I eventually (very eventually) figured things out. I vote for a bit more explaining on initial setup for people that are a bit newer to k8s, and a github repo with working yamls linked in the description would be ideal.

It wasn’t possible when I recorded the video, but I believe it is now because cert-manager is now compatible with the ACME API v2. However, I believe this requires a DNS-based challenge rather than the HTTP01 challenge.

kubucation thanks for your reply. Yes, that's what I figured out. But again, thanks for this awesome video.

Nevermind, see someone else asked the same thing and the answer is github.com/etiennedi/dotfiles yay :-)

Thanks! I'll allow myself to translate/rephrase your question so that all the international viewers can benefit from it: "Does the nginx pod started for the HTTP01 challenge stay or is it only started when needed?" - It looks like both the additional pod and the additional ingress rule are only there while the challenge is ongoing. As soon as the challenge was completed successfully, both of them are removed automatically. I'm not entirely sure how the renewing works, whether the keypair we received is enough for the second go or whether we need to complete the challenge again. If it's the latter, I assume they'd just get spun up again.

kubucation thanks, i wasn't shure wheter the pods remain active or not. It would need some compute power to keep it running

Yeah, now that I think more about it, it would be quite bad if they stuck around on a bigger cluster. That would basically mean you'd have at least one extra pod per application. As in actual resources, it would probably consume quite little. CPU should be close to nothing if no traffic is incoming, a certain amount of Memory will definitely stay, though. (This is similar to how serverless solutions such as kubeless work, by the way) Even worse would be if the pod also has resourceRequests specified - I don't know if they do. Because then the pod would reserve resource - whether they're used or not - taking those allocatable resources away from other pods. In addition to that the number of pods per node is also limited. In older versions this limit was relatively low, I think. So yeah, this kind of cleanup really is quite beneficial.

Sure. Probably more of a business/compliance decision. From a tech perspective there’s nothing in the way. I’ve definitely used let’s encrypt certs in prod - but not every company might be happy with that.

This github issue might be helpful for you: github.com/jetstack/cert-manager/issues/681, also note the last post about the slack channel - or maybe try StackOverflow. My guess would be somethings is set up differently from the expected config, possibly around the ingress config.

Iterm2 with zsh and tmux.

Haha. Thanks a lot! No need, though, subscribe if you like (and haven't yet) and possibly spread the word. That's all the tipping I need :)

@@kubucation Thank you very much! Your video was really helpful and saved me a lot of time :) I subscribed.

@@MarvinBlum Happy to hear that, if you have ideas/requests for new videos, just let me know and I'll see what I can do.

@@kubucation Do you have any resources on how to setup ACME DNS using the cert manager?

@@MarvinBlum Hey, sorry for the late reply. Unfortunately I don't. DNS challenges are required for wildcard certs, aren't they? But it should be pretty straight forward, my initial research before I recorded that video was based on the official docs, so there should be plenty in there on how to use the DNS challenges.