►
From YouTube: Cert-Manager Beyond Ingress – Exploring the Variety of Use Cases - Matthew Bates, Jetstack
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Cert-Manager Beyond Ingress – Exploring the Variety of Use Cases - Matthew Bates, Jetstack
Cert-manager is a widely used project for the automation of X.509 TLS certificates. In 2020, it reached 1.0 and landed in the CNCF Sandbox. cert-manager has been popularised by its support of ACME and Ingress, enabling many millions of certificates to be issued and renewed, and to help secure the cloud native web with Kubernetes and all the various ingress controllers. But cert-manager, with its custom resources and controllers, extensible with issuers including those out-of-tree, can also be used for a myriad of other use cases in which certificates are required. This talk will walk through the various use cases for cert-manager, including ingress, control plane and nodes (kubeadm, CAPI), webhooks, intra-service mTLS (cert-manager-csi) and service mesh (OpenServiceMesh, Istio).
A
I'm
matt
bates,
I'm
from
jet
stack
with
the
original
creators
of
the
project
and
together
with
now
280
contributors
in
the
community,
we've
got
set
manager
to
where
it
is
today.
Sub
manager
is
effectively
a
kubernetes
add-on
or
extension,
but
it
extends
the
kubernetes
api
and
adds
support
for
certificates
and
certificate
authorities.
A
It
means
that
you
can
manage
x509
tls
certificates,
that's
the
complete
life
cycle,
the
issuance
and
renewal
and
use
those
certificates
in
your
applications.
It
has
wide
adoption
and
lots
of
contribution
from
the
community
and
as
of
last
year,
we
donated
the
project
to
the
cncf.
So
it's
now
part
of
the
sandbox.
A
Briefly,
how
does
certain
manager
work?
As
I
said,
search
manager
is
an
extension
or
an
add-on.
It
provides
a
number
of
additional
resources,
so
called
custom
resources
crds
and
provides
them
to
the
key
on
top
of
the
kubernetes
api.
These
represent
certificates
and
certificate
authorities.
We
can
refer
to
that
as
an
issuer.
A
This
provides
first-class
support
for
those
in
the
kubernetes
api
and
you
get
all
of
the
advantages
of
being
able
to
manage
those
resources.
Declaratively
much
like
you
manage,
pods
and
deployments
set
manager
has
a
controller
that
manages
the
lifecycle
of
those
resources
and
importantly,
is
able
to
provide
the
automation
of
those
certificates.
Automating.
The
fetching
of
those
certificates,
and
importantly,
the
renewal
of
those
as
well
is
most
commonly
used
to
secure
ingresses,
and
you
can
see
here
it's
really
quick
and
easy
to
add
a
tls
certificate
to
an
ingress.
A
How
does
this
work
under
the
hood?
Well
set
manager,
watches
for
ingresses
using
its
ingress
shim
component
as
part
of
the
cert
manager
controller,
and
is
then
able
to
create
a
certificate
which
is
backed
by
a
point
in
time,
certificate
request
which
encodes
the
certificate
signing
request,
which
it
then
submits
to
your
ca
of
choice.
So,
in
my
particular
case
it
was
the
let's
encrypt
staging
endpoint
and
that's
the
point
in
which
cert
manager
is
able
to
automate
the
acme
flow.
There's
additional
resources
that
you
can
see
there,
the
order
and
the
challenge,
but
effectively.
A
All
of
that
is
automated
for
you
and
it
results
in
a
signed
certificate
from
the
certificate
authority
which
is
placed
into
a
secret
and
then
consumed
by
your
application.
In
the
case
of
an
ingress,
of
course,
that's
most
likely
to
be
an
ingress
controller,
something
like
nginx,
for
instance,
and
it's
then
able
to
serve
your
application
securely.
A
This
difficult
request
is,
like
a
point
in
time,
request:
that's
made
for
an
x509
certificate
from
an
issuer,
and
this
is
typically
consumed
by,
as
I
said
here,
by
managed
by
controllers
or
other
systems,
you
see
the
certain
controller.
