# trust-manager (/docs/runtime/components/trust-manager)



Component Category [#component-category]

Access and security / certificate management

Component Description [#component-description]

trust-manager is a Kubernetes operator that distributes CA trust bundles as `ConfigMap` or `Secret` resources across namespaces. It uses a `Bundle` custom resource to define which CA certificates should be available and where they should be projected.

Why It Is Used [#why-it-is-used]

In BullSequana AI, trust-manager ensures that all platform components share a consistent set of trusted CA certificates. This is required when the platform uses custom or internal CAs, because each component namespace needs access to the same trust bundle for TLS verification to succeed across service-to-service communication.

Learn More [#learn-more]

* [trust-manager documentation](https://cert-manager.io/docs/trust/trust-manager/)
* [cert-manager/trust-manager on GitHub](https://github.com/cert-manager/trust-manager)

Deployment notes [#deployment-notes]

trust-manager deploys into the `cert-manager` namespace at sync wave 3, the same wave as cert-manager. Because all dependent components are in higher sync waves, CA bundles are available before those components start.

Interacts With [#interacts-with]

* `cert-manager`, which manages the certificates whose CA chains trust-manager distributes. Both share the `cert-manager` namespace.
* `All platform components`, which consume the projected trust bundles for outbound TLS verification.