►
From YouTube: cert-manager - Past, Present and Future - Jake Sanders, cert-manager Maintainer & Ashley Davis
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from April 17-21, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
cert-manager - Past, Present and Future - Jake Sanders, cert-manager Maintainer & Ashley Davis, Jetstack
Speakers: Ashley Davis, Jake Sanders
cert-manager is the Cloud Native way to use X.509 certificates inside Kubernetes. It's usually one of the first things administrators install on a new cluster, with 15 million image pulls per day!
The project has just entered incubation, after being part of the CNCF sandbox for almost 2 years.
Join two of the maintainers for a talk about why you should use cert-manager, how we got to where we are today, and our plans for the future!
A
We
are
going
to
get
started
then
so
welcome
everyone
to
serve
manager,
past
present
and
future
we're
going
to
keep
the
audience
interaction
to
a
minimum
it's
Friday
morning,
and
there
was
obviously
the
parties
last
night
I
hope
everyone's
feeling:
okay,
anyone
else
at
spokenetti's
last
night
any
hands,
no
there's
some
nods.
There
we
go
yeah.
So
thank
you
all
for
coming
we'll
start
off
by
introducing
ourselves.
A
You
might
have
expected
that
I'm
Ash,
Ashley
I,
don't
mind
either
way,
I'm
a
senior
software
engineer
at
jetstack,
and
also
a
Ser
manager
maintainer,
which
is
useful
for
this
talk
right,
I'm
super
interested
in
like
cryptography
and
certificates
TLS
all
that
kind
of
stuff.
That's
the
kind
of
anger,
I
approach,
it
all
from.
Obviously
some
interesting
kubernetes
as
well,
given
the
the
nature
of
server
manager.
B
Yeah
and
I'm
Jake
I'm
a
platform
engineer
at
Geo
research,
we're
kind
of
a
london-based
financial
research
company
and
also
a
site
manager,
maintainer
and
I'm
kind
of
interested
in
like
highly
scalable
secure
systems
where
everything
has
an
identity.
Yes,
aren't
we
all
so
yeah?
We
thought
we'd
talk
a
little
bit
about
certain
manager
where
it
came
from
so
in
May
2016
there
was
a
project
called
Cube
Lego,
which
is
open
source
by
jetstack,
my
my
old
employer.
B
The
idea
was
that
you'd
have
your
Ingress
into
your
cluster
and
you'd
want
a
publicly
trusted
certificate
for
it.
So
you'd
stick
an
annotation
on
your
Ingress
key
of
Lego
would
contact
let's
encrypt
and
only
let's
encrypt
it
would
solve
the
HTTP
01
Challenge,
and
it
would
give
you
a
publicly
trusted
certificate
and
this
was
a
really
popular
kind
of
thing
to
deploy
in
kubernetes,
because
the
workflow
was
so
easy.
B
We
liked
this.
If
that
was
a
good
idea,
tried
to
make
it
a
little
bit
more
Cloud
native
so
started
to
create
some
custom
resource
definitions
that
would
hold
the
state
of
your
certificates
with
different
requests
and
your
challenges.
So
you
could
store
all
your
state
in
the
QRS
API,
so
people
started
using
this
over
the
next
two
years,
so
we
thought
well,
we
better
make
our
crd
API
stable,
because
we
have
a
lot
of
production
users.
Now
we're
not
going
to
break
it.
Anyone
here,
a
production
user,
assert
manager,
yeah.
So
that's.
B
Got
It's
got
15
15
million
pools
a
day
when
I
last
looked
so
there's
a
lot
of
production
users,
so
yeah
can't
break
them,
and
even
if
you
don't
know,
if
you're
using
it,
you
might
be
because
it's
included
by
default
in
a
few
Cloud
distributions.
It's
like
the
VMware
people
reached
out
to
us
a
while
back
just
showing
how
it
was
embedded
in
tanzu,
I've.
A
B
A
B
A
There
was
a
whole
bunch
of
work
there
and
thank
you
for
the
shout
out
Jake,
but
there's
so
many
other
people
we
could
thank
as
well.
It
was
a
really
great
process
and
I
think
there
is
a
possibility
that,
in
the
crowd
today,
there
are
people
from
the
TOC
who
sort
of
gave
us
a
thumbs
up
for
incubation.