There
is
responsible
for
reconciliating
those
certificate
and
certificate
request
resources,
but
of
course
there
are
lots
of
other
certificates
to
managing
kubernetes.
It's
not
just
the
ingress
certificates.
A
There
are
many
stuff
goods
across
a
cluster,
typically
that
you
may
wish
to
automate
using
cert
manager,
and
I've
just
highlighted
some
of
these
and
we're
going
to
talk
about
a
number
of
these
different
use.
Cases
in
this
talk
ingress,
as
I
mentioned
pod
to
pod,
which
might
be
without
we
have,
or
indeed
without
a
surface
mesh
and
we're
going
to
look
at
both
in
this
talk
today.
You
may
also
wish
to
secure
a
cluster
and
the
control
plane
and
the
data
plane.
A
A
We
often
get
asked
in
the
community
how
you
can
use
cert
manager
in
order
to
secure
you
know,
put
to
pod
communications
effect
effectively
that
kind
of
east-west
traffic
in
in
a
cluster
without
a
service
mesh
at
this
stage-
and
this
is
particularly
useful-
if
actually,
what
you've
got
is
a
really
small
handful
of
micro
services,
and
you
know
you
can
you
can
really
just
use?
You
need
certificates.
A
So
here's
an
example
of
how
actually
how
you
can
use
a
certain
manager
certificate
resource
directly.
Basically,
you
can
go
and
create
this
in
source
control,
of
course,
and
apply
it.
You
know
directly
via
ci
cd
to
your
cluster
and
cert
manager
will
automate
the
issuance
of
the
certificate
and
put
it
into
a
secret
that
you
can
then
consume
in
in
an
application
in
a
pod,
and
so
a
couple
of
things
to
point
out
here
making
this
this
particular
example
is
going
to
be
very
short-lived.
A
You
know
it
really
is
a
set
of
files
in
a
volume
mount
and
that
I
can
then
sort
of
put
into
my
application
and
start
serving
tls
and
some
dns
sans
here,
and
I'm
also
making
reference
to
mice.
Yet
this
is
going
to
be
like
a
private
ca,
so
this
would
obviously
not
be
a
public
ca
if
you
just
really
want
something
local
to
the
cluster
and
we're
going
to
see
how
this,
how
you
can
sort
of
set
this
up
in
some
slides
to
come.
A
Here's
a
bit
more
yammer
that
shows
how
you
can
effectively
take
the
secret
and
then
make
it
available
in
a
volume
and
a
volume
mount
and
the
files
would
have
will
be
available
to
this
ping
service
or
this
ping
pong
service
at
the
mount
path.
Etsy,
ssl,
privates.
There
you
go,
there's
the
the
key
pairs
and
the
ca
certificate
as
well.
There's
a
really
really
simple
way
of
being
able
to
use
the
underlying.
If
you
like
resources
and
certain
manager,
programmatically
we've
got
a
number
of
end
users
that
do
exactly
this
at
scale.
A
I've
used
the
sca
flag
to
denote
that
this
is
going
to
be
aca
certificate.
It's
got
a
90-day
duration
specified
the
secret,
the
common
names
and
subjects
the
number
of
other
properties
that
you
can
specify
and
an
issue
a
ref
in
this
case,
I'm
referring
to
that
sort
of
self-signed
key
that
I
generated
there.
On
the
left
hand
side.
A
This
is
just
sort
of
an
out
the
box
relatively
simple.
If
you
like
private
ca,
that
you
can
configure
using
search
manager
and
it's
a
little
known
people,
don't
know
that
you
can
do
this.
You
can
also,
of
course
plug
in
and
if
you
like,
a
more
robust
and
more
secure
and
private
pki.
If
you
wish-
and
so
we've
got
a
number
of
options
here,
both
built
into
the
core
of
the
project
but
and
also
those
that
are
external
to
the
project
as
well,
so
called
external
issuers.
