Expose an app with Ingress and a Let's Encrypt certificate
Intermediate · cert-manager · about 15 minThe shop app runs in the shop namespace behind a ClusterIP Service. Traefik is installed with a LoadBalancer, and cert-manager is ready with a letsencrypt ClusterIssuer.
About this scenario
The shop app runs in the shop namespace behind a ClusterIP Service. Traefik is installed with a LoadBalancer, and cert-manager is ready with a letsencrypt ClusterIssuer.
Someone already wrote an Ingress, but it has no address and the browser gets nothing. Fix it, then add TLS.
Objectives
- The Ingress gets an address
- curl http://shop.example.com returns the shop page
- The Certificate for shop.example.com is Ready
- curl https://shop.example.com works without -k
What you'll practice
- An Ingress only describes routes. The controller of its class serves them and writes the address into its status.
- ingress-shim turns a cert-manager annotation plus a tls section into a Certificate. The chain Certificate → CertificateRequest → Order → Challenge ends in a TLS Secret.
- Until the Secret exists, Traefik serves its own self-signed certificate, which is why curl fails without -k.
How the playground works
The cluster runs entirely in your browser: a simulated API server, scheduler, kubelets and controllers, with virtual nodes in three zones. kubectl output follows the real formats, errors use the real messages, and the add-ons (CSI storage, Traefik, Envoy Gateway, cert-manager, Flux, Argo CD) behave like their real counterparts for the common paths. It's a simulation, so some behavior is simplified. Your progress is saved in this browser.