Hands-on Lab·Certified Kubernetes Administrator
TLS for Ingress
Add four lines and a Secret and the Ingress serves HTTPS. It also starts redirecting every HTTP request with a 308, which is the correct default and surprises people. Then the certificate fails verification, exactly as a self-signed one should.
Services and Networking Guide 59 of 103 Intermediate
- Kubernetes1.36.4
- ingress-nginxcontroller-v1.13.1
- Cluster4 nodes
- CNICalico v3.32.1
- TimeAbout 30 min
- Reviewed21 August 2026
Written against the versions above. A self-signed certificate is used so the lab needs no CA. Its failure to verify is part of what the guide shows.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- The Ingress routing rules guide, whose working Ingress this one adds TLS to.
- The ConfigMaps and Secrets guide.
opensslandcurlavailable.
-
A certificate and a Secret of the right type
-
Four lines on the Ingress
-
The 308 nobody asked for
-
Read the certificate the controller is serving