Kubernetes cert-manager

Overview

QCecuring integrates with Kubernetes cert-manager to provide enterprise governance over certificates issued within Kubernetes clusters. Organizations gain centralized visibility and policy control while developers continue using familiar cert-manager workflows.

Key capabilities

• QCecuring acts as an external issuer for cert-manager, providing enterprise CA-backed certificates.
• Discovery of all Certificate and CertificateRequest resources across clusters and namespaces.
• Policy enforcement for allowed issuers, key sizes, and certificate durations within clusters.
• Centralized inventory of in-cluster certificates alongside traditional infrastructure certificates.
• Automated alerting on failed issuances, policy violations, and approaching expirations.

Typical use cases

• Platform teams standardizing certificate issuance across multiple Kubernetes clusters.
• Security teams requiring visibility into certificates issued by cert-manager across environments.
• Organizations needing enterprise CA integration rather than self-signed or Let’s Encrypt certificates in production.

High-level integration flow

1. Deploy the QCecuring issuer plugin into target Kubernetes clusters alongside cert-manager.
2. Configure ClusterIssuer or Issuer resources pointing to QCecuring-managed certificate authorities.
3. Developers request certificates through standard cert-manager annotations and Certificate resources.
4. QCecuring fulfills requests through approved CAs, enforcing organizational policies on each issuance.
5. All issued certificates are tracked centrally with full lifecycle management and compliance reporting.

CBOM Discovery

QCecuring discovers all Certificate and CertificateRequest resources across Kubernetes clusters, mapping issuers, algorithms, and key sizes into your CBOM for cluster-wide cryptographic visibility.