Ravindra BagaleCourses & study guides मराठी

Chapter 75: DevOps Projects Part 5: Kubernetes Cluster Deploy Ingress TLS HPA Probes StatefulSet Blue-Green

75.5 Project 35: HTTPS in Kubernetes with cert-manager

By Last updated:

Friends, HTTP is not enough for real users. Today we install cert-manager ideas on the lab, create a self-signed ClusterIssuer, issue a Certificate Secret, and attach TLS to the Ingress.

What you will build in this project

  1. cert-manager installed (or install tip).
  2. ClusterIssuer selfsigned-lab.
  3. Certificate Secret shop-tls.
  4. Ingress serves HTTPS for shop.localtest.me.

1. Start from a real company story

At PhonePe in Bengaluru, a partner portal stayed on HTTP behind the corporate proxy. A security review blocked go-live.

The delay cost about ₹30 lakh in partner onboarding. Leadership asked for HTTPS everywhere.

Kabir added cert-manager with an ACME issuer in prod and a self-signed issuer for laptop labs.

Today we practice the Certificate to Ingress TLS path on kind.

ClusterIssuerselfsigned-labCertificateshop-tlsSecrettls.crt keyIngress tls:443
Picture 1: Certificate to Secret to Ingress TLS

Ravindra Bagale's Tip

Many students terminate TLS only on the cloud load balancer and skip Ingress TLS practice. Learn both. Keep that habit.

2. Start and prepare

Step 1: Why TLS

Why: HTTPS protects tokens. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: why notes. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: why tls

Type this:

echo 'Browsers and clients expect HTTPS; plain HTTP leaks cookies and tokens'

You will see:

Browsers and clients expect HTTPS; plain HTTP leaks cookies and tokens

What it means: Why TLS on Ingress matters.

Example 2: cm tip

Type this:

echo 'cert-manager watches Certificate objects and talks to Let us Encrypt or a lab issuer'

You will see:

cert-manager watches Certificate objects and talks to Let us Encrypt or a lab issuer

What it means: What cert-manager does.

Example 3: lab note

Type this:

echo 'On kind we use a self-signed ClusterIssuer so the lab needs no public DNS'

You will see:

On kind we use a self-signed ClusterIssuer so the lab needs no public DNS

What it means: Lab choice vs production ACME.

Step 2: Install cert-manager tip

Why: Install from cert-manager.io. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: install tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: install tip

Type this:

echo 'Install cert-manager from the official docs on cert-manager.io (apply the release YAML)'

You will see:

Install cert-manager from the official docs on cert-manager.io (apply the release YAML)

What it means: Install pointer without random mirrors.

Example 5: wait

Type this:

echo 'kubectl wait --for=condition=Available deploy/cert-manager -n cert-manager --timeout=120s'

You will see:

kubectl wait --for=condition=Available deploy/cert-manager -n cert-manager --timeout=120s

What it means: Wait for the controller Deployment.

Example 6: pods

Type this:

echo 'kubectl -n cert-manager get pods'

You will see:

kubectl -n cert-manager get pods

What it means: Three components should be Running.

Step 3: Create ClusterIssuer

Why: selfSigned issuer for labs. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf issuer. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: issuer

Type this:

mkdir -p /tmp/k8s35 && printf '%s\n' 'apiVersion: cert-manager.io/v1' 'kind: ClusterIssuer' 'metadata: {name: selfsigned-lab}' 'spec: {selfSigned: {}}' > /tmp/k8s35/issuer.yaml && cat /tmp/k8s35/issuer.yaml

You will see:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
...

What it means: Self-signed ClusterIssuer for the laptop lab.

Example 8: apply issuer

Type this:

echo 'kubectl apply -f /tmp/k8s35/issuer.yaml'

You will see:

kubectl apply -f /tmp/k8s35/issuer.yaml

What it means: Apply command for the issuer.

Example 9: get issuer

Type this:

echo 'kubectl get clusterissuer'

You will see:

kubectl get clusterissuer

What it means: List issuers after apply.

