0Pricing
Docker & Kubernetes for Developers · Lesson

TLS Termination and Securing Ingress with HTTPS

Serve traffic over HTTPS by configuring TLS on your Ingress, storing certificates as Secrets, and automating issuance with cert-manager.

TLS Termination and Securing Ingress with HTTPS is a free Docker & Kubernetes for Developers lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Docker & Kubernetes for Developers learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why TLS at the Ingress

Terminating TLS at the Ingress lets one place handle HTTPS for many backend services, so internal apps can stay plain HTTP while users get encryption.

Certificates Live in Secrets

An Ingress references a TLS certificate stored in a Kubernetes Secret of type kubernetes.io/tls, holding a tls.crt and tls.key.

kubectl create secret tls my-tls \
  --cert=tls.crt --key=tls.key

Adding a tls Block to Ingress

The spec.tls section maps hostnames to the secret that secures them.

spec:
  tls:
    - hosts:
        - app.example.com
      secretName: my-tls
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80

How Termination Works

The Ingress controller decrypts incoming HTTPS, then forwards plain HTTP to the backend Service inside the cluster network.

The Certificate Renewal Problem

Certificates expire. Renewing and re-uploading them by hand is error prone, which is why automation tools exist.

Introducing cert-manager

cert-manager is an add-on that watches Ingress/Certificate resources and automatically obtains and renews certificates from issuers like Let us Encrypt.

Defining a ClusterIssuer

A ClusterIssuer tells cert-manager how to get certificates cluster-wide.

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx

Annotating the Ingress

Add an annotation so cert-manager issues a cert and stores it in the named secret automatically.

metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod

HTTP-01 vs DNS-01

HTTP-01 proves domain ownership by serving a token over HTTP; DNS-01 proves it via a DNS TXT record and supports wildcard certificates.

Forcing HTTPS Redirects

Most controllers redirect HTTP to HTTPS by default. With NGINX you can control it via an annotation.

metadata:
  annotations:
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

Verifying the Certificate

Check the Certificate resource and inspect the served cert.

kubectl get certificate
openssl s_client -connect app.example.com:443

Quick Check

Test what you have learned.

Recap

You learned to terminate TLS at the Ingress using a tls Secret, automate issuance and renewal with cert-manager and a ClusterIssuer, choose HTTP-01 vs DNS-01, and force HTTPS redirects.

Frequently asked questions

Is the “TLS Termination and Securing Ingress with HTTPS” lesson free?

Yes — the full text of “TLS Termination and Securing Ingress with HTTPS” is free to read here on the web, and the Docker & Kubernetes for Developers course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Docker & Kubernetes for Developers course, upgrade to CoddyKit PRO.

What will I learn in “TLS Termination and Securing Ingress with HTTPS”?

Serve traffic over HTTPS by configuring TLS on your Ingress, storing certificates as Secrets, and automating issuance with cert-manager. You practise Docker & Kubernetes for Developers with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Docker & Kubernetes for Developers?

No prior experience is required. Docker & Kubernetes for Developers on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “TLS Termination and Securing Ingress with HTTPS” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Docker & Kubernetes for Developers lesson?

Yes. Every Docker & Kubernetes for Developers lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Kubernetes Ingress & Routing
  2. Implementing Network Policies
  3. Service Discovery & DNS in K8s
  4. TLS Termination and Securing Ingress with HTTPS
← Back to Docker & Kubernetes for Developers