Skip to main content
In this short walkthrough you’ll install a production-grade Kubernetes operator (cert-manager), inspect the new API kinds it provides, and create a simple ClusterIssuer to prove the controller is reconciling custom resources. The sequence below demonstrates the standard operator installation pattern you’ll use repeatedly:
  1. Confirm the cluster is clean.
  2. Apply the operator release manifest (CRDs + controllers).
  3. Wait for controller deployments to become available.
  4. Inspect new API resources.
  5. Create a custom resource and verify reconciliation.
Step one — confirm the cluster is empty Before installing cert-manager, verify there is no cert-manager namespace and no cert-manager CRDs present on the cluster:
Expected output on a clean cluster:
Step two — apply the cert-manager release manifest A single kubectl apply against the official v1.19.1 release manifest installs the namespace, CRDs, controller deployment, webhook, CA injector, RBAC, and other cluster-scoped resources:
Wait for the three core cert-manager deployments to become available:
Example rollout output:
What the release manifest installs Inspect the API resources added by the operator List the API resources for the cert-manager.io API group to see the new Kubernetes kinds:
Example output (key cert-manager kinds): Prove it works — create a self-signed ClusterIssuer Apply a minimal ClusterIssuer manifest. The cert-manager controller will reconcile this custom resource into a Ready state:
kubectl will report the created resource:
Wait for the ClusterIssuer to report Ready:
Example wait output:
Verify the ClusterIssuer status:
Example output:
This demonstrates the operator pattern in ~60 seconds: apply an operator manifest (CRDs + controllers), observe new API kinds, create a custom resource, and let the controller reconcile it to the desired state.
Summary checklist Links and references

Watch Video