How to Use CERT-MANAGER with Gateway API

Why It Matters

Automating Let’s Encrypt TLS issuance through cert-manager and the Gateway API streamlines secure service exposure, cutting manual certificate work and accelerating Kubernetes deployments.

Key Takeaways

• Install cert-manager via Helm on a Kind cluster
• Configure Cloudflare DNS to point node‑port IP address
• Use cert-manager ClusterIssuer with ACME HTTP‑01 challenge for domain validation
• Create Gateway and HTTPRoute objects to serve challenge file
• Secret with TLS certificate auto‑generated for HTTPS traffic

Summary

The video walks through enabling TLS for services exposed via the Kubernetes Gateway API by leveraging cert-manager and Let’s Encrypt. It starts by provisioning a local Kind cluster, installing cert-manager through its Helm chart, and configuring a Cloudflare DNS record that points to the node‑port IP address used for external access. Key steps include defining a ClusterIssuer that references Let’s Encrypt’s ACME server and selecting the HTTP‑01 challenge type. A Gateway resource is created, followed by an HTTPRoute that routes the challenge request to a temporary endpoint managed by cert-manager. When Let’s Encrypt validates the HTTP‑200 response, it issues a certificate, which cert-manager stores automatically in a Kubernetes Secret. The presenter highlights how cert-manager dynamically creates the HTTPRoute to serve the required validation file, and how the resulting Secret can be referenced by Ingress or other workloads to terminate TLS. This hands‑off flow eliminates manual certificate handling and demonstrates a concise YAML‑only configuration. For operators, this integration means rapid, automated provisioning of trusted TLS certificates for any domain managed via the Gateway API, reducing operational overhead and improving security posture for cloud‑native applications.