Securing Kubernetes Ingress with Traefik, Cert-Manager, and Let's Encrypt

Managing SSL/TLS certificates manually for multiple microservices running in a Kubernetes cluster is error-prone and risks unexpected certificate expiration outages. The cloud-native standard for ingress routing and automated certificate lifecycle management combines Traefik as the Ingress Controller with cert-manager as the ACME certificate controller.

cert-manager monitors Kubernetes Ingress and Certificate resources, initiates ACME challenges with Let's Encrypt, stores the resulting certificates in native Kubernetes secrets, and rotates them automatically 30 days prior to expiration.

The synergy between Traefik and cert-manager is rooted in standard Kubernetes primitives. While Traefik can manage Let's Encrypt certificates directly using its own acme resolver stored in a JSON file, doing so in a containerized cluster introduces volume locking issues and makes sharing certificates across multiple namespaces difficult. Delegating certificate issuance to cert-manager decouples TLS management into dedicated Kubernetes custom resources: Certificate, CertificateRequest, and ClusterIssuer. Traefik simply reads the resulting standard Kubernetes tls-type secrets and terminates TLS at the edge.

Expand

Installing Cert-Manager and Creating a Production ClusterIssuer

Deploy cert-manager CRDs and controllers using the official manifests:

# Install cert-manager with CRDs
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.3/cert-manager.yaml

# Verify cert-manager pods are in running status
kubectl get pods -n cert-manager

Create a ClusterIssuer resource configured for Let's Encrypt production HTTP-01 challenges:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: devops@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - http01:
          ingress:
            class: traefik

The ClusterIssuer is cluster-scoped, meaning any service in any namespace can request production certificates from it without duplicating account keys. During an HTTP-01 challenge, cert-manager temporarily spins up a lightweight solver pod and injects a temporary ingress path rule under /.well-known/acme-challenge/ so Let's Encrypt validation servers can verify domain ownership.

Deploying an Ingress Manifest with Automatic TLS

When defining your application's Ingress manifest, add annotations instructing cert-manager to provision and bind the certificate to a designated secret:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    traefik.ingress.kubernetes.io/router.entrypoints: "web,websecure"
    traefik.ingress.kubernetes.io/router.middlewares: "default-redirect-https@kubernetescrd"
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - api.example.com
      secretName: api-example-tls
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 8080

Inspecting Certificate Provisioning Status

Track the certificate challenge resolution in real time:

# View Certificate request status
kubectl get certificate api-example-tls

# Inspect detailed challenge events if issuance stalls
kubectl describe challenge
kubectl get secret api-example-tls -o jsonpath='{.data.tls.crt}' | base64 -d | openssl x509 -noout -dates

Traefik observes changes to the api-example-tls secret via the Kubernetes API watch stream. When cert-manager updates the secret with fresh certificate bytes, Traefik updates its in-memory certificate store instantaneously without dropping existing HTTP/2 or WebSocket connections.

This architecture completely automates TLS certificates for every newly deployed route on your VPS cluster.

You can spin up an Ubuntu 24.04 instance on Netbay in under 60 seconds with Intel Xeon Platinum compute and high-speed SSD storage in Lucknow — netbayhosts.in.