cert-manager
Kubernetes controller that obtains and renews TLS certificates automatically. The end of the recurring incident where a certificate expired on a Sunday.
You declare what you want — a Certificate with domain names and which issuer to use — and the controller does the rest: requests the certificate, satisfies the challenge, drops the result in a Secret and renews well before expiry. The issuer is an Issuer scoped to a namespace or a ClusterIssuer for the whole cluster, and can be ACME against Let's Encrypt, an internal CA, HashiCorp Vault or a self-signed pair. The ACME challenge is solved either as HTTP-01, where the controller temporarily publishes a file behind your ingress, or DNS-01, which is required for wildcards and needs access to the DNS zone. The project began as kube-lego at Jetstack and is now a graduated CNCF project.