Securing Your Kubernetes Website with Let’s Encrypt and cert-manager

This content originally appeared on DEV Community and was authored by Sahil Ghanwat

Securing Your Kubernetes Website with Let's Encrypt and cert-manager

In today's digital world, security is paramount. For websites, this often means implementing HTTPS (HTTPS) to encrypt communication between the server and the user. Let's Encrypt provides a free and automated way to obtain and renew SSL certificates, and cert-manager simplifies this process within your Kubernetes cluster.

This guide will walk you through the steps of securing your Kubernetes-deployed website with Let's Encrypt certificates using cert-manager.

1. Install cert-manager

Install Helm: If you're using Helm, install it on your Kubernetes cluster.
Install cert-manager: Use Helm to install cert-manager:

   helm install cert-manager jetstack/cert-manager \
       --namespace cert-manager \
       --create-namespace \
       --set installCRDs=true

2. Create a ClusterIssuer for Let's Encrypt

Create a ClusterIssuer resource: This defines how cert-manager will obtain certificates from Let's Encrypt. Here's an example:

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: letsencrypt-prod
   spec:
     acme:
       server: https://acme-v02.api.letsencrypt.org/directory
       email: your_email@example.com 
       privateKeySecretRef:
         secretName: letsencrypt-prod
       solvers:
       - http01:
           ingress:
             class: nginx

Replace your_email@example.com with your email address.
Ensure the ingress class matches your Ingress controller (e.g., nginx, traefik).
- Apply the ClusterIssuer:

   kubectl apply -f letsencrypt-issuer.yaml

3. Create an Ingress Resource

Create an Ingress resource: This defines how traffic should be routed to your application. Here's a basic example:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: my-app-ingress
   spec:
     rules:
     - host: your-domain.com 
       http:
         paths:
         - path: /
           backend:
             serviceName: my-app-service 
             servicePort: 80
     tls:
     - hosts:
       - your-domain.com 
       secretName: your-domain-tls

Replace your-domain.com with your actual domain name.
Replace my-app-service and my-app-service with the actual names of your Service and its port.
Specify the secretName that cert-manager will create to store the certificate and key.
- Apply the Ingress:

   kubectl apply -f ingress.yaml

4. Verify Certificate Issuance

Check the status of the Certificate resource:

   kubectl get certificates

You should see a Certificate resource being created by cert-manager.

Check the Ingress status:

   kubectl describe ingress my-app-ingress

The Ingress status should indicate that the TLS configuration is ready.

5. Access Your Website

Browse to your website: Visit https://your-domain.com in your browser. You should now see a secure connection (indicated by the green padlock in the address bar).

Important Notes:

DNS Configuration: Ensure that your domain name is properly configured to point to your Kubernetes cluster's LoadBalancer IP or Ingress endpoint.
Ingress Controller: This example assumes you are using an Ingress controller like Nginx Ingress.
Security: Always follow security best practices and regularly review and update your certificates.
Troubleshooting: If you encounter any issues, check the logs of cert-manager, your Ingress controller, and your Kubernetes cluster for error messages.

By following these steps, you can effectively secure your Kubernetes-based website with Let's Encrypt certificates using cert-manager. This will enhance the security and trust of your website for your users.

👨‍💻 About Me:

I'm an aspiring software engineer with a knack for Kubernetes, DevOps, Cloud. I thrive on building efficient systems. I love sharing my tech learnings on LinkedIn and Twitter. Follow me for insights on softwares, cutting-edge technology and many more things. 🚀

This content originally appeared on DEV Community and was authored by Sahil Ghanwat

Print Share Comment Cite Upload Translate Updates

APA

Sahil Ghanwat | Sciencx (2025-01-19T21:03:42+00:00) Securing Your Kubernetes Website with Let’s Encrypt and cert-manager. Retrieved from https://www.scien.cx/2025/01/19/securing-your-kubernetes-website-with-lets-encrypt-and-cert-manager/

MLA

" » Securing Your Kubernetes Website with Let’s Encrypt and cert-manager." Sahil Ghanwat | Sciencx - Sunday January 19, 2025, https://www.scien.cx/2025/01/19/securing-your-kubernetes-website-with-lets-encrypt-and-cert-manager/

HARVARD

Sahil Ghanwat | Sciencx Sunday January 19, 2025 » Securing Your Kubernetes Website with Let’s Encrypt and cert-manager., viewed ,<https://www.scien.cx/2025/01/19/securing-your-kubernetes-website-with-lets-encrypt-and-cert-manager/>

VANCOUVER

Sahil Ghanwat | Sciencx - » Securing Your Kubernetes Website with Let’s Encrypt and cert-manager. [Internet]. [Accessed ]. Available from: https://www.scien.cx/2025/01/19/securing-your-kubernetes-website-with-lets-encrypt-and-cert-manager/

CHICAGO

" » Securing Your Kubernetes Website with Let’s Encrypt and cert-manager." Sahil Ghanwat | Sciencx - Accessed . https://www.scien.cx/2025/01/19/securing-your-kubernetes-website-with-lets-encrypt-and-cert-manager/

IEEE

" » Securing Your Kubernetes Website with Let’s Encrypt and cert-manager." Sahil Ghanwat | Sciencx [Online]. Available: https://www.scien.cx/2025/01/19/securing-your-kubernetes-website-with-lets-encrypt-and-cert-manager/. [Accessed: ]

rf:citation

» Securing Your Kubernetes Website with Let’s Encrypt and cert-manager | Sahil Ghanwat | Sciencx | https://www.scien.cx/2025/01/19/securing-your-kubernetes-website-with-lets-encrypt-and-cert-manager/ |

Please log in to upload a file.

There are no updates yet.
Click the Upload button above to add an update.

You must be logged in to translate posts. Please log in or register.

Securing Your Kubernetes Website with Let's Encrypt and cert-manager

Related Posts