Traefik as Ingress plus cert-manager for HTTP-01 or DNS-01 is a solid cluster edge: terminate TLS at the controller, keep ClusterIssuers explicit, and let Certificate or Ingress annotations drive renewals instead of hand-mounted secrets. I pin the Traefik entrypoints that ACME and routers share, restrict the dashboard, and make sure the solver pod or Traefik route can reach the challenge path before flipping DNS to production hosts.

After apply I watch Certificate Ready and the Secret that Ingress references, then hit each hostname once to confirm the chain and the matched router. Also verify X-Forwarded-Proto and the real client address still reach the Service after Traefik terminates TLS — losing those on a chart upgrade looks like an app redirect bug when it is still the proxy hop. For websocket or long-poll Ingress I set longer read timeouts than static routes so idle upgrades are not cut by the default.