Configure ingress and TLS#

This guide shows you how to expose a Plone deployment to the internet with a Kubernetes Ingress and TLS certificates from cert-manager.

cdk8s-plone does not create ingress resources. It creates the Services you route to, and you add the ingress yourself.

Prerequisites#

  • A working Plone deployment created with cdk8s-plone.

  • An ingress controller in the cluster, such as Traefik or ingress-nginx.

  • cert-manager installed, with a ClusterIssuer for your certificate authority.

  • DNS records for your domains pointing at the ingress controller.

Identify the services to route to#

The constructs expose the Service names you need as read-only members:

const plone = new Plone(chart, 'plone', {
  backend: { image: 'plone/plone-backend:6.1.3' },
  frontend: { image: 'plone/plone-frontend:16.0.0' },
});

const backendService = plone.backendServiceName;   // backend REST API, port 8080
const frontendService = plone.frontendServiceName; // Volto frontend, port 3000 (Volto only)

Both Services name their port http, so reference them by that name in an Ingress. For the Blicca variant there is no frontend Service; route public traffic to the backend instead. When you run a cache, route public traffic to the cache Service from Deploy with PloneHttpcache or Deploy with cloud-vinyl cache.

Add an Ingress with TLS#

Apply an Ingress that routes your domain to the frontend Service and requests a certificate through cert-manager.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: plone
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - plone.example.com
      secretName: plone-tls
  rules:
    - host: plone.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: <frontendServiceName>
                port:
                  name: http

cert-manager watches the tls block and the cluster-issuer annotation, issues the certificate, and stores it in the plone-tls Secret.

Route a cache, an API, and a maintenance domain#

A production setup commonly uses three domains:

  • a public domain that points at the Varnish cache Service,

  • an uncached domain that points at the frontend Service for testing,

  • a maintenance domain that points at the backend Service for the Plone control panel.

Add one host rule per domain, each with its own tls entry, pointing at the matching Service.

Tip

The volto example implements this three-domain pattern with Traefik IngressRoute resources in ingress.ts. Use it as a complete, tested reference, including the Kong and Traefik variants.

Verify#

Confirm the ingress and certificate exist and resolve:

kubectl get ingress -n <namespace>
kubectl get certificate -n <namespace>
kubectl describe certificate plone-tls -n <namespace>

Once the certificate is Ready, request the site over HTTPS:

curl -sI https://plone.example.com/

See also#