TLS and certificates

Certificates should renew themselves

TLS is normally terminated at the ingress, which holds the certificate and forwards plain traffic inside the cluster. That keeps certificate management in one place instead of in every service.

Manual renewal is a recurring outage waiting to happen. A controller that requests and renews certificates automatically removes an entire class of calendar-driven incident.

Certificates live in secrets, so the same access control questions apply. A private key readable by every workload in the namespace is not really private.