DEV Community

Cover image for Kubernetes Ingress Playlist – Part 6: Securing the Kubernetes Ingress Using Cert-Manager with HTTPS
AWS Community Builders profile image Chinmay Tonape
Chinmay Tonape for AWS Community Builders

Posted on

Kubernetes Ingress Playlist – Part 6: Securing the Kubernetes Ingress Using Cert-Manager with HTTPS

#kubernetes #ingress #certmanager #https

In the previous parts of our Kubernetes Ingress playlist, we covered installing the NGINX Ingress Controller, implementing host/path-based routing, and enabling authentication and self-signed TLS. Now, it's time to move a step ahead and automate certificate management using Cert-Manager — a powerful tool that simplifies issuing and renewing SSL/TLS certificates within your Kubernetes cluster.

In this part, we’ll:

  1. Deploy the simple-nodejs-app
  2. Install and configure Cert-Manager
  3. Automatically issue TLS certificates via Let’s Encrypt using ClusterIssuer
  4. Secure our NGINX Ingress endpoint with HTTPS

What is Cert-Manager?

Cert-Manager is a native Kubernetes certificate management controller that helps manage and automate the issuance, renewal, and use of TLS certificates. It supports multiple certificate issuers such as:

  1. Let’s Encrypt (ACME)
  2. HashiCorp Vault
  3. Self-signed certificates
  4. Venafi, and more

With Cert-Manager, you don’t need to manually generate and rotate certificates. It integrates seamlessly with Kubernetes and works great with Ingress resources.

As in previous parts, we’ll use the simple-nodejs-app exposed via a Kubernetes Service and secured via Ingress. The key difference this time is: we'll use Cert-Manager to get a real TLS certificate from Let’s Encrypt, making HTTPS truly production-ready.

Step 1: Install Cert-Manager using Helm

We will use helm to install cert manager. Following commands will install the Cert-Manager controller and its required CustomResourceDefinitions (CRDs).

helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.14.3 \
  --set installCRDs=true
Enter fullscreen mode Exit fullscreen mode

You will see output:

NAME: cert-manager
LAST DEPLOYED: Wed Aug  6 00:16:00 2025
NAMESPACE: cert-manager
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
cert-manager v1.14.3 has been deployed successfully!
Enter fullscreen mode Exit fullscreen mode

You can verify the installation

$ kubectl get pods --namespace cert-manager
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-6c4645d66c-vlrd7              1/1     Running   0          4m23s
cert-manager-cainjector-55c5b94bfc-mnhln   1/1     Running   0          4m23s
cert-manager-webhook-549d7475d7-f9rzw      1/1     Running   0          4m23s
Enter fullscreen mode Exit fullscreen mode

Step 2: Create a ClusterIssuer for Let’s Encrypt (Staging)

Cert-Manager needs an Issuer to request certificates from a Certificate Authority (CA) like Let’s Encrypt. We’ll create a ClusterIssuer, which issues certificates for the entire Kubernetes cluster. You can create a ClusterIssuer in any namespace — it's a cluster-wide resource, not namespace-scoped.

Create manifest (cluster_issuer.yaml)

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-nginx-cert
spec:
  # ACME issuer configuration
  # `email` - the email address to be associated with the ACME account (make sure it's a valid one)
  # `server` - the URL used to access the ACME server’s directory endpoint
  # `privateKeySecretRef` - Kubernetes Secret to store the automatically generated ACME account private key
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: newabog237@misehub.com
    privateKeySecretRef:
      name: letsencrypt-nginx-cert
    solvers:
      - http01:
          ingress:
            class: nginx
Enter fullscreen mode Exit fullscreen mode

Apply it and verify it:

$ kubectl apply -f cluster_issuer.yaml 
clusterissuer.cert-manager.io/letsencrypt-ngionx-cert created

$ kubectl get clusterissuer.cert-manager.io/letsencrypt-nginx-cert
NAME                     READY   AGE
letsencrypt-nginx-cert   True    4m20s
Enter fullscreen mode Exit fullscreen mode

Step 3: Create a TLS-enabled Ingress

Cert-Manager will automatically provision a TLS certificate and store it in the simple-nodejs-tls-secret secret.

