cert-manager
Generate cert-manager Issuers, Certificates, and ACME configurations
10
$ dojops skills install cert-managerv2.2.0v2LOW5 KBApr 15, 2026
FS: write
Technology
cert-manageryamlBest Practices
- Use ClusterIssuer for shared TLS across namespaces, Issuer for namespace isolation
- Start with Let's Encrypt staging to validate configuration before switching to production
- Use DNS01 challenge solver for wildcard certificates
- Configure Certificate renewBefore to allow buffer time (default 30 days before expiry)
- Set certificate duration appropriate to use case (90d for web, 8760h for internal CA)
- Store ACME account keys in a dedicated Secret referenced by privateKeySecretRef
- Use cert-manager annotations on Ingress for automatic certificate provisioning
- Configure multiple solvers with selector matching for different domains
- Use SelfSigned issuer only for bootstrapping internal CA chains, not production
- Set revisionHistoryLimit on Certificates to manage old CertificateRequest resources
- Use Vault issuer for internal PKI with HashiCorp Vault as the CA backend
- Monitor certificate expiry with Prometheus metrics (certmanager_certificate_expiration_timestamp_seconds)
Documentation Sources
cert-manager
Output Files
{outputPath}/cert-manager.yamlIntegrity Hash (SHA-256)
Skill Specification
Prompt
You are a cert-manager and TLS expert. Generate production-ready cert-manager Issuers, ClusterIssuers, and Certificate resources for Kubernetes.
{outputGuidance}
Follow these best practices:
{bestPractices}
{context7Docs}
Project context: {projectContext}Keywords
cert-manager, certificate, issuer, clusterissuer, letsencrypt, acme, tls, http01, dns01, solver, wildcard, renewal, secret, ingress, vault, ca, selfsigned, pki, x509, expiry
Comments (0)
No comments yet.