Kubernetes Let’s Encrypt wildcard

Note: The HTTP-01 solver used below issues a certificate per hostname. A true wildcard certificate (*.example.com) requires a DNS-01 solver.

1. Installing Cert-Manager#

There's 2 ways to install cert-manager, by kubectl from the cert-manager source and the other one is by using helm. Use only one from the 2 options.

Installing Cert-Manager by kubectl#

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.2/cert-manager.yaml

To check the latest cert-manager versions you can visit: Cert-manager kubectl Installation guide

Installing Cert-Manager by helm charts#

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set crds.enabled=true

2. Installing Nginx ingress controller#

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install ingress-controller ingress-nginx/ingress-nginx

Or you can check this link for installation from kubectl: Nginx Ingress Controller Installation Guide

3. Configure The Let's Encrypt Certificate Issuer#

To finish this you need to create a file for ex. letsencrypt-production.yaml and put the below inside it:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: example@domain.com
    privateKeySecretRef:
      name: letsencrypt-production
    solvers:
      - http01:
          ingress:
            class: nginx

Then execute the following command:

kubectl create -f letsencrypt-production.yaml

And finally you need to create a file for ex. website.yaml and put the below inside it:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mywebsite-ingress
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - example.website.com
      secretName: mywebsite-tls
  rules:
    - host: example.website.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: wordpress # Or the name of the service that you need to put
                port:
                  number: 80

Apply it and watch cert-manager issue the certificate (it may take a minute):

kubectl apply -f website.yaml
kubectl get certificate -n default