cert-manager is a Kubernetes add-on that automates obtaining, renewing, and deploying TLS certificates for secure microservice communication. It supplies custom resource definitions (CRDs) for certificate-related resources and connects Kubernetes workloads with certificate issuers. section 8.3 section 8.5
In a gRPC deployment, cert-manager supports HTTPS over HTTP/2 by generating certificates and injecting them into workloads or Ingress resources. This centralizes TLS termination instead of requiring separate load balancers for individual services. section 8.3.4 section 8.4.4
The Kubernetes resources and integrations commonly used with cert-manager include:
- Install cert-manager with Helm, an Operator, or kubectl apply; installation creates certificate-management CRDs. section 8.3.1
- Use a ClusterIssuer to define a certificate-issuance flow across the cluster; a self-signed ClusterIssuer is suitable for local development. section 8.3.1
- Integrate external issuers such as Let’s Encrypt, Vault, or Cloudflare when production certificate management requires them. section 8.3 section 8.4.4
helm repo add jetstack https://charts.jetstack.io #1 helm repo update #2 helm install \ cert-manager jetstack/cert-manager \ --namespace cert-manager \ --create-namespace \ #3 --version v1.10.0 \ --set installCRDs=true #4
Install cert-manager from the Jetstack Helm repository, create its namespace, pin version v1.10.0, and enable CRD installation. section 8.3.1
Local Kubernetes gRPC deployment
Install cert-manager, create a self-signed ClusterIssuer, and use the resulting certificate with an Ingress that exposes the Order service. The Ingress provides the public entry point while cert-manager handles TLS certificates; grpcurl can then call the service through ingress.local:443. section 8.3.1 section 8.3.4
