AI
Cert-manager at Scale: One Million Daily Users
Cert-manager issues X.509 certificates inside Kubernetes clusters and distributes private keys to pods, ingresses, gateways, and service meshes. Its companion project, trust-manager, combines configurable trust bundles from secrets, config maps, and the Mozilla public CA list, then distributes them across namespaces. Together they serve close to one million users per day. The project has nearly 500 contributors, reached CNCF graduation, and added its 10th maintainer, Hammond Joshy from Walmart, two weeks before this talk.
Gateway API Migration and the ListenerSet Fix
Ingress-NGINX was archived on stage at KubeCon Tuesday. Many teams using the cert-manager annotation on their Ingress resources now face a migration to Gateway API. The original cert-manager Gateway API integration dates to 2021 and put the TLS block and annotation on the Gateway object, forcing developers to contact cluster operators for every certificate change. The new ListenerSet resource, now supported by cert-manager, lets developers create and update listeners independently without touching the sensitive Gateway object, restoring self-service certificate management.
Helm Chart Improvements: One Flag for Custom Registries
Installing cert-manager with Artifactory or custom images previously required replacing the image repository value in every Helm subchart. The new image.registry field, available from v1.20, accepts a single flag that overrides the quay.io registry across cert-manager and all related projects. The same field pattern is already standard in other projects. Fixing it required undoing an early design choice about the repository field, but the change is now consistent across the full project family.
Supply-Chain and Direct-Attack Defenses
Cert-manager manages private keys, so a compromised release is a serious risk. The team pins every downloaded binary and GitHub Action by digest, stores those digests in git, and verifies them at build time. Renovate updates Go dependencies centrally and can upgrade a package before scanner vendors index the CVE. Base images are built with apko and layered with ko to minimize the dependency surface. All releases run in pipelines and are signed with the pipeline token, making local modifications detectable.
Tooling and Audits That Enforce Best Practices
The team runs golangci-lint with a centralized config, govulncheck for CVE scanning, a custom Helm linter that catches missing or unused values, and boiler-suite to verify license headers. Maintainer Eric is adding a kube-api linter to enforce CRD best practices across all repositories. Security audits ran in 2023 and 2025. A new security hardening guide, written with Control Plane and including a threat model for cert-manager deployments, published just before this talk. The link appears in the slide deck.
Roadmap: Renewal Windows, Server-Side Apply, and ACME Improvements
The next cert-manager release will include renewal window support, already merged, which lets operators restrict certificate renewals to specific time windows such as office hours. Server-side apply migration is underway. The team plans to extract built-in issuers into standalone libraries so external issuers can use the same code without depending on the full cert-manager project. ACME issuer performance is also being improved, with async processing and support for the ACME renewal information extension that signals when a certificate should ideally be renewed.
Notable Quotes
it is our 10th maintainer. Uh it is awesome. Maël Valais · ▶ 04:11
the fact that it is a graduated project and that we have a healthy number of maintainers that review P is a show that you can trust and you can rely on this project. Maël Valais · ▶ 05:22
if we end up releasing some malicious version of search manager and you install it that’s a big problem. Tim Ramlot · ▶ 12:39
sometimes we’re even able to upgrade a dependency before some of the lenders have picked up um on the CV for example. Tim Ramlot · ▶ 16:46
Key Takeaways
- Cert-manager reached CNCF graduation and now has 10 maintainers across multiple companies.
- ListenerSet support restores developer self-service certificates during Gateway API migrations.
- Digest-pinned dependencies and pipeline-signed releases block both supply-chain and direct attacks.
About the Speaker(s)
Maël Valais is a Senior Software Engineer at Palo Alto Networks with eight years in the cloud-native space and six years as a cert-manager maintainer. Before moving to software engineering, Maël worked in academia.
Tim Ramlot is a Senior Software Engineer at Palo Alto Networks. He joined through a Google Summer of Code internship while studying computer science engineering at Ghent University, and his current focus is advancing the cert-manager project.