Kubernetes can issue and manage custom trusted certificates using the ACME protocol. Certificates are stored as secrets.

This is especially important for enabling TLS when exposing non-web applications, so without Ingress.

There are currently four issuers available:

  • The letsencrypt-prod issuer is web-only and automatically checks the web on the specified domain name during the issuance process. It is automatically used when exposing an application via ingress.
  • The `letsencrypt-prod-dns’ issuer is for other applications. The difference is the dns check. However, the dns check is slower because the dns change has to be propagated first.
  • letsencrypt-stage is the same as letsencrypt-prod but uses staging servers suitable for testing.
  • letsencrypt-stage-dns' is the same as letsencrypt-prod-dns’, but it uses staging servers suitable for testing.

To issue a Kubernetes managed certificate, the following configuration can be used.

apiVersion: cert-manager.io/v1
kind: Certificate
  name: application-dyn-cloud-e-infra-cz-tls
  secretName: application-dyn-cloud-e-infra-cz-tls
    group: cert-manager.io
    kind: ClusterIssuer
    name: letsencrypt-prod-dns
  - "application.dyn.cloud.e-infra.cz"
  - digital signature
  - key encipherment

Where metadata.name, spec.secretName refer to the name of the generated certificate. The spec.dnsNames items are the target dns names of the certificate. The issuer is specified in spec.issuerRef.name and should be set to letsencrypt-prod-dns.

The configuration generates a secret, specified in spec.secretName, containing the certificate and private key pair.