Thank
you
specifically,
obviously,
or
if
anyone
watches
this
back
and
also
just
thank
you
to
everyone,
that's
here,
because
this
is
so
cliche
right.
This
is
so.
A
This
is
what
everyone
says,
but,
like
the
community
is
everything
and-
and
we
we
genuinely
love
talking
to
people
about
this
stuff
and
it's
people
contributing
and
raising
issues,
pull
requests
just
getting
involved
that
really
drives
everything
forwards.
That's
why
we
are
where
we
are
and
yeah
just
a
huge
thank
you
for
all
of
that.
It's
a
it's!
It's
a
great
train
to
be
on
and
we
hope
it
continues.
B
B
Probably
one
of
the
first
things
that
you'd
install
on
a
production
cluster
if
you're
a
cluster
administrator,
and
we
basically
just
want
to
make
managing
TLS
in
your
cluster
simple
and
easy.
Our
workflow
is
really
simple.
The
final
certificates
are
available
in
cuvette's
secrets,
and
originally
they
were
just
in
pem,
but
apparently
real
users
need
like
pkcs12
and
Java
key
stores.
B
So
we
we
make
all
of
the
formats
available
and
you
can
just
Mount
them
in
your
pod
and
consume
them,
and
you
don't
need
to
learn
asn1
or
to
manually,
make
your
Certificate
request
and
email
it
to
your
certificate.
Authority
like
before,
and
yeah
certificates
are
just
renewed
in
good
time,
which
means
that
fairly
often,
even
now,
you
see
big
companies
go
down
and
it
turns
out.
Oh
one
of
the
key
certificates
buried
somewhere
in
their
infrastructure
has
expired,
and
it's
really
embarrassing
for
everyone.
If
you're
using
snap
manager,
that
should
never
happen,
we
promise.
B
A
We
we
have
this,
we
through
the
number
of
our
GitHub
stars
on
here.
Every
time
we
write
slides.
This
seems
to
have
to
be
updated,
we'd
love
to
get
to
10
000.
So
maybe
this
is
a
mini
call
to
action
like
if
you
could
star
the
repo.
After
this,
like
we'll,
get
there
so
yeah
I'm,
going
to
do
a
really
quick
overview
of
sort
of
the
general
gist
of
how
cert
manager
Works
we're
not
going
to
dive
into
code
or
anything.
Because
who
wants
to
do
that?
A
Right
generally,
we
have
a
few
crds
which
model
the
core
sort
of
ideas
of
issuing
a
certificate.
So
at
the
top
there
we
have
issuers
and
that's
how
you
describe
how
to
get
a
certificate
from
what
service
or
from
where
or
whatever
things
like
authentication
for
that
service
or
whatever
it
may
be.
We've
got
some
examples
of
different
issues
there.
Let's
encrypt
is
a
big
one.
The
big
one
I'll
talk
about
that
in
a
sec,
hashicot
vault
is
also
very
popular.
A
lot
of
people
managing
all
of
their
most
secure
secrets
in
there.
A
Venify
TPP
is
another
option
that
you
see
a
lot
of,
especially
Enterprises
using,
but
there's
there's
more
that
as
Jake
alluded
to
there's.
There's
external
issues
as
well.
There's
all
kinds
of
things:
I
actually
had
a
a
guy,
came
up
to
me
yesterday
and
asked
about
a
issuer
that
I'd
never
personally
heard
of,
but
we
were
able
to
find
a
certain
manager
issuer
that
someone
had
written
for
it.
A
It's
really
pretty
simple
from
this
high
level
overview.
The
end
goal,
ideally
if
everything
went
well,
which
usually
it
seems
to
go
well,
is
that
you
end
up
with
your
certificate
inside
a
kubernetes
secret
and
you
can
use
it.
However,
you
want
to
use
it
that
might
be
identifying
a
service
like
a
website
or
something
webpki
that
might
be
identifying
a
client
for
mtls
or
something
like
that.
But
but
once
the
certificate's
there
you
can
use
it
and
you
can
hopefully
rely
on
it
being
renewed.
