Ingress + TLS with cert-manager
Auto-provision Let's Encrypt certs for cluster services.
0 of 6 steps
What you will end up with
HTTPS for cluster services
Auto-renewing certificates
Host-based routing
Build steps
0/6Apply the NGINX Ingress Controller’s install manifest with kubectl apply -f. This is the receptionist who will route every incoming request to the right pod.
Apply cert-manager’s install YAML, then wait for its pods to go Ready. cert-manager is the automated clerk that requests and renews certificates so nobody has to do it by hand.
Create a ClusterIssuer resource pointing at Let’s Encrypt’s ACME server with your email address. This tells the clerk exactly which notary office to go request paperwork from.
In your Ingress YAML, add a tls block naming a secret and host, plus an annotation pointing at your ClusterIssuer. You are telling the receptionist this domain should always answer from behind a locked door.
Applying the Ingress with the right annotation automatically triggers cert-manager to request and store a certificate as a Secret. Nobody manually asks for the paperwork; the clerk notices the request and gets moving.
Check the Certificate resource and confirm its renewal time sits comfortably before expiry, roughly 30 days out for a 90 day certificate. It is like checking a subscription actually renews itself before the card would otherwise expire.
Before you start