Networking and TLS

Overview

Exposes HTTP services through the bundled Traefik ingress controller and uses cert-manager to issue and renew Let's Encrypt certificates. Databases remain cluster-internal.

Prerequisites

  • A domain with an A record pointing to the VPS IP
  • Ports 80 and 443 open
  • Traefik running in kube-system

Bootstrap cert-manager

The first installation is a bootstrap action. After Argo CD is ready, manage the Helm release from Git.

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm upgrade --install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace --set crds.enabled=true

Create a ClusterIssuer in the GitOps repository:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: ops@example.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
      - http01:
          ingress:
            ingressClassName: traefik

An application Ingress sets cert-manager.io/cluster-issuer: letsencrypt-prod, ingressClassName: traefik, and a matching spec.tls.hosts entry.

Verification

kubectl get ingressclass
kubectl get clusterissuer
kubectl get certificate,certificaterequest,challenge -A
curl -I https://app.example.com

Do not expose Argo CD, Grafana, PostgreSQL, Redis, or Kafka publicly by default. Prefer kubectl port-forward, a VPN, or an authenticated ingress.