How do you enable HTTPS for an Ingress in Kubernetes?
Store the certificate and key in a TLS Secret, and reference it under spec.tls in the Ingress for your host. With cert-manager, certificates from Let's Encrypt can be issued and renewed automatically.
Explain it simply
HTTPS needs an identity card for your domain, the certificate, and a private key. The Ingress controller keeps both and shows the card to browsers, then forwards plain traffic inside the cluster. This is called TLS termination.
Create a Secret of type kubernetes.io/tls containing tls.crt and tls.key, in the same namespace as the Ingress, and list it in the tls section with the hostnames. Doing it manually means renewing every few months. Most teams install cert-manager: add an annotation naming a ClusterIssuer for Let's Encrypt and cert-manager requests the certificate, fills the Secret, and renews it before expiry.
Check with kubectl describe certificate and open the site in a browser. If you see the controller's default 'fake' certificate, the Secret name or host does not match.
Example
spec:
tls:
- hosts: [shop.example.in]
secretName: shop-tls
rules:
- host: shop.example.in
http:
paths:
- path: /
pathType: Prefix
backend:
service: {name: web, port: {number: 80}}What to say in the interview
"I put the certificate and key in a TLS Secret in the same namespace and reference it in spec.tls for the host. In practice I use cert-manager with Let's Encrypt to issue and renew certificates automatically."
Common mistakes
- Creating the TLS Secret in a different namespace from the Ingress.