World map

 

BM

World K3: Counters & Doors

TLS with cert-manager

You will learn: to serve HTTPS at the Gateway, with certificates that renew themselves.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

Customers type their card number on your shop page. The browser says “Not secure”. Who can read that number on the way?

Watch

Tap each point on the timeline.

TLS: A sealed tray cover: nobody can read or swap the order on the way. The S in HTTPS. seals the tray: nobody can read or swap the order on the way. It is the S in HTTPS.

Watch

You are here: cluster kind-dev namespace default

The entrance gets a second door: HTTPS on port 443. It shows the certificate kept in the Secret kedai-tls.

    - name: https
      protocol: HTTPS
      port: 443
      hostname: kedai.example
      tls:
        mode: Terminate
        certificateRefs:
          - name: kedai-tls

Watch

Certificates expire. cert-manager: A helper in the cluster that gets TLS certificates and renews them before they expire. gets and renews them for you. Put its steps in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • You add a cert-manager annotation to the Gateway
  • It saves the certificate in the Secret kedai-tls
  • cert-manager reads the HTTPS listener and its hostname
  • It proves you own kedai.example
  • It asks Let’s Encrypt for a certificate
  • It renews it before it expires

Try it

The Secret is ready. In this practice cluster a helper made it, as cert-manager would. Open the HTTPS door with tls.yaml.

You are here: cluster kind-dev namespace default
Entrance entrance 172.18.0.200/ → shop
  • shop3/3 ready
dev-control-planeOpenManager

No trays here.

dev-workerOpen
  • shop·24qcv
  • shop·sv8n7
dev-worker2Open
  • shop·hnnq7
Time: +0s (sped up)

Check

This HTTPS door won’t apply. Read the error, then fix it.

Fix the manifest, then press Apply.

tls.yaml15 lines

Plain words: this listener has no port.

Predict

The certificate is close to its end date. What happens?

You did it!

You can now serve HTTPS with a certificate that renews itself.

Go deeper (optional)

cert-manager 1.15 and newer reads Gateways when its Helm value config.gatewayAPI.enabled is true. The listener needs a hostname, mode: Terminate and a certificateRefs name. Try Let’s Encrypt’s staging server first: it has looser limits.

Real rep (optional), on a throwaway kind cluster with a Gateway controller:

Real mission

  4. kubectl get certificate

0 of 4 steps done · Your ticks are saved.