How cert-manager Got to 500 Million Downloads a Month
Dec 19, 2024
auto_awesome
Matt Barker, co-founder of Jetstack, and Ashley Davis, staff software engineer at Venify, dive into the fascinating journey of cert-manager, an open-source project that revolutionized Kubernetes certificate management. They recount how a job interview challenge sparked its creation, leading to over 500 million downloads monthly. The discussion highlights cert-manager's CNCF graduation, upcoming sub-projects like trust-manager, and the importance of managing machine identities in cloud-native environments, while also addressing the challenges of community engagement and scaling.
Cert-manager evolved from an interview challenge into a vital open-source project for Kubernetes, achieving 500 million downloads monthly and CNCF graduation.
The project faces governance challenges due to diverse user opinions while planning future enhancements like post-quantum cryptography and improved enterprise integrations.
Deep dives
Overview of CertManager's Journey to Graduation
CertManager transitioned from a sandbox project to graduation status within the Cloud Native Computing Foundation (CNCF) in four years, showcasing its significance in cloud-native environments. Initially developed by Jetstack, CertManager was created to address common challenges in managing TLS certificates within Kubernetes ecosystems. Its wide adoption can be seen, as studies indicate that it is utilized in up to 90% of Kubernetes clusters. This project has grown into a cornerstone of open-source certificate management, reflecting the community's strong support and substantial contributions towards its development.
Challenges and Solutions in Development
The development journey of CertManager involved navigating numerous challenges, particularly in reaching consensus among a broad user base regarding security practices. Project maintainers noted the difficulty of addressing vulnerabilities without disrupting users' workflows, reflecting the diverse perspectives within the community. The CNCF's structured processes proved invaluable in fostering collaboration and defining strategies to address such challenges. Ultimately, the project not only benefited from CNCF's support but also established formal mechanisms for decision-making, enhancing the overall governance of the project.
Future Directions and Innovations
Looking forward, CertManager aims to continue expanding its capabilities while addressing the evolving needs of enterprise users. Upcoming features include the ARI process for cert renewal and enhanced integrations with technologies like Spiffy for workload identity management. The recent acquisition of Venify by CyberArk opens new opportunities to unify identity management across various platforms and services. Furthermore, recognizing the increasing urgency around post-quantum cryptography, the project is preparing to tackle the complexities of transitioning to quantum-safe algorithms while ensuring cert management remains robust in rapidly changing climates.
Jetstack’s cert-manager, a leading open-source project in Kubernetes certificate management, began as a job interview challenge. Co-founder Matt Barker recalls asking a prospective engineer to automate Let’s Encrypt within Kubernetes. By Monday, the candidate had created kube-lego, which evolved into cert-manager, now downloaded over 500 million times monthly.
Cert-manager’s journey to CNCF graduation, achieved in September, began with its donation to the foundation four years ago. Relaunched as cert-manager, the project grew under engineer James Munnelly, becoming the de facto standard for certificate lifecycle management. The thriving community and ecosystem around cert-manager highlighted its suitability for CNCF stewardship. However, maintainers, including Ashley Davis, noted challenges in navigating differing opinions within its vast user base.
With graduation achieved, cert-manager’s roadmap includes sub-projects like trust-manager, addressing TLS trust bundle management and Istio integration. Barker aims to streamline enterprise-scale deployments and educate security teams on cert-manager’s impact. Cert-manager has become integral to cloud-native workflows, promising to simplify hybrid, multicloud, and edge deployments.