cert-manager vs HashiCorp Vault
cert-manager
cert-manager is a widely used Kubernetes controller for X.509 certificate management. It automates the issuance and renewal of certificates from Let's Encrypt, HashiCorp Vault, Venafi, AWS Private CA, Google CAS, and internal CA setups. cert-manager is a CNCF Graduated project originally built by Jetstack, and it's the go-to tool for any team running TLS on Kubernetes.
Pros
- De facto standard for TLS on Kubernetes
- Wide CA provider support (public and private)
- Automatic renewal eliminates expired-cert incidents
- Massive community and active development
Things to check
- Kubernetes-only; not for non-container workloads
- Configuration has many CRDs to understand (Issuer, ClusterIssuer, Certificate)
- ACME rate limits can surprise teams doing heavy issuance
- Complex certificate chains require custom Issuer logic
Pricing: Free (open source); enterprise support from Venafi/CyberArk
HashiCorp Vault
HashiCorp Vault is a widely adopted open-source secrets management tool. It provides a unified interface for managing secrets, encrypting data in transit, and controlling access to sensitive information across distributed infrastructure. Vault supports dynamic secrets, leasing, and revocation.
Pros
- Massive community and ecosystem
- Highly extensible with plugins
- Strong enterprise features
- Multi-cloud and hybrid support
- Free open-source tier
Things to check
- Steep learning curve
- Complex to operate at scale
- Requires dedicated infrastructure
- Enterprise features require paid license
Pricing: Free self-managed Community edition (Business Source License, not true OSS); HCP Vault Dedicated managed cloud from $0.03/hr (about $22/mo) Development tier (HCP rates as of 2022; tiers have since been renamed, verify current pricing), production tiers from about $1.58/cluster-hr plus per-client fees; Vault Enterprise self-managed license is quote-only (contact sales).