A
So
you
can
use
vol,
you
can
use
small
step.
They've
got
acme
an
acme
ca
server.
You
can
also
use
the
cloud
providers,
so
we've
got
support
for
google's
certificate
authority
service
and
there's.
Also
an
external
issuer
for
aws
is
pca,
and
if
you're,
in
a
more
of
an
enterprise
environment,
you
can
also
integrate
it
with
venify
and
there's
an
issuer
for
tpp.
A
So
in
that
previous
example,
we
were
looking
at
how
you
could
use
the
certificate
resource
insert
manager
in
order
to
obtain
a
serving
certificate.
But
how
about?
If
you
wanted
to
use
cert
manager
to
do
interpod
pod
to
pod
mutual
tls
and
you
know
obtained
by
a
by
serving
certificate,
but
also
a
client
certificate,
so
I've
got
an
example
here
of
a
really
really
simple
example
of
a
ping
service
and
a
pong
service,
and
we
open
source
this
lab.
A
If
you
want
to
go
and
find
it
for
you
follow
the
link
there
on
the
slide
and
it
sort
of
hooks
up.
You
know
this
ping
pong
service
simple,
go
binary
that
you
can
also
use
in
some
of
your
your
own
examples.
In
this
example,
we
have
is
the
two
services
I
said
ping
context.
Pong
verifies
itself
for
clients,
pong
replies,
that's
secured
using
the
servicer
and
yeah.
It
actually
replies
back
to
the
browser.
A
A
A
In
this
way,
you
can
you
configure
it
to
create
certificates
in
order
to
do
things
like,
for
instance,
your
authentication
to
a
database,
and
so
we've
got
this
blog
post
and
the
one
of
our
team
put
together
in
which
we
used.
We
talked
through
how
you
can
use
cert
manager
to
create
certificates
for
client
authentication
with
mysql
and
there's
been
lots
of
examples.
We've
also
seen
the
community
of
where
users
have
used
it
exactly
for
this
type
of
purpose.
A
Very
neat
thing
about
the
csi
driver
is
that
it
means
the
private
keys
can
remain
node
local,
it's
rather
than
being
put
into
a
kubernetes
secret,
as
is
the
case
with
some
of
the
integrations
that
we've
already
seen
in
this
particular
case,
you
can
keep
the
private
key
to
the
node,
where
it's
generated
by
the
csi
driver.
It
means
you
can
provide
unique
key
and
certificates
for
each
of
your
applications.
A
A
A
A
That's
that
certificate
request
is
submitted
to
the
api
server
on
your
behalf.
The
cr
is
then
reconciled
and
a
certificate
is
obtained
from
your
kind
of
ca
of
choice
and
that
certificate
is
then
together.
The
private
key
is
written
to
the
node's
file
system
and
then
that's
bind
mounted
into
each
each
of
the
pods.
A
Obviously,
in
teaching
the
relevant
pods,
the
driver
will
keep
track
of
all
of
the
certificates
and
they
will
also
be
responsible
for
it
for
news
and
if
at
any
time
or
if
and
and
when,
of
course,
the
pod
is
terminated
and
then
it
will
also
send
out
a
call
to
the
driver,
the
cubelet
will
send
out
a
call
to
the
driver
in
order
to
make
sure
that
the
certificate
and
the
key
are
deleted.
So
this
is
a
really
seamless,
automated
way
of
getting
those
identities.
A
You
can
also
use
cert
manager
to
secure
cuban
these
web
hooks
web
hooks
are
used
for
a
sort
of
dynamic
admission
control
used
for
a
variety
of
purpose
for,
for
instance,
mutating
resources
or
validating
resources,
as
they
are
admitted
to
the
api
server
and
typically
use,
for
instance,
for
applying
default
values
or
enforcing
policy.
