About This Architecture
Kubernetes cert-manager TLS architecture automates certificate provisioning, renewal, and rotation across ingress controllers, microservices, and data services using ClusterIssuers, Webhooks, and CSI drivers. The cert-manager Controller orchestrates certificate lifecycle within its namespace, while CA Injector distributes certificates to Secrets and CSI volumes across ingress-system, microservices, and data-services namespaces. Service-to-service mTLS is enforced via X.509 client certificates injected into ServiceAccounts and NetworkPolicies, with automatic rotation preventing downtime through hot-reload mechanisms. Prometheus and Grafana monitor certificate expiry and renewal metrics, ensuring compliance and reducing manual intervention. Fork this diagram on Diagrams.so to customize issuer strategies, add external CAs, or adapt CSI driver configurations for your cluster topology.