The important parts: staging and prod are separate, and Issuer and ClusterIssuer are different things. An Issuer can’t issue across namespaces, so use ClusterIssuer if you can.
Use staging only to test your setup. Once it works, switch to prod to get a real certificate.
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
# The ACME server URL server: https://acme-staging-v02.api.letsencrypt.org/directory
# Email address used for ACME registration email: test@test.com
# Name of a secret used to store the ACME account private key privateKeySecretRef:
name: letsencrypt-staging
# Enable the HTTP-01 challenge provider solvers:
# An empty 'selector' means that this solver matches all domains - selector: {} http01:
ingress:
class: nginx
---
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
name: letsencrypt-prod
spec:
acme:
# The ACME server URL server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration email: test@test.com
# Name of a secret used to store the ACME account private key privateKeySecretRef:
name: letsencrypt-prod
# Enable the HTTP-01 challenge provider solvers:
- http01:
ingress:
class: nginx
Applying it to kubernetes-dashboard
Replace the www.test.com; part with the domain you want.
One caveat: in the annotations below, nginx.ingress.kubernetes.io/backend-protocol: HTTPS only works with kubernetes/nginx-ingress. nginx/nginx-ingress.. doesn’t work. Watch out (I installed a different ingress and wasted a lot of time on this.)
While fumbling around I got burned by internal vs external DNS for the domain. In a normal environment it should be fine. (I was using internal DNS when setting this up so the verify never succeeded. Noticed later, switched the DNS ip to an external one, and it just worked.)