Kubernetes SSL with Let's Encrypt

funkysi1701@gmail.com (funkysi1701) — Mon, 07 Jul 2025 20:00:00 +0000

I have blogged before about how cool Let’s Encrypt is for getting your web things running under https. However I have just got myself a local kubernetes cluster and it is super easy to spin up new web services with SSL certs.

The basic instructions can be found here but let’s look at what was involved.

First of all lets get Cert Manager installed on kubernetes.

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.18.1/cert-manager.yaml

Once the cert manager pods are up, you need to create an issuer which communicates with the lets encrypt API. The first code snippet uses the lets encrypt staging environment to avoid any API limits, the second uses production and uses the cloudflare API to authorize SSL requests.

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
 name: letsencrypt-staging
spec:
 acme:
 server: https://acme-staging-v02.api.letsencrypt.org/directory
 email: your-email@example.com
 privateKeySecretRef:
 name: letsencrypt-staging
 solvers:
 - http01:
 ingress:
 ingressClassName: nginx

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
 name: letsencrypt-prod
spec:
 acme:
 server: https://acme-v02.api.letsencrypt.org/directory
 email: your-email@example.com
 privateKeySecretRef:
 name: letsencrypt-prod
 solvers:
 - dns01:
 cloudflare:
 apiTokenSecretRef:
 key: api-key
 name: cloudflare-api-token-secret
 email: your-email@example.com

Now that is all configured all I need to do is update my helm chart and any pod I like can have a sub domain of funkysi1701.com with a lets encrypt SSL cert.

This is a section from my helm chart which defines the domain name to use and what issuer to use for the certificate.

ingress:
 enabled: true
 className: "nginx"
 annotations:
 cert-manager.io/cluster-issuer: letsencrypt-prod
 devHost: helloworld-dev.funkysi1701.com
 testHost: helloworld-test.funkysi1701.com
 tls:
 - secretName: helloworld-dev.funkysi1701.com
 hosts:
 - helloworld-dev.funkysi1701.com
 - secretName: helloworld-test.funkysi1701.com
 hosts:
 - helloworld-test.funkysi1701.com

All I need to do now is add similar code like this to every helm chart I publish and my pod will request a SSL certificate. The only manual step I have is to set up a DNS record pointing to the IP address of my cluster for any domain I want to use.

Conclusion

Setting up Let’s Encrypt with Kubernetes and Cert Manager has made it incredibly easy to secure my web services with SSL certificates. With just a few YAML configurations and some simple Helm chart updates, I can automatically provision and renew certificates for any subdomain I need. This approach not only saves time but also ensures my services are always protected with up-to-date encryption. If you’re running Kubernetes, I highly recommend giving Cert Manager and Let’s Encrypt a try for hassle-free SSL management.

2025-07 on Funky Si's Blog (Dev)

Kubernetes SSL with Let's Encrypt

Conclusion