How We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-manager
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 17:30· Level 3 | ICC Capital Suite 14-16·
summary
A production setup issues short‑lived mTLS certificates for a thousand microservice workloads across shared clusters and enables true self‑service by annotating service accounts so a controller creates CertificateRequests and Secrets. Initial V1 wrongly mounted CA.CRT; V2 fixes root rotation with trust-manager bundles that add and remove roots without downtime, enforces tenant isolation with approver-policy checks (URI and DNS suffix tied to namespace via cell support), uses Vault CA as a signing backend, and triggers restarts with a service-account annotation + reloader and monitors expiries in Prometheus/Grafana.
AI-written summary · about
chapters (13)
- 0:00TLS at scale with cert-manager
- 2:28Multi-tenant Kafka context
- 6:49SPIFFE and SPIRE for identities
- 7:53Why cert-manager chosen
- 10:05Multi-tenancy setup
- 13:16Certificate distribution challenges
- 14:59Mounting CA.CRT issues
- 17:46Production issues and v2 need
- 18:28Trust Manager solution
- 21:25Unlocking with Approve Policy
- 23:08Approve Policy isolation
- 25:35Scaling TLS principles
- 26:39Q&A: Monitoring & expiration
related talks
24mOur Journey of Implementing TLS at Scale for Services on Kubernetes
31mPractical TLS Advice for Large Infrastructure
15mCertificates in Kubernetes
33mSolving Multi-Service Without a Service Mesh
30mCert-Manager Beyond Ingress – Exploring the Variety of Use Cases
10mLightning Talk: Your Wish Is Our Command: Declarative Certificate Management in a...
36mCertifik8s: All You Need to Know About Certificates in Kubernetes
45mSecure Together: Consul + Vault