Trust Manager

This Plugin provides trust-manager to automate the management and distribution of trust bundles across Kubernetes clusters.

Trust-manager is a Kubernetes operator that distributes trust bundles (CA certificates) to workloads running in your cluster. It works alongside cert-manager and enables you to manage CA trust stores declaratively.

Prerequisites

• cert-manager must be installed on the target cluster before deploying this plugin. Trust-manager depends on cert-manager for its webhook certificates. You can install it using the cert-manager Greenhouse plugin.

Configuration

This section highlights configuration of selected Plugin features. All available configuration options are described in the plugindefinition.yaml.

Trust Bundle

The plugin creates a Bundle resource that distributes trust bundles to selected namespaces. The bundle includes:

• Default CAs from the trust package image
• The cluster’s kube-root-ca.crt ConfigMap

Bundle creation can be disabled by setting bundle.enabled to false.

⚠️ Warning: An empty namespaces selector ({}) matches ALL namespaces, distributing the trust bundle cluster-wide. To restrict distribution, configure a matchLabels or matchExpressions selector.

Namespace Selector Example

namespaces:
  matchExpressions:
    - key: kubernetes.io/metadata.name
      operator: In
      values:
        - my-namespace-1
        - my-namespace-2

Additional Bundle Sources

Additional CA sources can be included in the trust bundle by enabling and configuring additionalSources.

Example

additionalSources:
  enabled: true
  sources:
    - configMap:
        key: ca.crt
        name: my-custom-ca

Cert Exporter

An optional cert-exporter can be deployed to monitor trust bundle certificates and expose Prometheus metrics.

Trust Manager Configuration