Hello cert-manager maintainers,
I would like to propose a conceptual, scenario-based guide titled “Certificate Rotation Beyond the Secret: cert-manager and a Gateway API Implementation.”
cert-manager’s Gateway API support can create a Certificate from an annotated Gateway and store the issued certificate and private key in the referenced TLS Secret. From an operator’s perspective, however, updating the Secret is not necessarily the final observable state: the Gateway implementation must also consume the updated Secret and begin serving the renewed certificate.
The proposed guide would use Apache APISIX as one concrete Gateway API implementation to explain this end-to-end responsibility boundary. The discussion would remain centered on cert-manager resources, operational signals, and troubleshooting rather than on APISIX product features.
The proposed outline is:
- How an annotated Gateway connects the Gateway, Certificate, and TLS Secret
- What Certificate readiness and a Secret update do—and do not—confirm
- The responsibility boundary between cert-manager and a Gateway implementation
- Distinguishing certificate issuance, Secret rotation, and the certificate served to clients
- Diagnosing a missing Issuer and stale certificate state
- Production certificate-management concerns outside the scope of the guide
This would not be presented as a complete production PKI guide. It would exclude ACME challenge setup, cross-namespace Secret references, performance benchmarks, availability guarantees, product comparisons, and sales content.
Would this topic be useful for cert-manager readers? If so, which placement would maintainers prefer?
- A guide or tutorial hosted on the cert-manager website
- An independently published article later listed under External Tutorials
- Another official cert-manager community channel
I would prepare the complete 1,000–1,500 word draft only after receiving placement guidance. Any technical statements involving the Gateway implementation would receive a focused technical review before submission.
Yilia Lin, Apache APISIX Committer
Hello cert-manager maintainers,
I would like to propose a conceptual, scenario-based guide titled “Certificate Rotation Beyond the Secret: cert-manager and a Gateway API Implementation.”
cert-manager’s Gateway API support can create a Certificate from an annotated Gateway and store the issued certificate and private key in the referenced TLS Secret. From an operator’s perspective, however, updating the Secret is not necessarily the final observable state: the Gateway implementation must also consume the updated Secret and begin serving the renewed certificate.
The proposed guide would use Apache APISIX as one concrete Gateway API implementation to explain this end-to-end responsibility boundary. The discussion would remain centered on cert-manager resources, operational signals, and troubleshooting rather than on APISIX product features.
The proposed outline is:
This would not be presented as a complete production PKI guide. It would exclude ACME challenge setup, cross-namespace Secret references, performance benchmarks, availability guarantees, product comparisons, and sales content.
Would this topic be useful for cert-manager readers? If so, which placement would maintainers prefer?
I would prepare the complete 1,000–1,500 word draft only after receiving placement guidance. Any technical statements involving the Gateway implementation would receive a focused technical review before submission.
Yilia Lin, Apache APISIX Committer