---
title: "cert-manager CSI Driver for Kubernetes | Hostman Docs"
description: "Mount TLS certificates directly into Kubernetes pods with cert-manager CSI Driver—no separate Certificate resource or secret required."
---

> For the complete documentation index for AI agents, see [llms.txt](https://hostman.com/llms.txt).

cert-manager CSI Driver is a Kubernetes add-on that mounts TLS certificates directly into pods. It works alongside [cert-manager](https://hostman.com/docs/kubernetes/addons/cert-manager/): you define certificate parameters in the pod manifest, and the driver requests a certificate and mounts it—along with its private key—into the specified directory. There's no need to create a separate Certificate resource or secret for the pod's certificate.

## How It Works

This approach works well for applications that handle TLS connections themselves and read certificates from files. For example, the driver can issue and mount a certificate for an Nginx pod, or give each pod its own certificate for mutual authentication between services. Certificates are issued through a configured `Issuer` or `ClusterIssuer`, including Let's Encrypt.

Each application replica gets its own certificate and key. The private key is generated on the node running the pod, stays in memory, and is never transmitted over the network by the driver. When a pod is deleted, its certificate files are removed; when the pod is recreated, a new certificate is issued.

If you need a certificate to persist across pod recreations, or to use for HTTPS on an Ingress controller, configure it through cert-manager with a `Certificate` resource and a secret instead.

## Install cert-manager CSI Driver

[cert-manager](https://hostman.com/docs/kubernetes/addons/cert-manager/) must already be installed in the cluster before you install this add-on.

1.  Go to the **Kubernetes** section and select your cluster.
2.  Open the **Addons** tab and click **cert-manager CSI Driver**.
3.  In the setup wizard, click **Install** and wait for the installation to complete.

## Verify the Installation

Connect to the cluster [with kubectl](https://hostman.com/docs/kubernetes/connect-to-clusters/kubectl/) and check that the driver is registered:

```shell
kubectl get csidriver csi.cert-manager.io
```

The output should list the `csi.cert-manager.io` driver with `Ephemeral` mode. This mode is used for temporary volumes tied to a pod's lifecycle, so you don't need to create a `StorageClass`, `PersistentVolume`, or `PersistentVolumeClaim` for them.

The driver runs on worker nodes as a `DaemonSet`. Check its status with:

```shell
kubectl get daemonsets -A
```

Find the cert-manager CSI Driver `DaemonSet` in the list. The values in the `DESIRED` and `READY` columns should match and be greater than zero.