A
It's
very
popular,
so
I
mentioned,
like
the
the
Acme
stuff
that
let's
encrypt
stuff,
is
by
far
the
most
popular
as
far
as
we
can
tell
like
we're,
not
collecting
Telemetry
or
anything
really.
So
we
don't
really
know
unless
people
tell
us,
but
certainly
Acme
seems
like
the
main
one,
because
the
certificates
are
publicly
trusted
and
that
tends
to
take
the
form
of
let's
encrypt
right.
That's
the
most
popular
super
awesome.
They
sort
of
got
the
ball
rolling
and
making
like
TLS
certificates
more
obtainable
for
everyone.
A
But
we,
like
I,
said
we
have
all
these
other
issuers
as
you
might
need
them.
It's
automated.
We
really
want
to
drive
that
point
home
and
it's
extensible,
which
we
also
want
to
drive
home
right.
We
don't
want
to
leave
anyone
out
in
the
dark.
That's
kind
of
the
power
of
an
open
source
project
is
that
we
can
just
Define
those
apis
and
people
can
go
and
run
with
them.
That
there's
at
least
one
person
I
spoke
to
this
week.
A
Another
huge
part
of
the
current
status
of
the
project
is
obviously
security.
Given
the
state
of
kubernetes
generally
and
the
aims
of
the
project
security
is
pretty
important.
We
we
really
need
to
focus
on
making
sure
that
the
private
keys
are
actually
kept
private
and
all
that
stuff.
So
we
we
do
view
cert
managers
being
critical
security
infrastructure,
and
we
would
argue
that,
if
you're
using
it
in
production
or
even
in
your
test
environments,
then
you
should
probably
view
it
the
same
way.
It's.
A
So
we
use
cosine
from
six
store
to
sign
all
of
our
container
images,
so
you
can
validate
those
when
you
download
them
all
the
details
for
that
are
on
our
website,
and
we
would
encourage
more
people
to
do
that,
because
it's
just
an
extra
sort
of
reassurance
that
you're
actually
getting
your
containers
from
us
and
not
someone
random.
We
have
seen
like
third-party
mirrors
of
our
container
images
on
the
web
and
you've
got
no
way
of
knowing
if
they've
been
tampered
with,
and
obviously
you
don't
want
your
certificates
to
be
tampered
with.
B
A
Yeah,
we
hope
we
hope
you
trust
us.
We
also
are
self-certified
we're
saying
as
salsa
too
and
salsa
is
the
best
named
project
ever
I.
Think
it's
just
kind
of
a
way
of
specifying
like
how
much
time
and
thought
we've
put
into
our
supply
chain
security
right.
How?
How
can
you
verify
the
things
you
get
are
actually
from
us?
So
we
think
we're
at
level
two
where
I
think
we're
nearly
at
level
three,
the
differences
between
that.
A
Don't
really
matter
for
this
talk
we're
not
talking
about
salsa
here
but,
like
generally,
it's
a
pretty
good
indicator
of
us.
Taking
the
time
to
look
into
this
and
I
would
recommend,
if
you're
interested
in
that
or
you've
not
heard
of
solstice,
to
check
out
salsa.dev
for
more
information
on
that.
Of
course,
another
aspect
of
security
is
actually
asserting
things
like
policy
about
the
certificates
that
you're
issuing,
which
leads
nicely
into.
B
Yeah,
so
obviously
we've
got
a
lot
of
production
users
and
I'm
just
going
to
briefly
say
that
so
manager
is
not
just
the
cert
manager
kind
of
certificate.
Renewal
operator,
it's
an
entire
project
and
we
think
anything
that
interacts
with
TLS
workflows
in
the
cloud
native
space
can
live
under
the
set
manager,
GitHub
org.
B
So
one
of
the
things
that
we've
put
there
is
a
policy
engine,
so
Insight
manager.
If
you
just
deploy
it,
it
will
approve
anything
in
your
cluster,
which
is
probably
not
what
you
want,
because
if
you
happen
to
have
a
cluster
issuer
that
could
sign
your
like
production
web
services,
anyone
could
just
make
a
certificate
in
their
namespace
reference.
It
and
then
same
manager
would
just
sign
it
and
someone's
now
taken
your
secure
instructor
and
ruined
it
by
getting
a
valid
certificate.
