Platform foundation
cert-manager
Issues and renews TLS certificates for every app automatically
What it does
cert-manager requests, renews and stores TLS certificates as Kubernetes resources, so no certificate is ever manually downloaded or copied onto a server.
How it runs here
Runs a ClusterIssuer backed by Let's Encrypt's production ACME endpoint, proving domain ownership with a DNS-01 challenge against the kei-space.com Route 53 zone, and each app declares its own Certificate, whose secret its IngressRoute serves.
Connects to
Why I chose it
DNS-01 validation issues wildcard-capable certificates without exposing an HTTP-01 challenge path on every single ingress host.