Overview
Before you deploy vLLM, set up the infrastructure components that handle external traffic routing and TLS certificate management. This step installs Traefik (for ingress) and cert-manager (for automatic SSL certificates), so that the vLLM service you deploy in later steps is reachable from outside the cluster over HTTPS.
This page is for cluster operators who have already provisioned a CKS cluster and have helm and kubectl configured to target it.
Step 1: Add CoreWeave Helm repository
The CoreWeave Helm repository hosts the Traefik and cert-manager charts used throughout this tutorial. Add it to your local Helm configuration so that subsequent helm install commands can resolve those charts:
You should see output similar to the following:
Step 2: Install Traefik ingress controller
Deploy Traefik to handle external traffic routing and TLS termination:
You should see something like the following:
Verify the installation by checking that all Traefik Pods are running:
You should see output similar to the following:
Step 3: Install and enable cert-manager
Install cert-manager for automatic TLS certificate management:
You should see output similar to the following:
Enable the cert-manager cluster issuers:
You should see output similar to the following:
To verify that cert-manager is running, use the following command:
You should see output similar to the following:
Step 4: Verify infrastructure setup
Before you move on to monitoring setup, confirm that Traefik and cert-manager are both healthy and that the expected cluster issuers are available. Check that all components are installed and running:
You should see output similar to the following:
To check cert-manager services, run the following command:
You should see output similar to the following:
To verify that certificate issuers are available, run the following command:
You should see output similar to the following:
What’s next
Your cluster now has Traefik handling ingress and TLS termination, and cert-manager issuing certificates through the letsencrypt-prod, letsencrypt-staging, and selfsigned-cluster-issuer cluster issuers. With these infrastructure dependencies in place, you can expose the vLLM service securely after you deploy it.
In the next step, you configure monitoring and observability for your vLLM deployment.
If you encounter issues with the installation, check the Pod logs for troubleshooting information. Last modified on June 10, 2026
