.md - SelfSigned and CA issuer configuration
• references/vault-issuer.md - Vault PKI issuer configuration and auth methods
• references/traefik-integration.md - IngressRoute TLS setup
• references/webhook-issues.md - Webhook connectivity problems