<p>I have setup a backend and frontend service running on Kubernetes. Frontend would be <code>www.&lt;myDomain&gt;.com</code> and backend would be <code>api.&lt;myDomain&gt;.com</code></p>
<p>I need to expose and secure both services. I wish to use one ingress. I want to use free certificates from let's encrypt + cert manager. I guess a certificate for <code>&lt;myDomain&gt;.com</code> should cover both <code>www.</code> and <code>api.</code>.</p>
<p>Pretty normal use case, right? But when these normal stuff comes together, I couldn't figure out the combined yaml. I was able to get single service, the <code>www.&lt;myDomain&gt;.com</code> working with https. Things doesn't work when I tried to add the <code>api.&lt;myDomain&gt;.com</code></p>
<p>I'm using GKE, but this doesn't seem to be a platform related question. Now creating ingress takes forever. This following events has been tried again and again</p>
<pre><code>Error syncing to GCP: error running load balancer syncing routine: loadbalancer &lt;some id here&gt; does not exist: googleapi: Error 404: The resource 'projects/&lt;project&gt;/global/sslCertificates/&lt;some id here&gt;' was not found, notFound
</code></pre>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    kubernetes.io/ingress.class: gce
    kubernetes.io/ingress.allow-http: &quot;true&quot;
    cert-manager.io/issuer: letsencrypt-staging
spec:
  tls:
    - secretName: web-ssl
      hosts:
        - &lt;myDomain&gt;.com
  rules:
    - host: &quot;www.&lt;myDomain&gt;.com&quot;
      http:
        paths:
          - pathType: Prefix
            path: &quot;/&quot;
            backend:
              service:
                name: angular-service
                port:
                  number: 80
    - host: &quot;api.&lt;myDomain&gt;.com&quot;
      http:
        paths:
          - pathType: Prefix
            path: &quot;/&quot;
            backend:
              service:
                name: spring-boot-service
                port:
                  number: 8080
</code></pre>

<p>@Jun's answer worked mostly for me, but the <code>secretName</code> values have to be different. Otherwise, you'll get this error:</p>
<blockquote>
<p>Warning  BadConfig          12m    cert-manager-ingress-shim  spec.tls[0].secretName: Invalid value: &quot;api-ingress-cert&quot;: this secret name must only appear in a single TLS entry but is also used in spec.tls[1].secretName</p>
</blockquote>
<p>After fixing the <code>secretName</code> values, cert-manager generated everything as expected.</p>
