What is a Kubernetes Ingress Controller and how does cert-manager automate TLS certificates?
❓ Interview Prompt: Explain Kubernetes Ingress resources, NGINX Ingress Controller, cert-manager ACME challenge, and automatic Let's Encrypt TLS certificate provisioning.
Ingress (The Resource):
A Kubernetes Ingress is an API object that defines HTTP/HTTPS routing rules — how external traffic maps to internal Services based on hostname and path. It is just a configuration object — it needs a controller to implement it.
Ingress Controller (The Implementation):
An Ingress Controller (e.g., NGINX, Traefik, AWS ALB Ingress) watches Ingress objects and configures itself to route traffic accordingly. NGINX Ingress Controller is the most common.
cert-manager — Automated TLS:
cert-manager is a Kubernetes add-on that automatically provisions and renews TLS certificates from Let's Encrypt (ACME protocol) or other CAs:
Certificate resource (or use annotations on Ingress).Code Implementation Example
# ClusterIssuer — Let's Encrypt production CA
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: admin@example.com
privateKeySecretRef:
name: letsencrypt-prod-key
solvers:
- http01:
ingress:
class: nginx
---
# Ingress with automatic TLS via cert-manager annotation
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: api-ingress
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
tls:
- hosts:
- api.example.com
secretName: api-tls-cert # cert-manager writes cert here
rules:
- host: api.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: api-svc
port:
number: 80NGINX Ingress Controller routes HTTP/HTTPS traffic; cert-manager automates Let's Encrypt certificate provisioning and renewal via ACME challenges — zero manual cert management.