Certificate Management with cert-manager

Manage TLS certificates using kubectl-mcp-server's cert-manager tools.

Requires the certs toolset: start kubectl-mcp-server with --toolsets default,certs (or MCP_TOOLSETS=default,certs).

When to Apply

Use this skill when:

• User mentions: "certificate", "cert-manager", "TLS", "SSL", "issuer", "Let's Encrypt"
• Operations: creating certificates, configuring issuers, debugging cert issues
• Keywords: "https", "secure", "encrypt", "renew", "expiring"

Priority Rules

Priority	Rule	Impact	Tools
1	Detect cert-manager first	CRITICAL	detect_ecosystem
2	Use staging issuer for testing	HIGH	Test with letsencrypt-staging
3	Check issuer before cert	HIGH	list_cert_issuers
4	Monitor certificate expiry	MEDIUM	get_cert

Quick Reference

Task	Tool	Example
Detect cert-manager	detect_ecosystem	detect_ecosystem()
List certificates	list_certs	list_certs(namespace)
Get certificate	get_cert	get_cert(name, namespace)
List issuers	list_cert_issuers	list_cert_issuers()

Check Installation

detect_ecosystem()

Certificates

List Certificates

list_certs(namespace="default")

Get Certificate Details

get_cert(
    name="my-tls",
    namespace="default"
)

Create Certificate

kubectl_apply(manifest="""
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: my-tls
  namespace: default
spec:
  secretName: my-tls-secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - app.example.com
  - www.example.com
""")

Issuers

List Issuers

list_cert_issuers(namespace="default")

list_cert_issuers()

Get Issuer Details

get_cert_issuer(name="my-issuer", namespace="default")
get_cert_issuer(name="letsencrypt-prod")

Create Let's Encrypt Issuer

kubectl_apply(manifest="""
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-staging-key
    solvers:
    - http01:
        ingress:
          class: nginx
""")

kubectl_apply(manifest="""
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
    - http01:
        ingress:
          class: nginx
""")

Create Self-Signed Issuer

kubectl_apply(manifest="""
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned
spec:
  selfSigned: {}
""")

Certificate Requests

list_cert_requests(namespace="default")

list_cert_requests(
    namespace="default",
    label_selector="app=my-app"
)

Troubleshooting

Certificate Not Ready

get_cert(name, namespace)
list_cert_requests(namespace)
kubectl_get(resource_type="events", namespace)

Issuer Not Ready

get_cert_issuer(name)
kubectl_get(resource_type="events", namespace="cert-manager")

Ingress Integration

kubectl_apply(manifest="""
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-service
            port:
              number: 80
""")

Prerequisites

• cert-manager: Required for all certificate tools

  kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml
  

Related Skills

• k8s-networking - Ingress configuration
• k8s-security - Security best practices