cert-manager: Managing Certificates in Kubernetes

cert-manager is a powerful add-on for Kubernetes that automates the management and issuance of TLS certificates from various issuing sources, such as Let’s Encrypt, HashiCorp Vault, and Venafi. It ensures that certificates are valid and up to date, and attempts to renew them at a configurable point before expiry.

Checking cert-manager Status

To verify that cert-manager is running correctly, you can check its pods:

kubectl get pods -n cert-manager

Inspecting Certificate Requests and Challenges

When cert-manager requests a new certificate (or a renewal), it creates CertificateRequest and Challenge resources. Inspecting these can help diagnose issues during the certificate issuance process.

Listing Certificate Requests

CertificateRequest objects represent an attempt to obtain a signed certificate.

kubectl get certificaterequest -n <your-namespace>
# Example for a specific namespace:
kubectl get certificaterequest -n uat

Listing and Describing Challenges

Challenge objects are created by cert-manager to solve ACME challenges (e.g., HTTP-01 or DNS-01) for domain validation.

# List all challenges across all namespaces, then filter for a specific domain/resource
kubectl get challenge -A | grep homepage
 
# Describe a specific challenge for detailed events and status
kubectl describe challenge homepage-tls-fnx4c-1266481962-2115654750 -n uat

Replace homepage-tls-fnx4c-1266481962-2115654750 with the actual name of your challenge resource.

Troubleshooting: Reinstalling cert-manager

If cert-manager pods are not running or you are experiencing persistent issues, you might need to reapply its Custom Resource Definitions (CRDs) and core components. Ensure you are using the correct version compatible with your Kubernetes cluster.

# 1. Apply cert-manager Custom Resource Definitions (CRDs)
# This step creates the necessary API extensions for cert-manager to function.
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.3/cert-manager.crds.yaml
 
# 2. Apply the main cert-manager components
# This deploys the cert-manager controller, webhook, and cainjector into the cert-manager namespace.
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.3/cert-manager.yaml

Note: Always refer to the official cert-manager documentation for the latest installation instructions and recommended versions.