Using
you
know
the
likes
of
opa
coverno,
and
also
for
ensuring
that
resources
that
are
submitted
are
semantically
valid
and,
in
fact,
certain
manager
uses
this
itself.
You'll
notice.
There's
a
component
called
the
search
merger
webhook.
A
So
you
can
use
certain
manager
in
order
to
secure
those
end
points
and
secure
those
provide
the
means
provide
the
certificates
for
those
endpoints
and
there's
a
couple
of
annotations
or
few
annotations.
Should
I
say
and
where
you
can
do
this
one
is
inject
ca
from
so
my
dry
o
inject
ca
from
you
can
reference
a
certificate
and
you
can
also
inject
it
from
a
secret,
and
you
can
also
inject
the
api
server
ca
certificate
as
well.
A
A
So
this
is
an
example
of
a
command
that
I
ran
recently
when
spinning
up
a
local
cluster
api
cluster
you're
using
cluster
ctl,
as
you
can
see,
and
one
of
the
very
first
things
that
it
does
it
fetches
the
various
different
providers
and
then
it
installs
cert
manager,
and
that
might
look
a
little
curious
if
you.
But
if
you
dig
a
little
bit
deeper
once
the
cluster
api
is
up
and
working,
then
you've
got
cube,
ctl
get
certificates
and
specifically
you
look
in
the
capi
webhook
system.
A
Now,
service
message
becoming
increasingly
popular
and
a
number
of
users
in
the
community
are
asking
how
they
can
integrate
cert
manager
and
also
with
all
its
various
different
ca
integrations
into
the
mesh,
so
that
those
workload
search
the
control
plane.
Certain
data
inserts
are
provided
from
their
sort
of
provider
of
choice.
A
Now,
if
you
think
of
what
service
mesh
provides,
it's
a
really
really
rich
capability
to
have
consistent,
observability
security
and
so
various
reliability
features
that
are
built
into
the
platform
so,
rather
than
developers
having
to
build
this
themselves,
it's
transparent
and
it's
provided
for
them.
This
can
be,
you
know
highly
convenient,
rather
than
services
contacting
each
other
directly.
A
I've
got
an
example
here:
service,
a
and
service
b,
and
these
microservices
or
services
communicate
via
a
proxy
and
the
proxy
can
be
dynamically
programmed
based
on
resources
that
reside
in
the
control,
plane,
and
so
what's
great
about.
This
is
that
you
can
provide
all
of
that
capability
in
the
proxy
rather
than
having
to
be
implemented
in
the
application
itself,
and
quite
often
most
of
these
meshes,
so
most
of
which
are
based,
of
course,
on
envoy
and
have
the
ability
to
automatically
provide
mtls
between
proxies
in
the
mesh.
A
A
You
can
provided
a
trust
tank
and
an
issue,
a
certificate
and
private
key,
and
this
can
all
be
automated
using
cert
manager
and
thereafter
linkid
has
a
component
built
into
it
responsible
for
effectively
automating
the
provisioning
of
the
lease
certificates
and
the
renewal
of
those
sleeve
tickets
with
you
know,
relatively
short,
short
lifetimes,
so
you
get
a
full
automation
of
that.
Both
the
bootstrapped
certificates
that
are
used,
the
trust,
anchor
and
also
the
lease
certificates
as
well.
So
there's
a
really
good
combination.
A
Putting
the
two
together
istio
has
had
the
ability
to
plug
in
custom
ca
certificates
into
its
into
a
citadel.
For
some
time,
you
can
reference
a
ca
key
pair
using
a
kubernetes
secret,
but
we've
win
working
with
the
seo
folks
in
order
to
more
fully
integrate
certain
managers
so
that
you
can
actually
have
the
workload
certificates
obtained
from
cert
manager
itself,
because
that's
advantageous,
because
you
can
then
start
to
take
advantage
of
all
the
different
issuers
that
set
merger
has
in
its
community,
and
what
this
involves
is
effectively
replacing
the
citadel.
