Certificates is highlighted; its page is below.

Certificates

Every web interface and every log connection uses a certificate from a private root CA. The CA is trusted on the admin devices, and name constraints limit it to internal names, so even a stolen CA key could not impersonate a public website.

How it is used#

cert-manager issues and renews every certificate in the cluster.
One wildcard for *.apps.internal covers every web app behind Traefik.
The SIEM's syslog receiver has its own certificate, which the firewall verifies before sending a single line.
The firewall answers with a client certificate. Its key was made on the firewall and never left it; only a signing request went to the laptop, where the CA signed it, for client authentication only.
Devices outside the cluster, like the UniFi controller, get certificates issued in the cluster and installed by hand.

The CA key#

The root key lives on the admin laptop, encrypted with a passphrase, with a copy in a password manager. The cluster holds the one other copy, which cert-manager needs to sign, encrypted with SOPS in Git.

In the configuration#

Name constraints on the root CA

nameConstraints:
  critical: true
  permitted:
    dnsDomains: ["internal", "svc", "cluster.local"]
    ipRanges:   ["192.168.0.0/16"]

A certificate for any public domain, signed by this CA, would be rejected by every client that trusts it.