skills.rest
villadalmine
villadalmineCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

cert-manager

Issues and manages TLS certificates for private Kubernetes domains.

1|Updated Apr 3, 2026
Search Tags:#kubernetes#tls#cert-manager#gateway api#wildcard certificates#internal ca
One-click install
npx skills add https://github.com/villadalmine/infra --skill cert-manager-villadalmine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cert-manager
Source: https://github.com/villadalmine/infra/tree/main/.agents/skills/cert-manager
Command: npx skills add https://github.com/villadalmine/infra --skill cert-manager-villadalmine

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill removes the complexity of managing trusted TLS certificates for private Kubernetes domains by standardizing internal CA issuance, certificate rotation, and browser trust setup.

Core Features & Use Cases

  • Internal CA Workflow: Creates and uses a cert-manager-backed CA for the private cluster.home domain instead of relying on public ACME validation.
  • Cluster TLS Delivery: Issues wildcard and service certificates for Gateway API and Ingress TLS termination across the cluster.
  • Trust Distribution: Extends trust to macOS Keychain so local browsers and command-line tools accept cluster certificates without warnings.
  • Operational Safety: Covers idempotent issuance, status checks, upgrade steps, and troubleshooting for failed certificates or webhook readiness issues.

Quick Start

Ask for a cert-manager configuration plan that sets up an internal CA, ClusterIssuer, wildcard certificate, and macOS trust for cluster.home.

Frequently Asked Questions about cert-manager

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up an internal CA for Kubernetes TLS certificates?▼

Use cert-manager with an Ansible-managed CA to generate an internal CA, create a ClusterIssuer, and issue wildcard certificates for your private Kubernetes domain. This keeps certificate issuance idempotent and browser-trusted without relying on public ACME validation.

How do I make macOS Keychain trust certificates issued by a Kubernetes internal CA?▼

Distribute trust to macOS Keychain by importing the internal CA root certificate so local browsers and command-line tools accept cluster certificates. This Skill includes trust distribution steps to prevent browser warnings for your private cluster domain.

Can I use cert-manager wildcard certificates with Gateway API TLS termination?▼

Yes, cert-manager issues wildcard and service certificates for Gateway API and Ingress TLS termination across the cluster. You configure a ClusterIssuer and Certificate resource to automate TLS delivery for your private domain.

What is the best way to automate certificate rotation for a private Kubernetes domain?▼

Automate certificate rotation using cert-manager with an internal CA and Ansible-managed CA generation. This approach ensures idempotent issuance and provides status checks to monitor certificate readiness and troubleshoot webhook issues.

Why are my cert-manager certificates failing to issue after creating a ClusterIssuer?▼

Certificate issuance can fail due to webhook readiness issues or an incorrectly configured internal CA. This Skill provides troubleshooting for failed certificates, idempotent issuance checks, and upgrade steps to resolve operational blockers.

Do I need a public ACME provider to secure TLS for a private Kubernetes cluster?▼

No, you can use an internal CA workflow with cert-manager instead of relying on public ACME validation. This Skill creates a cert-manager-backed CA for the private cluster.home domain to standardize TLS issuance and trust setup.

Related Skills

Explore More Software Engineering Skills→
rohitg00rohitg00
944

k8s-certs

Automate Kubernetes certificate management with cert-manager for issuers and certificates.

Community
Advanced
chatermchaterm
50

service-ingress

Configures Kubernetes Service and Ingress resources for network exposure and TLS termination.

Community
Intermediate
thc1006thc1006

gateway-api

Configure and deploy Kubernetes Gateway API with Envoy Gateway.

Community
Intermediate
BjzyLabsBjzyLabs
1

step

Issue, renew, and revoke TLS certificates via Smallstep Step CA.

Official
Advanced