Cert-Manager Extensions

Google CAS Issuer and Trust Manager for certificate management

The Infra Management Cluster uses cert-manager extensions for certificate management: Google CAS Issuer for issuing certificates from Google Certificate Authority Service, and Trust Manager for distributing CA trust bundles.

ArgoCD Resources

ApplicationNamespaceSource TypeChart
infra-platform-google-cas-issuercert-managerHelmcert-manager-google-cas-issuer
cert-manager-trust-managercert-managerHelmtrust-manager

File Paths

ApplicationFile
infra-platform-google-cas-issuerapps/google-cas-issuer.yaml
cert-manager-trust-managerapps/cert-manager-trust-manager.yaml

Google CAS Issuer

Issues certificates from Google Certificate Authority Service.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: infra-platform-google-cas-issuer
  namespace: argocd
spec:
  project: infra-services
  destination:
    server: https://kubernetes.default.svc
    namespace: cert-manager
  syncPolicy:
    syncOptions:
      - ServerSideApply=true
  source:
    chart: cert-manager-google-cas-issuer
    repoURL: https://charts.jetstack.io
    targetRevision: v0.10.0
    helm:
      valuesObject:
        crds:
          enabled: true
          keep: true
        replicaCount: 1
        serviceAccount:
          annotations:
            iam.gke.io/gcp-service-account: cert-manager-cas-issuer@tb-infra-mgmt-gke-prod-uk-40fd.iam.gserviceaccount.com
        resources:
          requests:
            cpu: 100m
            memory: 128Mi

Key Configuration

SettingValuePurpose
crds.enabledtrueInstall CRDs
crds.keeptruePreserve CRDs on uninstall
Workload Identitycert-manager-cas-issuer@...GCP service account for CAS access

Trust Manager

Distributes CA trust bundles across the cluster.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: cert-manager-trust-manager
  namespace: argocd
spec:
  project: infra-services
  destination:
    server: https://kubernetes.default.svc
    namespace: cert-manager
  syncPolicy:
    automated:
      prune: true
  source:
    chart: trust-manager
    repoURL: https://charts.jetstack.io
    targetRevision: v0.18.0
    helm:
      valuesObject:
        crds:
          enabled: true
          keep: true
        replicaCount: 1
        defaultPackage:
          enabled: true
        secretTargets:
          enabled: true
          authorizedSecretsAll: false
          authorizedSecrets:
            - tb-infra-root-ca-trust-secret
            - tb-infra-internal-root-ca-trust-secret
        resources:
          requests:
            cpu: 100m
            memory: 128Mi

Key Configuration

SettingValuePurpose
defaultPackage.enabledtrueInclude default CA bundle
secretTargets.enabledtrueAllow writing to Secrets
authorizedSecretsListSecrets trust-manager can write to

Authorized Secrets

Trust Manager is authorized to write to these Secrets:

  • tb-infra-root-ca-trust-secret
  • tb-infra-internal-root-ca-trust-secret

How to Update

Upgrading Charts

  1. Update targetRevision in the Application YAML
  2. Review the chart’s changelog for breaking changes
  3. Commit and push to main

Adding Authorized Secrets

To allow Trust Manager to write to additional Secrets:

  1. Edit apps/cert-manager-trust-manager.yaml
  2. Add the Secret name to secretTargets.authorizedSecrets
  3. Commit and push to main
ResourcePurpose
GoogleCASIssuer CRDDefine CAS-backed certificate issuers
Bundle CRDDefine trust bundles for distribution
cert-managerBase certificate management (deployed separately)

Workload Identity

The Google CAS Issuer uses Workload Identity to authenticate to GCP:

  • Kubernetes SA: cert-manager-google-cas-issuer (in cert-manager namespace)
  • GCP SA: cert-manager-cas-issuer@tb-infra-mgmt-gke-prod-uk-40fd.iam.gserviceaccount.com

The GCP service account must have the roles/privateca.certificateRequester role on the CA pool.

Last modified January 19, 2026: docs: add ArgoCD managed services (#1932) (2efa8f20)