cert-manager on Kubernetes without Helm, with Kapitan

The cert-manager controller, cainjector and webhook with their RBAC, and optionally the CRDs, rendered by the kadet-hub kubernetes generator 1.9.0.

• Latest version: 1.0.2, published 2026-10-27
• Source chart: oci://quay.io/jetstack/charts/cert-manager:v1.21.2@sha256:634dce9c13b56677a2c05e2ab76c312d0be2664022d5dd05815da67e1fd5f610
• Proof level: deploys, compared with the chart by the kadet-hub/recipes CI
• renders passed in the release run of 2026-10-27 with check 0.12.0, kind v0.33.0
• Output capabilities: admission-webhook
• Generators: kubernetes 1.9.0 sha256:987694d4d8b061a6937fb5b8acd17416a16ed3fea36786a7604e6d607c210e24

What it deploys

• recipes.cert-manager (init.yml)
• recipes.cert-manager.controller (controller.yml): cert-manager
• recipes.cert-manager.cainjector (cainjector.yml): cert-manager-cainjector
• recipes.cert-manager.webhook (webhook.yml): cert-manager-webhook
• recipes.cert-manager.crds (crds.yml), an option

Required parameters

No parameter has to be set.

Include

A target includes the recipe and its options as classes and can override anything the recipe sets:

classes:
  - recipes.cert-manager
  - recipes.cert-manager.crds   # the chart's crds.enabled
parameters:
  namespace: cert-manager
  kapitan:
    vars:
      target: cert-manager

Fetching it

A separate fetch inventory pins the recipe by version and digest. This is fetch/targets/recipes.yml for version 1.0.2:

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/recipes/cert-manager:1.0.2@sha256:2ffb63ac054a0cfe5d3cb06892430908502908f194e5227c12df480803ec465a
        output_path: inventory/classes/recipes/cert-manager

The first command fetches the recipe into inventory/classes/recipes/cert-manager, the second the generators and compiles:

kapitan compile --inventory-path fetch --fetch --output-path .
kapitan compile --fetch

The first command exits with status 1 because the fetch target compiles nothing. Kapitan's --fetch checks neither the digest nor the attestation. This verifies the attestation of each recipe the fetch inventory pins:

gh attestation verify \
  oci://ghcr.io/kadet-hub/recipes/cert-manager@sha256:2ffb63ac054a0cfe5d3cb06892430908502908f194e5227c12df480803ec465a \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

The attested index must also list each digest under its recipe with the pinned version, and not as yanked. Verifying by hand shows how to read it.

The output rules found admission-webhook in the compiled output of the recipe's test target. The consumer workflow fails unless the policy .kapitan-sandbox.yaml accepts these capabilities for the target's output path:

output_capabilities:
  "compiled/<target>/*": [admission-webhook]

Settings

args is a mapping and renders in the recipe’s key order, with new keys after them. A string value is one argument, a list several, and ~ drops the entry, for example components.cert-manager.args.verbosity: --v=4.

Any other list set in the target is appended to the recipe’s list. To replace one, set the key to ~ in a class included after the recipe and the new list in the target.

Left out

The chart’s startupapicheck hook runs only inside helm install, where it waits until the webhook answers. tests/smoke checks the same on the installed recipe. These hook objects are not rendered: Job/cert-manager-startupapicheck, ServiceAccount/cert-manager-startupapicheck, Role/cert-manager-startupapicheck:create-cert and RoleBinding/cert-manager-startupapicheck:create-cert.

Renamed RBAC objects

The generator rejects : in names. Each role keeps its own entry and its binding.

Proof

check cert-manager --level deploys with tests/values.yaml (crds.enabled: true) and tests/target.yml, on kind kindest/node:v1.37.0. The objects outside RBAC differ only in these classes:

• Selector scheme: the Deployments and Services select on name, the chart on app.kubernetes.io/name, instance and component.
• Explicit default: the pods set automountServiceAccountToken: true.
• Port by name: the controller’s and the cainjector’s Service target http-metrics, the chart’s 9402.
• Derived name: the controller’s container is named cert-manager, the webhook configurations cert-manager-cert-manager-webhook, and container ports are sorted by name.

All ServiceAccounts and users bound to view, edit and admin have the same permissions. aggregate-to-cluster-reader targets an OpenShift role and is not tested. tests/smoke has a self-signed ClusterIssuer issue a Certificate.

Versions

• 1.0.2, 2026-10-27: sha256:2ffb63ac054a0cfe5d3cb06892430908502908f194e5227c12df480803ec465a
• 1.0.1, 2026-10-26: sha256:fa5cf32dec2fe9faf87660f09b44574a13d740e1ddc41786d651b86890bf41a6
• 1.0.0, 2026-10-26: sha256:fba77d82cff08db6af5acf44b4ae73436d43f3eb8086d20c966fded27fb8024a

The recipe's files are in kadet-hub/recipes. All recipes