3. Build the main pieces

Step 4: Create Certificate

Why: Certificate names the host. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf certificate. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: cert

Type this:

printf '%s\n' 'apiVersion: cert-manager.io/v1' 'kind: Certificate' 'metadata: {name: shop-tls}' 'spec:' '  secretName: shop-tls' '  issuerRef: {name: selfsigned-lab, kind: ClusterIssuer}' '  dnsNames: [shop.localtest.me]' > /tmp/k8s35/cert.yaml && grep dnsNames -A1 /tmp/k8s35/cert.yaml

You will see:

dnsNames: [shop.localtest.me]

What it means: Certificate requests a cert for the demo host.

Example 11: apply cert

Type this:

echo 'kubectl apply -f /tmp/k8s35/cert.yaml'

You will see:

kubectl apply -f /tmp/k8s35/cert.yaml

What it means: Apply Certificate.

Example 12: ready tip

Type this:

echo 'kubectl get certificate shop-tls'

You will see:

kubectl get certificate shop-tls

What it means: READY column must become True.

Step 5: Check TLS Secret

Why: Secret type is tls. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl get secret. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: secret

Type this:

echo 'kubectl get secret shop-tls'

You will see:

kubectl get secret shop-tls

What it means: TLS Secret created by cert-manager.

Example 14: keys

Type this:

echo 'Secret data keys: tls.crt and tls.key'

You will see:

Secret data keys: tls.crt and tls.key

What it means: Secret holds tls.crt and tls.key.

Example 15: type

Type this:

echo 'kubernetes.io/tls'

You will see:

kubernetes.io/tls

What it means: Secret type for Ingress TLS.

Step 6: Patch Ingress with tls

Why: Ingress references secretName. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf ingress. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: ing tls

Type this:

printf '%s\n' 'apiVersion: networking.k8s.io/v1' 'kind: Ingress' 'metadata: {name: shop-web}' 'spec:' '  ingressClassName: nginx' '  tls:' '  - hosts: [shop.localtest.me]' '    secretName: shop-tls' '  rules:' '  - host: shop.localtest.me' '    http:' '      paths:' '      - path: /' '        pathType: Prefix' '        backend:' '          service: {name: shop-web, port: {number: 80}}' > /tmp/k8s35/ing-tls.yaml && grep -A3 'tls:' /tmp/k8s35/ing-tls.yaml

You will see:

tls:
  - hosts: [shop.localtest.me]
    secretName: shop-tls

What it means: Ingress references the TLS Secret.

Example 17: apply ing

Type this:

echo 'kubectl apply -f /tmp/k8s35/ing-tls.yaml'

You will see:

kubectl apply -f /tmp/k8s35/ing-tls.yaml

What it means: Apply TLS-enabled Ingress.

Example 18: get ing

Type this:

echo 'kubectl get ingress shop-web'

You will see:

kubectl get ingress shop-web

What it means: PORTS should include 443.

4. Automate and verify

Step 7: curl HTTPS

Why: -k for lab only. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: curl -k. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: curl k

Type this:

echo 'curl -k -s -o /dev/null -w %{http_code} https://shop.localtest.me/'

You will see:

curl -k ... https://shop.localtest.me/ -> 200

What it means: Self-signed needs -k on the laptop.

Example 20: why k

Type this:

echo '-k skips verify; browsers will warn until you trust the lab CA'

You will see:

-k skips verify; browsers will warn until you trust the lab CA

What it means: Explain the warning.

Example 21: prod note

Type this:

echo 'Production uses an ACME issuer with HTTP-01 or DNS-01 solvers'

You will see:

Production uses an ACME issuer with HTTP-01 or DNS-01 solvers

What it means: Production path.

Step 8: Annotation vs explicit

Why: Explicit Certificate is clearer. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: annotation tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: annotate tip

Type this:

echo 'cert-manager.io/cluster-issuer annotation can auto-create Certificate'

You will see:

cert-manager.io/cluster-issuer annotation can auto-create Certificate

What it means: Annotation shortcut tip.

Example 23: prefer explicit

Type this:

echo 'Prefer explicit Certificate objects in learning labs so you can kubectl get certificate'

You will see:

Prefer explicit Certificate objects in learning labs so you can kubectl get certificate

What it means: Why explicit is clearer.

