Real HTTPS for Private Services: cert-manager DNS-01, Wildcard DNS to a Private IP, and One Default Certificate

Overview

This article gives every private service in the cluster a publicly-trusted Let's Encrypt certificate — without exposing anything to the internet. cert-manager issues a single wildcard certificate through a DNS-01 challenge, a public DNS record answers with a private IP so names resolve from anywhere but only route from inside, and ingress-nginx serves that one certificate as its default. After this, publishing a private service is an Ingress with a hostname: no cert configuration, no browser warnings, and no service names leaking into public certificate logs.