TLS certificate management module (shturval-cert-manager)
About the service
| Parameter | Description |
|---|---|
| GUI name | TLS certificate management module |
| System name (identifier) | shturval-cert-manager |
| Cluster Assignment | Automatic issuance, renewal and management of TLS certificates (Let’s Encrypt, corporate CA); integration with Ingress. |
| Critical | Yes |
| Public repository | Cert-Manager |
| Dependencies | shturval-cert-manager-crds |
| Namespace | cert-manager |
Purpose
shturval-cert-manager is a controller for TLS certificates of applications and components in a cluster based on Cert-Manager. The module provides:
- creating and updating certificates;
- renewal of certificates before expiration;
- revocation of certificates.
A critical service for the Shturval platform cannot be disabled. Installed by default in the management cluster and client clusters.
Features
- Automatically obtain certificates from Let’s Encrypt or corporate CA;
- ClusterIssuer and Issuer support;
- Integration with Ingress for automatic TLS. To generate
commonNamefor Ingress certificates, see the page FQDN or VIP Features for KubeAPI and Ingress.
Deployment and management
shturval-cert-manager is a critical platform service. In the Shturval platform, its inclusion and life cycle in the cluster is ensured by cluster-manager (platform service); ShturvalServiceConfig (SSC) objects for associated charts are created and maintained as part of the platform configuration, rather than as an arbitrary manual installation of a Helm chart by an administrator.
In the working environment, the module is represented by two SSCs:
shturval-cert-manager-crds— CRD chart (definitions of Issuer, ClusterIssuer, etc.);shturval-cert-manager— main chart of cert-manager.
Note: The order of deployment at the platform level must take into account the dependency: the CRD (shturval-cert-manager-crds) must be installed first, then the main controller (shturval-cert-manager). Otherwise, Kubernetes will not be able to create custom cert-manager resources until their types are registered in the cluster.
Recommendation: do not edit the ShturvalServiceConfig object manually to change limits, nodeSelector and other release parameters - such an object belongs to the platform configuration and can be overwritten during updates. Changes to the behavior of the service are made through ShturvalServicePatch (SSP), which overlays spec.customvalues on top of the base SSC.
Below in the section Where to configure the transition to managing an already deployed service in the GUI is described; this block does not duplicate the full deployment scenario via the UI/API cluster-manager.
Where to configure
Services and Repositories → Installed Services → find TLS Certificate Management Module (shturval-cert-manager) → Manage.
For correct operation, the Resource creation component for the TLS certificate management module (shturval-cert-manager-crds) must be installed and enabled in the cluster. Tracking the expiration dates of Kubernetes API certificates is in Kubernetes API Certificate Validation Module (shturval-cert-expiration).
Learn more about setting up ClusterIssuer, Issuer - Certificate Management. Official documentation: cert-manager.