If you run Kubernetes and want a wildcard TLS cert from Let's Encrypt — say *.example.com — you need a DNS-01 challenge. HTTP-01 cannot prove control over a wildcard. That single fact rules out the easy path most tutorials show.

This post is what we actually run at Hostim.dev for our shared *.region.hostim.dev wildcard. We use cert-manager for per-app certs and a plain certbot Ansible playbook for the wildcard . Two different tools for two different jobs. We will explain why, then show the code for both.

Why two tools for one cluster?

You can do everything with cert-manager. It supports DNS-01 with a long list of providers. So why are we running a second tool?

Three reasons:

Our DNS provider (Namecheap) does not have a stable cert-manager webhook. There are community webhooks, but they break on upgrades. Maintaining one for a single cert is more work than running certbot once a quarter.

The wildcard cert covers our shared ingress, not user apps.…