Red Hat OpenShift Container Platform

Configuring trust bundle

After installing the trust-manager operand, you must use the Bundle custom resource (CR) to distribute certificate authority (CA) certificates across your cluster. A trust bundle combines certificate sources and maintains target ConfigMap and Secret objects across selected namespaces.

If you configure your trust bundle to use the default CAs, you do not need to manually provision the source certificates. The controller reads them from the cert-manager-operator-trusted-ca-bundle ConfigMap, which is injected by the Cluster Network Operator (CNO) during the Operator installation.

Distributing certificates by using trust manager is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

Prerequisites

You have access to the cluster with cluster-admin privileges.
You have installed trust-manager operand.

Procedure

To inject the trust bundle into a specific namespace, apply the required label by running the following command:
```
$ oc patch namespace <namespace> --type=merge '{"metadata":{"labels":{"trust.cert-manager.io/inject":"true"}}}'
```
The trust-manager operand creates the target bundle in all namespaces that match the label selector defined in your Bundle CR.

Create a YAML file, for example, bundle.yaml, that defines the Bundle object as shown in the following example:

apiVersion: trust.cert-manager.io/v1alpha1
kind: Bundle
metadata:
  name: example-bundle
spec:
  sources:
    - useDefaultCAs: true
  target:
    configMap:
      key: ca-certificates.crt
    secret:
      key: ca-certificates.crt
    namespaceSelector:
      matchLabels:
        trust.cert-manager.io/inject: "true"

For more information on bundle configurations, see trust-manager usage.

If your Bundle CR targets a Secret object, you must set the spec.trustManagerConfig.secretTargets.policy field in your TrustManager CR to Custom and add the name of target secret to the spec.trustManagerConfig.secretTargets.authorizedSecrets list. If the spec.trustManagerConfig.secretTargets.policy field is set to Disabled, the Bundle CR fails to create the target secret.

Create the Bundle custom resource by running the following command:
```
$ oc create -f bundle.yaml
```

Verification

Verify the status of Bundle CR by running the following command:

$ oc get Bundle example-bundle -o jsonpath='{.status.conditions}' | jq

In the output, the reason must be set to Synced and status must be set to True, as shown in the following example:

[
  {
    "lastTransitionTime": "2026-03-27T12:03:42Z",
    "message": "Successfully synced Bundle to namespaces that match this label selector: trust.cert-manager.io/inject=true",
    "observedGeneration": 1,
    "reason": "Synced",
    "status": "True",
    "type": "Synced"
  }
]

Verify the target secret by running the following command:

$ oc describe secret example-bundle -n trust-bundle-target

Example output

Name:         example-bundle
Namespace:    trust-bundle-target
Labels:       trust.cert-manager.io/bundle=example-bundle
Annotations:  trust.cert-manager.io/hash: 55c00f8109c4c6b1ee4710aa53ad280355973f25444d6bb13a93851af0d8f5d8

Type:  Opaque

Data
====
ca-certificates.crt:  219257 bytes

Verify the target ConfigMap by running the following command:

$ oc get cm example-bundle -n trust-bundle-target

Example output

NAME             DATA   AGE
example-bundle   1      4m25s