The certificate manager (https://github.com/jetstack/cert-manager) automates the management and issuance of TLS certificates from various issuing sources. Certificate renewal and ensuring that they are updated periodically is all managed by cert-manager, which is a Kubernetes add-on.

The following command installs the cert-manager; at the time of writing, it requires the following workaround to avoid the custom resource already exists error:

helm install stable/cert-manager 
--name cert-manager 
--set createCustomResource=false 
--set ingressShim.extraArgs='{--default-issuer-name=letsencrypt-prod,--default-issuer-kind=Issuer}' 
--set rbac.create=false

helm upgrade cert-manager stable/cert-manager 
--set createCustomResource=true 
--set ingressShim.defaultIssuerName=letsencrypt-prod 
--set ingressShim.defaultIssuerKind=ClusterIssuer 
--set rbac.create=false 
--set serviceAccount.create=false