B
B
B
If
you're
using
set
manager
for
like
your
credentials,
you
probably
want
them
short-lived,
like
mgls
credentials
so
right
now
we
support
certificates
down
to
one
hour
in
duration
and
have
them
automatically
renewed
every
like
20
minutes
or
so
it's
one
hour
is
not
quite
short
enough,
but
that
was
the
one
mistake
we
made
in
our
V1
API.
So
we're
not
sure
whether
we
should
change
it
or
not
we're
trying
to
get
it
lower
and,
of
course,
private
key
rotation
policy.
B
So
if,
if
you
can,
you
should
always
rotate
your
private
key
when
you
issue
your
certificate,
if
you
remember
heart
bleed
when
a
bunch
of
private
Keys
got
leaked
and
everyone
had
to
reissue
their
certificate
and
there
were
some
very
large
percentage
of
certificates
that
just
got
reissued
with
the
same
private
key.
You
can
like
completely
invalidating
the
point
of
reassuring
them,
so
yeah
make
sure
you
always
do
that,
but
it
turns
out
that
some
Legacy
apps
will
rely
on
the
private
key
being
the
same.
B
Yeah
we
already
talked
about
Integrations,
but
every
part
of
set
manager
is
kind
of
modular
and
it
can
be
disabled
and
you
can
drop
in
your
own
component,
so
I'll
approval
policy.
We
it's
it's
pretty
good
if
it
does,
if
it
does
what
you
want,
but
if
you
have
a
really
complicated
like
internal
security
posture,
you
might
want
to
put
your
own
approver
in
and
we
have
an
example
with
Opa
I
think
it's
I
think
at
some
point
we.
A
Still
have
it
as
a
as
a
cryptography
person,
I'm
super
interested
in
things
like
policy,
which
can
say
Hey.
You
must
have
a
private
key
for
your
certificate,
which
is
of
an
acceptable
security
level.
Like
you,
don't
you
don't
want
people
issuing
keys
that
are
going
to
be
broken
in
like
a
week
on
a
Raspberry
Pi
right
like
this
stuff,
is
important.
B
B
And
yeah
so
thanks,
I,
guess
and
yeah.
We
have
Rich
Prometheus
metrics,
which
is
really
important
for
observability,
like
if
you
have
hundreds
of
thousand
certificates
in
your
cluster
like
you're,
not
going
to
be
manually.
Checking
them
right,
set
manager
will
tell
you
when
it's
when
a
certificates
due
for
Renewal
and
you
could
maybe
alert
on
the
certificate
going
past
that
without
being
renewed
because
then
something
has
gone
wrong.
That's.
B
B
Oh
yeah.
We
also
have
two
CSI
drivers,
so
kind
of
a
sticky
Point,
sometimes
with
Enterprises.
Is
they
don't
want
Secrets
stored
in
the
kubernetes
API,
so
a
normal,
a
TLS
key
Fair
has
a
private
key
in
so
we
have
a
regular
CSI
driver
which
will
expose
the
certificate
to
your
pod,
but
the
private
key
will
only
ever
be
in
memory,
but
we
also
have
a
CSI
driver
that
implements
the
spiffy
x509
standard.
B
A
And
maybe
at
the
next
kubecon
we'll
be
able
to
talk
about
more
of
these
things
like
we
have
a
lot
of
Integrations,
as
we
just
said,
and
we
really
really
want
to
keep
on
doing
this,
because
it's
such
a
a
great
way
of
showcasing
what
we
can
do
and
what
other
projects
can
do.
I,
don't
think
it's
crazy
to
say
that
a
lot
of
projects
have
a
need
for
some
sort
of
certificate
management
right
like
it
comes
into
a
lot
of
things,
just
because
TLS
comes
into
a
lot
of
things.
It's
it's!
A
Ideally
it's
used
everywhere
nowadays.
So
if
you
have
an
idea,
if
your
project
maybe
could
integrate
with
server
manager,
we
could
have
a
blog
post
or
a
workshop
or
then
a
talk
in
Amsterdam,
maybe
about
it,
we'd
love
to
talk
to
you
about
it
and
maybe
work
together.
Who
knows
so
yeah.