A
That's
that
registration
authority
with
cert
manager,
we
can
create
certificate
requests
and
have
those
fulfilled
set
by
those
different
providers.
There's
also
some
integration,
which
is
much
more
experimental,
and
it's
been
more
recently
released
that
enables
istio
to
use
the
kubernetes
certificates
api
and
we're
working
with
them
on
that
integration
as
well.
A
And
finally,
the
third
example
I
have
here
is
the
open
service
mesh
project
osm
that
we've
been
working
with
to
plug
in
servermanager
and
they've,
had
plugable
certificate
management
from
the
get-go
and
they've
got
their
own
built-in
component.
I
believe
support
for
also
volt
and
also
azure's
key
vault,
but
yeah.
If
you
want
to
use
so
much,
there
is
an
integration
that
enables
you
to
plug
it
in,
and
it
will.
That
component
will
be
responsible
for
creating
and
managing
certificate
requests
for
the
workloads
that
run
within
the
mesh.
A
For
now
for
anyone,
that's
tried
setting
up
pki
and
kubernetes
they'll
know
that
there
are
a
lot
of
certs
client
search
services
of
all
different
flavors,
and
it
can
get
quite
complex
trying
to
manage
this.
I
know
from
doing
this
in
the
very
early
days
of
provisioning,
a
kubernetes
cluster.
Well,
now
things
have
changed.
We
can
use
the
magic
that
is
cubed,
m
or
cube.
Adam
is
here
to
the
rescue,
really
it
provides
auto
generated
water,
renewed
control,
plane
inserts
and
by
default.
This
uses
like
a
self-signed
certificate.
A
So
how
about
provisioning
of
certificates
for
the
the
gubernates
nodes?
On
the
previous
slide,
we
saw
how
you
can
use
qbdm
to
provision
certificate
for
the
control
plane
and
how
you
can
customize
that
and
use
you
know
an
external
external
ca
provided
certificates,
but
how
about
the
nodes
themselves?
A
A
So
through
a
process
of
bootstrap,
the
keyblade
makes
a
certificate
signing
request.
That's
this
resource
here
to
the
api
server
and
that
certificate
signing
request,
as
you
can
see
here
on
the
side,
has
a
has
assigned
a
name
and
those
that's
not
a
required
field,
as
of
as
of
v1
and
those
signers
are
actually
built
into
the
keep
controller
managers
that
one
there.
A
A
In
the
next
release
of
certain
manage
we're
actually
going
to
be
adding
support,
or
the
next
releases
should,
I
say,
open,
valuing
support
for
the
community
certificates
api,
so
that
means
you're
actually
going
to
use
all
the
various
cert
manager
issuers
in
order
to
sign
a
certificate
signing
quest.
Just
like
this
and
that'll
open
up.
You
know
open
the
project
up
to
being
able
to
support.
You
know
kind
of
many
more
use
cases
so
we'll
support
this
typical
request.
A
You
can
use
the
csi
driver
if
you
want
to
be
able
to
have
pretty
seamless,
pod
identities
created
and
have
those
renewed
and
how
important
you
have.
The
private
key
remain
node
local.
You
can
also
integrate
search
manager
with
a
variety
of
different
service.
Meshes
we've
got
integration
today
with
link
d,
istio
and
open
service
mesh
more
to
come,
the
web
hooks
and
also
the
control
plane
and
node
certificates,
as
well
as
said
in
1.3
or
as
of
1.3,
we'll
be
supporting
the
kubernetes
certificates
api
and
we're
looking
for
many
more
use
cases.
A
A
So,
thanks
to
everyone
we're
going
to
be
available
here
now
for
some
live
q.
A
after
this
session,
it's
been
a
pleasure
being
able
to
tell
you
a
bit
more
about
the
project
and
the
various
different
use
cases
that
we're
building
set
manager
for
look
for
your
questions,
stay
safe.
Everyone
thanks
bye-bye.