cert-manager
cert-manager automates TLS certificate provisioning and renewal in the K3s cluster.
Overview
| Property | Value |
|---|---|
| Namespace | cert-manager |
| Components | Controller, Webhook, CA Injector |
| Issuer | letsencrypt-prod (HTTP-01, BROKEN) |
Known Issue
The HTTP-01 ACME challenge solver does not work behind the Cloudflare tunnel. This is the root cause of multiple NOT READY certificates. See TLS Certificates and Certificate Renewal for the DNS-01 migration plan.
Components
| Pod | Restarts | Purpose |
|---|---|---|
| cert-manager | 24 | Main controller, watches Certificate resources |
| cert-manager-cainjector | 28 | Injects CA bundles into webhooks |
| cert-manager-webhook | 22 | Validates and mutates Certificate resources |
The high restart counts (22-28) are accumulated over 37 days of uptime.
Issuers
| Name | Type | Solver | Status |
|---|---|---|---|
| letsencrypt-prod | ClusterIssuer | HTTP-01 | Broken behind tunnel |
| letsencrypt-staging | ClusterIssuer | HTTP-01 | FALSE/Error |
Quick Commands
kubectl get pods -n cert-manager
kubectl get clusterissuer
kubectl get certificates -A
kubectl get challenges -A
kubectl logs -n cert-manager deployment/cert-manager --tail=100
TODO: expand with full issuer YAML, wildcard certificate setup, and DNS-01 configuration after migration.