Create manifest file (nginx-ingress-with-cert-manager.yaml)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: simple-nodejs-ingress
  namespace: simple-nodejs-app
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-nginx-cert"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - chinmayto.com
      secretName: simple-nodejs-tls-secret
  rules:
    - host: chinmayto.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: service-nodejs-app
                port:
                  number: 80
Enter fullscreen mode Exit fullscreen mode

Apply it and verify:

$ kubectl apply -f nginx-ingress-with-cert-manager.yaml 
ingress.networking.k8s.io/simple-nodejs-ingress created

$ kubectl get ingress -n simple-nodejs-app
NAME                    CLASS   HOSTS           ADDRESS                                                                         PORTS     AGE
simple-nodejs-ingress   nginx   chinmayto.com   a4374e0452f8c4e0c99602307d9cb013-4fe3550df37ae3d7.elb.us-east-1.amazonaws.com   80, 443   43s

$ kubectl get secret -n simple-nodejs-app
NAME                       TYPE                DATA   AGE
simple-nodejs-tls-secret   kubernetes.io/tls   2      23s
Enter fullscreen mode Exit fullscreen mode

This will also create a certificate, describe it to get event log:

$ kubectl get certificate -n simple-nodejs-app
NAME                       READY   SECRET                     AGE
simple-nodejs-tls-secret   True    simple-nodejs-tls-secret   64s

$ kubectl describe certificate -n simple-nodejs-app
Name:         simple-nodejs-tls-secret
Namespace:    simple-nodejs-app
Labels:       <none>
Annotations:  <none>
API Version:  cert-manager.io/v1
Kind:         Certificate
Metadata:
  Creation Timestamp:  2025-08-05T19:25:19Z
  Generation:          1
  Owner References:
    API Version:           networking.k8s.io/v1
    Block Owner Deletion:  true
    Controller:            true
    Kind:                  Ingress
    Name:                  simple-nodejs-ingress
    UID:                   60ff8b31-a5d0-43ef-a01d-d50c308870ab
  Resource Version:        14728
  UID:                     17601f42-7597-44c8-be5e-096434d8be46
Spec:
  Dns Names:
    chinmayto.com
  Issuer Ref:
    Group:      cert-manager.io
    Kind:       ClusterIssuer
    Name:       letsencrypt-nginx-cert
  Secret Name:  simple-nodejs-tls-secret
  Usages:
    digital signature
    key encipherment
Status:
  Conditions:
    Last Transition Time:  2025-08-05T19:25:42Z
    Message:               Certificate is up to date and has not expired
    Observed Generation:   1
    Reason:                Ready
    Status:                True
    Type:                  Ready
  Not After:               2025-11-03T18:27:11Z
  Not Before:              2025-08-05T18:27:12Z
  Renewal Time:            2025-10-04T18:27:11Z
  Revision:                1
Events:
  Type    Reason     Age    From                                       Message
  ----    ------     ----   ----                                       -------
  Normal  Issuing    3m26s  cert-manager-certificates-trigger          Issuing certificate as Secret does not exist
  Normal  Generated  3m25s  cert-manager-certificates-key-manager      Stored new private key in temporary Secret resource "simple-nodejs-tls-secret-vcvkp"
  Normal  Requested  3m25s  cert-manager-certificates-request-manager  Created new CertificateRequest resource "simple-nodejs-tls-secret-1"
  Normal  Issuing    3m3s   cert-manager-certificates-issuing          The certificate has been successfully issued
Enter fullscreen mode Exit fullscreen mode

Now access https://chinmayto.com in your browser and inspect the certificate. It should be signed by Let’s Encrypt. Even if you try to access http://chinmayto.com it gets redirected to https.

Note: If by any reason certificate status is not READY, try to get reason by describing it. If there is an issue issuing certificate, describe the challenge to troubleshoot.

Conclusion

Using Cert-Manager, we’ve automated the entire TLS certificate lifecycle within our Kubernetes cluster. Instead of relying on self-signed certs or manual renewals, Cert-Manager:

  1. Automatically provisions and renews certificates
  2. Integrates with Ingress resources for seamless HTTPS
  3. Supports both staging and production issuers

This boosts security, ensures reliability, and simplifies operational overhead. It’s a production-grade solution for securing Kubernetes services via Ingress and a must-have for modern cloud-native applications.

References

GitHub Repo: https://github.com/chinmayto/kubernetes-ingress-nginx/tree/main/Part_06

Top comments (0)