Please
do
drop
by
and
chat
to
us,
especially
our
booth,
which
we'll
talk
about
a
bit
later.
If
you've
got
any
ideas
on
that,
because
we'd
love
to
talk
to
you.
B
Cool,
so
that
was
the
the
present,
and
now
we
can
move
on
to
the
Future.
So
we
keep
talking
about
our
Integrations,
but
there's
the
cncf
landscape
is
growing
every
year.
There's
me
lots
of
meme
templates
about
it,
so
we
yeah
we
want
to
integrate
with
any
cncf
project
that
talks
about
TLS
certificate
management,
especially
like
other
service
meshes
like
there's
a
couple
of
posts
about
psyllium
which
we're
excited
about
I'm,
also
personally,
very
interested
in
spiffy
Inspire.
B
A
lot
of
work
recently
has
been
going
on
the
developer
experience
like
they're
in
there's
a
small
number
of
core
contributors,
but
we
all
have
other
jobs.
So
we
need
to
make
it
as
easy
as
possible
for
the
community
to
get
involved
in
the
project
and
recently
there's
a
lot
of
work
on
fixing
our
kind
of
flaky
CA.
So
now,
if
you
make
a
PR
and
the
tests
fail,
it's
because
you
didn't
test
it.
B
Not
because
our
test
infrastructure
is
terrible,
at
least
in
theory,
and
we
also
yeah,
we
participate
in
Google
summer
of
code
every
year
and
recently
Google
season
of
dogs,
so
we're
really
trying
to
bring
new
contributors
up
and
get
them
up
to
speed
with
Cloud
native
and
yeah.
There's
like
lots
of
things
in
our
roadmap.
Here's
just
through
some
examples
in
the
slides,
if
you,
if
any
of
them
jump
out
to
you,
okay,
please
reach
out
on
slack
or
anywhere.
A
But
further
on
to
that,
we
are
pretty
convinced
that
road
maps
are
like
crucially
important
for
an
open
source
project
because
for
people
to
rely
on
that
project
we
need
to
know
what's
coming
in
the
future.
The
way
we're
achieving
that
is
to
have
a
roadmap
available
in
the
main
search
manager,
repo,
that's
a
certain
manager,
cert
manager.
A
If
there's
something
there,
that
would
be
really
useful
for
you,
plus
one
sort
of
would
be
appreciated
like
talk
to
us
about
it,
if
you
think
there's
something
missing
on
that
roadmap
that
we
should
add,
like
we're,
happy
to
chat,
I'm
saying
that
a
lot
but
we
are,
we
are
really
genuinely
happy
to
chat
another
thing
in
the
future.
This
is
this
is
kind
of
becoming
my
baby
and
I'm
sort
of
super
enthusiastic
about
it,
and
this
Top
Line
I've,
said
it.
A
A
So
what
what
I
mean
by
that
is?
Is
it's
all
well
and
good
if
you've
got
the
certificate
that
identifies
your
website
right.
That's
that's
great
like
if
you
use
that
can
be
clients
will
trust
it
automatically,
because
it's
a
publicly
trusted
cert.
They
probably
already
have
a
bundle
of
certificates
onto
their
machine
which
will
allow
them
to
validate
that.
So
that's
great,
but
the
other
half
of
the
problem
is
is
generally.
How
do
clients
know
how
to
trust
certificates
and
I?
A
Think
it's
an
area
that,
as
an
industry,
we're
not
looking
at
enough
as
I
say
that
there
is
Upstream
work
on
this
kind
of
stuff
so
like
clearly,
people
are
looking
at
it,
but
I
think
we
really
should
be
looking
at
it
more
without
trust
like
none
of
TLS
works
and
getting
the
certificate
doesn't
really
like
do
much
good.
If
you
don't
know
how
to
trust.
A
There's
all
kinds
of
spooky
things
going
on
here.
This
isn't
a
Halloween
themed
talk
but
like
there
is
some
there
is
some
scary
stuff
going
on
and
we'd
like
to
help
solve
the
problem.
If
we
can
right,
I'll
mention
the
Upstream
work
but
like
we
have
as
as
a
non
core
project,
we
can
kind
of
move
fast
and
like
discover
things,
learn
things
hopefully
work
with
people
on
this.
