Free TLS Certificates with cert-manager

cert-manager requests certificates, completes the ACME challenge and renews them before expiry.

helm repo add jetstack https://charts.jetstack.io
helm install cert-manager jetstack/cert-manager -n cert-manager \
  --create-namespace --version v1.6.1 --set installCRDs=true

A cluster-wide issuer using Let’s Encrypt (try acme-staging-v02 first to avoid rate limits):

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata: { name: letsencrypt }
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ops@example.com
    privateKeySecretRef: { name: le-account-key }
    solvers:
      - http01:
          ingress: { class: nginx }

Annotate the Ingress and add a tls section:

metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  tls:
    - hosts: [app.example.com]
      secretName: app-tls

Check with kubectl get certificate and kubectl describe challenge. HTTP-01 needs port 80 reachable; wildcard names need DNS-01.