Building cert-manager: Migrating Thousands of Users from kube-lego to use CRDs
summary
cert-manager introduces CRDs (Issuer, ClusterIssuer, Certificate) and an Ingress shim that automatically creates Certificate objects, enabling a seamless path that migrates kube-lego users to CRD-backed issuance. It supports ACME (Let’s Encrypt), a CA keypair, and HashiCorp Vault; demo issues a wildcard cert and writes it to a Kubernetes Secret. Migration strategy keeps existing ingress annotations working, tracks status via conditions and Prometheus metrics, and the project shows 38 contributors and ~834 commits.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:22Who am I
- 1:07What is certmanager
- 2:20Image pools
- 2:48Who got started
- 3:29Building certmanager
- 5:07CA support
- 6:26Structured API types
- 7:29Kubernetes support
- 9:21Why do this
- 10:19Custom resources
- 12:09Switching from kubelego
- 13:11Certificate issuers
- 13:58Cluster issuers
- 15:06Certificates
- 16:09HTTP DNS
- 17:00nginx ingress
- 17:48Simplifying
- 18:21Ingress shim
- 18:56Create certificate resources
- 19:39Secure
- 20:48Demo
- 26:15Wrapping up
- 28:43Summary
- 29:14Informal Development Meeting
- 29:53Questions
related talks
15mCertificates in Kubernetes
38mImplementing Cert-manager in K8s
31mHow We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-manager
22mIdentity with certificates in Kubernetes
45mBeyond cluster-admin: Getting Started with Kubernetes Users and Permissions
24mOur Journey of Implementing TLS at Scale for Services on Kubernetes
32mManaging CRDs and Operators in Practice
19mKeynote: CRDs, No Longer 2nd Class Thing!