cert-manager CSI Driver

Last updated September 16, 2026

cert-manager CSI Driver is a Kubernetes add-on that mounts TLS certificates directly into pods. It works alongside cert-manager: you define certificate parameters in the pod manifest, and the driver requests a certificate and mounts it—along with its private key—into the specified directory. There's no need to create a separate Certificate resource or secret for the pod's certificate.

How It Works
Copy link

This approach works well for applications that handle TLS connections themselves and read certificates from files. For example, the driver can issue and mount a certificate for an Nginx pod, or give each pod its own certificate for mutual authentication between services. Certificates are issued through a configured Issuer or ClusterIssuer, including Let's Encrypt.

Each application replica gets its own certificate and key. The private key is generated on the node running the pod, stays in memory, and is never transmitted over the network by the driver. When a pod is deleted, its certificate files are removed; when the pod is recreated, a new certificate is issued.

If you need a certificate to persist across pod recreations, or to use for HTTPS on an Ingress controller, configure it through cert-manager with a Certificate resource and a secret instead.

Install cert-manager CSI Driver
Copy link

cert-manager must already be installed in the cluster before you install this add-on.

  1. Go to the Kubernetes section and select your cluster.
  2. Open the Addons tab and click cert-manager CSI Driver.
  3. In the setup wizard, click Install and wait for the installation to complete.

Verify the Installation
Copy link

Connect to the cluster with kubectl and check that the driver is registered:

kubectl get csidriver csi.cert-manager.io

The output should list the csi.cert-manager.io driver with Ephemeral mode. This mode is used for temporary volumes tied to a pod's lifecycle, so you don't need to create a StorageClass, PersistentVolume, or PersistentVolumeClaim for them.

The driver runs on worker nodes as a DaemonSet. Check its status with:

kubectl get daemonsets -A

Find the cert-manager CSI Driver DaemonSet in the list. The values in the DESIRED and READY columns should match and be greater than zero.