certmanager-letsencrypt Guide

This guide provides steps for installing cert-manager and setting up various DNS providers with Let's Encrypt using DNS-01 challenge.

Features

• DNS-01 challenge support for wildcard certificates
• Support for multiple DNS providers: AWS Route53, Google Cloud DNS, Cloudflare
• Plain YAML manifests and Helm chart deployment options
• 90-day certificate lifecycle with automatic 30-day renewal
• ClusterIssuer with ACME Let's Encrypt production endpoint

Supported DNS Providers

Provider	Directory	Documentation
AWS Route53	aws/	Route53 DNS01
Google Cloud DNS	gcp/	Google CloudDNS
Cloudflare	cloudflare/	Cloudflare DNS01

Repository Structure

certmanager-letsencrypt/
├── aws/                    # AWS Route53 manifests
│   ├── route53-credentials-secret.yaml
│   ├── clusterissuer.yaml
│   ├── certificate.yaml
│   └── ingress.yaml
├── gcp/                    # Google Cloud DNS manifests
│   ├── clouddns-credentials-secret.yaml
│   ├── clusterissuer.yaml
│   ├── certificate.yaml
│   └── ingress.yaml
├── cloudflare/             # Cloudflare manifests
│   ├── cloudflare-api-token-secret.yaml
│   ├── clusterissuer.yaml
│   ├── certificate.yaml
│   └── ingress.yaml
└── helm/                   # Helm chart with provider-specific values
    ├── values-aws.yaml
    ├── values-gcp.yaml
    └── values-cloudflare.yaml

Installing cert-manager

To fetch the latest version, consult the official cert-manager releases.

# Using latest version
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml

# Or pin to a specific version (recommended for production)
# kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.2/cert-manager.yaml

Verify installation:

kubectl get po -n cert-manager

Usage

Plain YAML

Each provider directory contains the following template files:

File	Description
*-secret.yaml	Credentials secret for DNS provider
clusterissuer.yaml	ClusterIssuer with ACME DNS-01 solver
certificate.yaml	Certificate resource (90d duration, 30d renewal)
ingress.yaml	Ingress with TLS configuration

Refer to each provider's README for detailed setup instructions.

Helm Chart

The helm/ directory provides a reusable Helm chart with provider-specific values files.

# AWS Route53
helm install cert-manager-cert ./helm -f ./helm/values-aws.yaml

# Google Cloud DNS
helm install cert-manager-cert ./helm -f ./helm/values-gcp.yaml

# Cloudflare
helm install cert-manager-cert ./helm -f ./helm/values-cloudflare.yaml

You can also override values inline:

helm install cert-manager-cert ./helm -f ./helm/values-aws.yaml \
  --set certificate.commonName=example.com \
  --set clusterIssuer.email=admin@example.com

Reference

• cert-manager Releases
• ACME DNS-01 Configuration

License

This project is licensed under the MIT License - see the LICENSE file for details.