# cert-manager (/docs/runtime/components/cert-manager)



Component Category [#component-category]

Access and security / certificate management

Component Description [#component-description]

cert-manager automates the issuance, renewal, and management of TLS certificates in Kubernetes.

Why It Is Used [#why-it-is-used]

In BullSequana AI Runtime, cert-manager helps secure platform endpoints with managed certificates and reduces the operational burden of handling certificate lifecycles manually. This is important for ingress exposure, trusted service endpoints, and the general security posture of a production platform.

Learn More [#learn-more]

* [cert-manager documentation](https://cert-manager.io/docs/)
* [cert-manager/cert-manager on GitHub](https://github.com/cert-manager/cert-manager)

Deployment notes [#deployment-notes]

cert-manager deploys into the `cert-manager` namespace at sync wave 3 in the common tier. It installs CRDs via the Helm chart and provisions a Let's Encrypt cluster issuer (when Azure DNS is enabled) and a self-signed CA chain cluster issuer. Custom TLS certificates can be supplied through the platform configuration when Let's Encrypt is not available.

Interacts With [#interacts-with]

* `Gateway API`, which references cert-manager-issued TLS certificates on the shared Gateway resource.
* `trust-manager`, which distributes the CA trust bundles from cert-manager-managed CAs across namespaces. Both share the `cert-manager` namespace.
* `External DNS`, because certificate issuance depends on the same DNS and domain setup.
* `Rook Ceph`, whose RGW and dashboard endpoints use cert-manager-managed certificates.