trust-manager

Kubernetes operator that distributes X.509 CA certificate bundles cluster-wide via the Bundle CRD. Maintained by Jetstack alongside cert-manager.

When to Use

• Distributing private/internal root CA certificates to many namespaces
• Bundling system trust roots (Debian/Mozilla) with custom CAs into one ConfigMap
• Generating JKS or PKCS#12 trust stores for Java/.NET workloads
• Syncing the cert-manager root CA Secret out to consumer namespaces

Architecture

Sources (trust namespace) ──► Bundle controller ──► Targets (selected namespaces)
  configMap | secret                                  ConfigMap | Secret
  inLine    | useDefaultCAs                           + JKS / PKCS12 formats