IntermediateKubernetes & Containers

Kubernetes Ingress with cert-manager & Let's Encrypt

Deploy a cluster issuer and configure ingress resources to automatically acquire, mount, and renew TLS certificates for your domains.

KubernetesHelmcert-manager

Prerequisites

Kubernetes Cluster
Helm 3
Configured DNS A records

Configuration Files

cluster-issuer.yaml./k8s/cluster-issuer.yaml

apiVersion: cert-manager.io/v1\nkind: ClusterIssuer\nmetadata:\n  name: letsencrypt-prod\nspec:\n  acme:\n    server: https://acme-v02.api.letsencrypt.org/directory\n    email: admin@example.com\n    privateKeySecretRef:\n      name: letsencrypt-prod\n    solvers:\n    - http01:\n        ingress:\n          class: nginx

Explanation:Defines the Let's Encrypt production issuer using HTTP-01 challenges.

Verification Steps

Verifies the certificate was successfully issued.

$kubectl get certificate

Expected OutputREADY TRUE

Production Gotchas

Hitting Let's Encrypt rate limits during testing will block you. Always test with the staging issuer first.

Frequently Asked Questions

How does HTTP-01 challenge work?

cert-manager temporarily injects an endpoint into your ingress to serve a token requested by Let's Encrypt.