A
If
you
are
interested
in
a
bit
of
a
Halloween
scare,
I
did
a
talk
a
few
weeks
ago,
where
I
sort
of
go
into
trust
manager,
which
is
what
we
hope
will
be
our
solution
to
this
problem
and
sort
of
the
kind
of
things
that
we
think
about
and
and
how
you
might
want
to
consider
what
could
go
wrong
in
your
cluster,
so
yeah,
please
feel
free
to
scan
that
QR
code.
The
slides
will
be
available.
They've
been
uploaded.
A
A
Another
thing
that
we'd
really
like
to
highlight
is
that
we
do
get
a
lot
of
community
engagement
on
this
project.
We
mentioned
the
nine
and
a
half
thousand
GitHub
Stars.
We
get
a
lot
of
issues
and
pull
requests
and
messages
on
slack
and
emails.
That's
great
we're
not
saying
we
don't
want
that
right.
A
The
community
engagement
is
fantastic,
but
there's
a
lot
of
work
to
do
and,
as
we
said,
we
have
jobs
right,
we'd,
love
to
get
more
maintainers,
I'm
sure
this
is
standard
for
a
lot
of
projects,
but
we
we,
if
you
think,
hey
certificates,
are
interesting.
Maybe
I'd
be
I'd
like
to
get
involved
in
some
way
like
that,
doesn't
have
to
be
code,
it
could
be
docs,
it
could
be
sort
of
compute,
Community
stewardship.
That's
a
tricky
thing
to
say
on
a
Friday,
then
yeah,
please
do
get
in
touch
again
like
you.
A
A
Obviously
it's
Friday
mornings
and
people
might
be
going
home,
but
we're
going
to
be
there
all
day
today,
I'll
be
there
all
afternoon
or
most
of
the
afternoon,
I'll
try
and
find
some
time
to
eat
something,
but
yeah,
please
do
drop
by
the
booth
like
we'd
love,
to
talk
about
anything
like
some
people
just
come
by
and
say
they're
like
cert
manager,
and
that
does
wonders
for
my
ego.
So
please
do
that
as
well.
Maybe
more
of
a
draw
than
inflating
my
ego
further
is
to
get
your
own
souvenir
certificate.
A
B
A
It
really
is
so
much
fun
and
also
so
much
fun.
Is
this
line
which
I'm
so
pleased
with
myself
for
we'd
love
to
have
a
TLS
handshake
with
you
in
person
or
an
elbow
bump
if
you'd
prefer
so
yeah,
please
do
come
along,
we'll
still
be
there
until
the
end
of
today,
We've
threw
loads
of
links
on
this
slide.
Obviously
you
can't
click
them
in
person,
but
the
slides
will
be
available
and
we
encourage
you
to
check
out
all
of
this
at
highlight
as
well
the
meetings
and
the
slack
slack
Channel.
A
We
have
tons
of
ways
that
you
can
reach
out
to
us
and
our
meetings
are
public.
If
you're
us-based,
our
I
was
going
to
say
fortnightly
meeting,
but
that's
not
a
thing
that
people
say
here.
The
meeting
that
we
hold
every
two
weeks
is
available
and
will
work
for
a
US
time
zone.
The
the
stand-ups
are
sort
of
early
morning,
EU
time
zones,
so
whatever
works
best
for
you,
but
please
feel
free
to
join,
there's
also
an
email
address.
A
We
we'd
like
to
thank
you
all
for
turning
out
today,
like
we
recognize
as
we
started.
As
we
said
at
the
beginning,
there
was
obviously
the
parties
last
night
I
had
a
very
intense
game
of
big
chess
with
someone
in
in
the
tent
outside
the
spookineties
happened.
Thank
you
for
turning
out.
It's
been
great
to
have
you
all
here.
A
There's
a
feedback
link
here
in
this
QR
code,
we'd
love
to
take
any
questions
that
people
might
have
we
and
and
if
you
don't
get
time
for
a
question
or
you'd,
rather
ask
in
person
again
I'd
direct
you
to
the
booth
or
slack
or
any
of
the
methods.
I've
just
talked
about
for
like
five
minutes.
So
thank
you
all
so
much.