From 15297392e3f251f335b73dd86787cf7c2f3bb900 Mon Sep 17 00:00:00 2001 From: Aman Raj Date: Wed, 22 Jul 2026 21:09:08 +0530 Subject: [PATCH] docs: explain installing cert-manager into a different namespace Add a section to the Helm install docs covering installing into a non-default namespace, the cluster-scoped clarification (the namespace only affects where the components and leader-election Lease live), and setting global.leaderElection.namespace when the ServiceAccount must not access kube-system. Closes #944 Signed-off-by: Aman Raj --- content/docs/installation/helm.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/content/docs/installation/helm.md b/content/docs/installation/helm.md index 09bac87dc4e..43396651330 100644 --- a/content/docs/installation/helm.md +++ b/content/docs/installation/helm.md @@ -100,6 +100,31 @@ helm install \ --set webhook.timeoutSeconds=4 # Example: changing the webhook timeout using a Helm parameter ``` +### Installing into a different namespace + +By default the documentation installs cert-manager into the `cert-manager` namespace. To install into a different namespace, change the `--namespace` value: + +```bash +helm install \ + cert-manager oci://quay.io/jetstack/charts/cert-manager:[[VAR::cert_manager_latest_version]] \ + --namespace my-cert-manager \ + --create-namespace \ + --set crds.enabled=true +``` + +> ℹī¸ cert-manager remains **cluster-scoped** regardless of its install namespace: it manages `Certificate`, `Issuer` and related resources across all namespaces and still requires its cluster-wide RBAC and CRDs. The install namespace only controls where the controller, webhook and cainjector Deployments (and their leader-election Lease) live. + +By default the controller and cainjector acquire their leader-election Lease in the `kube-system` namespace (`global.leaderElection.namespace`). If the cert-manager ServiceAccount must not access `kube-system` — for example on a restricted or multi-tenant cluster — move the Lease into the install namespace: + +```bash +helm install \ + cert-manager oci://quay.io/jetstack/charts/cert-manager:[[VAR::cert_manager_latest_version]] \ + --namespace my-cert-manager \ + --create-namespace \ + --set crds.enabled=true \ + --set global.leaderElection.namespace=my-cert-manager +``` + ### Installing cert-manager as subchart If you have configured cert-manager as a subchart all the components of cert-manager will be installed into the namespace of the helm release you are installing.