<p>I have a containerized Flash application (a simple webservice exposed in the internet) with SSL enabled by gunicorn through:</p>

<pre><code>CMD ["gunicorn", "--certfile", "/var/tmp/fullchain.pem", "--keyfile", "/var/tmp/key.pem", "__init__:create_app()", "-b", ":8080"]
</code></pre>

<p>I have a bot that renews Let's Encrypt certificates in this path every 3 months.</p>

<p>Now I am creating a Kubernetes cluster to put this application an orchestrate the replicas.</p>

<p>In a related <a href="https://stackoverflow.com/questions/56665355/configure-ssl-in-cluster-of-kubernetes">question</a> I've seen some ingress controllers provide this certificate creation/renew functionality so I would not need to map to .pem files anymore. There is also cert-manager that does that.</p>

<p>Now I don't know if I need gunicorn or what is the easyest and recommended way to configuring that to run the application. I am also in the process of chosing an ingress controller for my cluster.</p>

staticdev
<p>Theoretically you don't need to resign from your current setup: Flask app exposed on HTTPS.<BR> For instance the NGINX ingress controller can pass (encrypted) TLS packets directly to an upstream server (in your case Gunicorn) using SSL <a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/#ssl-passthrough" rel="nofollow noreferrer">Passthrough</a> feature.</p>

<p>But definitely it would be better to do it in a recommended Kubernetes way, with TLS enabled for Ingress (where cert-manager add-on can help you in obtaining certificates from sources like Let's Encrypt)</p>
