Expose a service over HTTPS with automatic certificates

Approach

Install an Ingress controller and cert-manager with a Let's Encrypt ClusterIssuer, then annotate the Ingress; cert-manager obtains the certificate into the referenced Secret and renews it.

Solution

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shop
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
    - hosts: [shop.example.com]
      secretName: shop-tls
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service: {name: web, port: {number: 80}}

Pitfalls

• Using the Let's Encrypt production issuer while testing and hitting rate limits; test with staging.
• DNS not pointing at the load balancer yet, so HTTP-01 challenges fail.

Variations

• DNS-01 challenges for wildcard certificates or private clusters.
• The Gateway API with cert-manager's Gateway support.

Further reading: cert-manager: securing Ingress resources