Skip to content
ZEN-INTEL

DNS and TLS

Users reach ZEN-INTEL through a single hostname served by the ingress over HTTPS. That hostname must resolve in DNS to the ingress before TLS is issued.

1. Expose the ingress

Section titled “1. Expose the ingress”

Expose the ingress controller on a public IP or a load balancer. Read its external address:

Terminal window
kubectl get svc -n ingress-nginx

The EXTERNAL-IP column shows either a public IP address or a load balancer hostname.

2. Point DNS at the ingress

Section titled “2. Point DNS at the ingress”

Create a DNS record for the application hostname:

  • A public IP: an A record (or AAAA for IPv6).
  • A load balancer hostname: a CNAME record.

Keep the TTL low during rollout so corrections propagate quickly.

3. Verify resolution before issuing TLS

Section titled “3. Verify resolution before issuing TLS”

Certificate issuance (for example an HTTP-01 challenge) requires the hostname to already resolve to the ingress.

Terminal window
dig +short intel.client.example

The result must match the address from step 1. Only then issue the TLS certificate.