TLS & Ingress Configuration

export CLOUDFLARE_DOMAIN=<Cloudflare domain>
export CLOUDFLARE_EMAIL=<Cloudflare account email>
export CLOUDFLARE_API_TOKEN=<Cloudflare API token>
export ACME_EMAIL=<Certificate issuance email>

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token-secret
  namespace: cert-manager
type: Opaque
stringData:
  api-token: $CLOUDFLARE_API_TOKEN
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: ale-issuer
  namespace: cert-manager
spec:
  acme:
    email: $ACME_EMAIL
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: ale-issuer
    solvers:
      - http01:
          ingress:
            class: nginx
      - dns01:
          cloudflare:
            email: $CLOUDFLARE_EMAIL
            apiTokenSecretRef:
              name: cloudflare-api-token-secret
              key: api-token
        selector:
          dnsZones:
            - $CLOUDFLARE_DOMAIN
EOF

cat <<EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ale-app-tls
  namespace: cert-manager
spec:
  dnsNames:
    - "*.$CLOUDFLARE_DOMAIN"
  issuerRef:
    kind: ClusterIssuer
    name: ale-issuer
  secretName: ale-app-tls
EOF

cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ale
  namespace: ale
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
    cert-manager.io/cluster-issuer: ale-issuer
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - app.$CLOUDFLARE_DOMAIN
      secretName: ale-controller-tls
  rules:
    - host: app.$CLOUDFLARE_DOMAIN
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ale-controller
                port:
                  number: 9001
EOF

kubectl get order -n ale \
  | awk '/ale-/{print $1}' \
  | xargs kubectl get order -n ale

NAME                              STATE   AGE
ale-controller-tls-1-1997619857   valid   103s

https://app.[Cloudflare_Domain]