# Which cert-manager component issues a certificate straight into a pod's volume without creating a Secret?

cert-manager, Hard (Expert), Security. https://k8wiz.com/uquiz/which-cert-manager-component-issues-a-certificate-straight-into-a-pods-volume-without-creating-a-secret

- A. trust-manager
- B. csi-driver
- C. cainjector
- D. ingress-shim

**Answer:** csi-driver

**Explanation:** The cert-manager csi-driver creates a CertificateRequest when the pod starts and mounts the key and certificate through an ephemeral CSI volume. The private key is generated on the node and is never stored in the API server. Each pod gets its own certificate, which suits mTLS between workloads.