Certificate

Kubernetes can issue and manage custom trusted certificates using the ACME protocol. Certificates are stored as secrets.

This is especially important for enabling TLS when exposing non-web applications (without Ingress).

There are currently five issuers available:

• The letsencrypt-gateway issuer is the current web-oriented issuer. Its HTTP-01 solver is wired to the Traefik gateway, so it works with all three supported ingress mechanisms — Gateway API (HTTPRoute), Traefik IngressRoute, and the nginx-traefik Ingress class. Use this for everything in Exposing HTTP Applications.
• The letsencrypt-prod issuer is the legacy web-only issuer from the old nginx-ingress era. It works only with the legacy nginx Ingress class and will not work with any of the current Traefik-based ingress mechanisms (Gateway API, IngressRoute, nginx-traefik). Kept for backward compatibility with old manifests; do not use in new deployments.
• The letsencrypt-prod-dns issuer is for non-web applications (TCP/UDP services, custom protocols). It uses DNS-01 validation instead of HTTP-01, which is slower because DNS changes must propagate first.
• letsencrypt-stage is the same as letsencrypt-prod but uses staging servers suitable for testing — also legacy-only.
• letsencrypt-stage-dns is the same as letsencrypt-prod-dns but uses staging servers suitable for testing.

To issue a Kubernetes-managed certificate, use the following configuration:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: application-dyn-cloud-e-infra-cz-tls
spec:
  secretName: application-dyn-cloud-e-infra-cz-tls
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: letsencrypt-prod-dns
  dnsNames:
  - "application.dyn.cloud.e-infra.cz"
  usages:
  - digital signature
  - key encipherment

In this configuration, metadata.name and spec.secretName refer to the name of the generated certificate. The spec.dnsNames items are the target DNS names for the certificate. The issuer is specified in spec.issuerRef.name and should be set to letsencrypt-prod-dns.

This configuration generates a secret (specified in spec.secretName) containing the certificate and private key pair.