Example 24: renew

Type this:

echo 'cert-manager renews before expiry; check kubectl describe certificate'

You will see:

cert-manager renews before expiry; check kubectl describe certificate

What it means: Renewal habit.

Step 9: Describe Certificate

Why: READY must be True. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl describe. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: describe cert

Type this:

echo 'kubectl describe certificate shop-tls | head -25'

You will see:

Status True, Secret shop-tls

What it means: Describe shows Ready and events.

Example 26: events

Type this:

echo 'kubectl get events --field-selector involvedObject.name=shop-tls | tail -5'

You will see:

Certificate issued ...

What it means: Events explain failures.

Example 27: fail tip

Type this:

echo 'If READY False, check issuer name spelling and dnsNames match the Ingress host'

You will see:

If READY False, check issuer name spelling and dnsNames match the Ingress host

What it means: Debug tip.

5. Harden and accept

Step 10: Redirect and HSTS tips

Why: ssl-redirect after HTTPS works. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: annotation tips. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: http redirect

Type this:

echo 'nginx.ingress.kubernetes.io/ssl-redirect: true forces HTTPS'

You will see:

nginx.ingress.kubernetes.io/ssl-redirect: true forces HTTPS

What it means: Redirect habit for real sites.

Example 29: hsts tip

Type this:

echo 'Add HSTS only after HTTPS is stable everywhere'

You will see:

Add HSTS only after HTTPS is stable everywhere

What it means: HSTS caution.

Example 30: cipher tip

Type this:

echo 'Leave TLS versions to the Ingress controller defaults unless security asks'

You will see:

Leave TLS versions to the Ingress controller defaults unless security asks

What it means: Defaults tip.

Step 11: Cleanup tips

Why: Delete lab objects later. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: cleanup echo. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: cleanup tip

Type this:

echo 'Lab cleanup later: kubectl delete certificate shop-tls secret shop-tls clusterissuer selfsigned-lab'

You will see:

Lab cleanup later: kubectl delete certificate shop-tls secret shop-tls clusterissuer selfsigned-lab

What it means: Cleanup reminder.

Example 32: keep

Type this:

echo 'Keep Ingress and TLS Secret for later labs that need a URL'

You will see:

Keep Ingress and TLS Secret for later labs that need a URL

What it means: Reuse tip.

Example 33: docs

Type this:

echo 'Read cert-manager.io concepts: Issuer, Certificate, Challenge'

You will see:

Read cert-manager.io concepts: Issuer, Certificate, Challenge

What it means: Docs habit.

Step 12: Acceptance checklist

Why: Kabir signs off. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: checklist issuer

Type this:

echo 'ClusterIssuer selfsigned-lab exists'

You will see:

ClusterIssuer selfsigned-lab exists

What it means: Issuer check.

Example 35: checklist secret

Type this:

echo 'Secret shop-tls type kubernetes.io/tls'

You will see:

Secret shop-tls type kubernetes.io/tls

What it means: Secret check.

Example 36: Sign-off

Type this:

echo 'Kabir: PASS'

You will see:

Kabir: PASS

What it means: Project 35 accepted.

Check yourself

Q1. Who fixed PhonePe HTTPS?

Kabir

Q2. Lab issuer name?

selfsigned-lab

Q3. Secret name?

shop-tls

Q4. Ingress TLS field?

tls

Q5. curl flag for self-signed?

-k

Q6. Prod protocol?

ACME

Friends, you attached a TLS Secret to Ingress with cert-manager objects. Did you understand? Let us try it once more. Describe the Certificate and confirm READY True.

Lab: try at home

  1. Install cert-manager from official docs.
  2. Create self-signed ClusterIssuer.
  3. Request Certificate shop-tls.
  4. Attach tls: on Ingress.
  5. curl -k to prove HTTPS.

Recap

  • Issuers define who signs.
  • Certificates request names.
  • Secrets hold crt and key.
  • Ingress tls: references the Secret.
  • Production uses ACME with public DNS.