trust-manager Kubernetes operator for distributing X.509 CA trust bundles. Use when installing trust-manager via Helm, writing Bundle CRDs (sources/targets), syncing CA bundles to namespaces, integrating with cert-manager root CAs, configuring JKS/PKCS12 additional formats, secretTargets RBAC, or troubleshooting bundle sync.
Kubernetes operator that distributes X.509 CA certificate bundles cluster-wide via the Bundle CRD. Maintained by Jetstack alongside cert-manager.
Sources (trust namespace) ──► Bundle controller ──► Targets (selected namespaces)
configMap | secret ConfigMap | Secret
inLine | useDefaultCAs + JKS / PKCS12 formats
Bundle is cluster-scoped. Sources live in the trust namespace (default cert-manager). Targets fan out via namespaceSelector.
# Prerequisite: cert-manager (provides webhook cert)
helm upgrade cert-manager oci://quay.io/jetstack/charts/cert-manager \
--install --namespace cert-manager --create-namespace \
--set crds.enabled=true
# trust-manager (must share namespace with cert-manager by default)
helm upgrade trust-manager oci://quay.io/jetstack/charts/trust-manager \
--install --namespace cert-manager --wait
For production values, secretTargets RBAC, and approver-policy integration, see references/helm-installation.md.
apiVersion: trust.cert-manager.io/v1alpha1