cert-manager
Hard
Security
Which cert-manager component issues a certificate straight into a pod's volume without creating a Secret?
Select your answer:
Show answer and explanation
Answer: csi-driver
Explanation
The cert-manager csi-driver creates a CertificateRequest when the pod starts and mounts the key and certificate through an ephemeral CSI volume. The private key is generated on the node and is never stored in the API server. Each pod gets its own certificate, which suits mTLS between workloads.
More hard cert-manager questions
- What has to happen to a CertificateRequest before an issuer will sign it?
- Which annotation tells cainjector to fill a webhook configuration's caBundle from a cert-manager Certificate?
- cert-manager can't be given API access to the DNS zone for example.com. How can you still use DNS-01 for it?
- Which of the following is a valid way to revoke a certificate in cert-manager?
- Which of the following is a valid way to configure a Vault issuer?
- What is the purpose of the 'keystores' field in a Certificate resource?