Skip to main content
cert-manager automates TLS certificate management - issuing, renewing, and revoking certificates from Let’s Encrypt, Vault, Venafi, and other issuers.

​
What Radar Shows

Topology: Certificate → Issuer/ClusterIssuer edges connect each certificate to its observed built-in issuer, including ownerless issuers. Omitted issuerRef.kind and issuerRef.group use cert-manager defaults. Only referenced issuers are added; external issuer groups are not inferred. ClusterIssuer visibility uses its exact cluster-scoped read permission. Resource details and MCP context distinguish issuer dependencies from autoscaling. The full provisioning chain (Certificate → CertificateRequest → Order → Challenge) is connected via owner references.
cert-manager Topology

cert-manager in Topology View - Certificate → CertificateRequest provisioning chain

Certificate Detail View:
  • Status conditions (Ready) with color-coded expiry warnings
  • Validity period with progress bar (green → yellow → red as expiry approaches)
  • Subject, DNS names, issuer reference
  • Renewal time and last failure
Dashboard: Certificate health card showing healthy/warning/critical/expired certificate counts across all namespaces. TLS Secret Parsing: Click any TLS Secret to see the X.509 certificate details - subject, issuer, validity dates, SANs - parsed directly from the secret data.
Certificate Detail

Certificate Detail View - Validity progress bar, DNS names, issuer reference, and status conditions

Certificate List

Certificate Resource Browser - Ready status, domains, issuer, and expiry date at a glance

​
Supported CRDs