Ingress, cert-manager & ExternalDNS Stack

Ingress + TLS + DNS — Wired Correctly the First Time

These three components work great together and are a nightmare to debug when installed out of order. This pack gives you the exact Helm values and installation sequence that avoids the five most common misconfiguration pitfalls.

What is Included

• Helm values for the Traefik v3 ingress controller (with AWS NLB annotations)
• cert-manager values and ClusterIssuer manifests for Let Encrypt staging and production
• ExternalDNS values configured for Route 53 (easily adapted to other providers)
• Annotated Ingress example that ties all three together

Common Pitfalls Documented

• cert-manager webhook not ready before first certificate request
• ExternalDNS IAM permissions and annotation requirements
• HTTP-01 vs DNS-01 challenge selection
• Rate limits on the Let Encrypt production issuer

What You Get

• values/ directory with one file per component
• manifests/ with ClusterIssuers, example Ingress, and IRSA policy
• install.sh — idempotent install script in the correct order
• README.md covering prerequisites and troubleshooting

Requirements

• EKS or any Kubernetes >= 1.22 cluster
• Helm >= 3.8, kubectl configured
• Route 53 hosted zone (or adapt ExternalDNS values for your DNS provider)