$ kubectl get pods --namespace cert-manager
NAME                                     READY   STATUS    RESTARTS   AGE
cert-manager-6d8d6b5dbb-wg8p7            1/1     Running   0          44m
cert-manager-cainjector-d6cbc4d9-t9pn9   1/1     Running   0          44m
cert-manager-webhook-85fb68c79b-2bfmh    1/1     Running   0          44m

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: <YOUR EMAIL> # replace this
    privateKeySecretRef:
      name: prod-issuer-account-key
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
      - http01:
          ingress:
            class: traefik
        selector: {}

$ kubectl apply -f letsencrypt.yml
$ kubectl describe clusterissuer letsencrypt
...
Status:
  Acme:
    Last Registered Email:  songtianlun@frytea.com
    Uri:                    https://acme-v02.api.letsencrypt.org/acme/acct/430905970
  Conditions:
    Last Transition Time:  2022-03-01T01:32:36Z
    Message:               The ACME account was registered with the ACME server
    Observed Generation:   1
    Reason:                ACMEAccountRegistered
    Status:                True
    Type:                  Ready
Events:                    <none>

$ kubectl create namespace logos

$ cat deployment.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: rancher-logo-app
  namespace: logos
spec:
  selector:
    matchLabels:
      name: rancher-logo-backend
  template:
    metadata:
      labels:
        name: rancher-logo-backend
    spec:
      containers:
        - name: backend
          image: ruanbekker/logos:rancher
          ports:
            - containerPort: 80

$ kubectl apply -f deployment.yml
$ kubectl get deployment -n logos
NAME               READY   UP-TO-DATE   AVAILABLE   AGE
rancher-logo-app   1/1     1            1           29m

$ cat service.yml
apiVersion: v1
kind: Service
metadata:
  name: rancher-logo-service
  namespace: logos
spec:
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    name: rancher-logo-backend

$ kubectl apply -f service.yml
$ kubectl get service -n logos
NAME                   TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
rancher-logo-service   ClusterIP   10.43.87.67   <none>        80/TCP    33m

$ cat ingress.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
    annotations:
        cert-manager.io/cluster-issuer: letsencrypt-prod
    name: rancher-logo-ingress
    namespace: logos
spec:
  tls:
    - secretName: rancher-logo-k3s-ruan-dev-tls
      hosts:
        - logos.k3s.frytea.com
  rules:
  - host: logos.k3s.frytea.com
    http:
      paths:
        - pathType: Prefix
          path: /
          backend:
            service:
              name: rancher-logo-service
              port:
                number: 80

$ kubectl apply -f ingress.yml
$ kubectl get ingress -n logos
NAME                   CLASS    HOSTS                  ADDRESS                       PORTS     AGE
rancher-logo-ingress   <none>   logos.k3s.frytea.com   x.x.x.x,x.x.x.x   80, 443   26m

$ kubectl -n logos describe certificate
...
Status:
  Conditions:
    Last Transition Time:  2022-03-01T01:54:19Z
    Message:               Certificate is up to date and has not expired
    Observed Generation:   1
    Reason:                Ready
    Status:                True
    Type:                  Ready
  Not After:               2022-05-30T00:54:17Z
  Not Before:              2022-03-01T00:54:18Z
  Renewal Time:            2022-04-30T00:54:17Z
  Revision:                1
Events:
  Type    Reason     Age   From          Message
  ----    ------     ----  ----          -------
  Normal  Issuing    28m   cert-manager  Issuing certificate as Secret does not exist
  Normal  Generated  28m   cert-manager  Stored new private key in temporary Secret resource "rancher-logo-k3s-ruan-dev-tls-rgrd8"
  Normal  Requested  28m   cert-manager  Created new CertificateRequest resource "rancher-logo-k3s-ruan-dev-tls-g8rm7"
  Normal  Issuing    28m   cert-manager  The certificate has been successfully issued