Thanks, indeed you are right using DNS 01 challenge can be appropriate for this. Btw do you use a VPN for transmission. I mean, for egress traffic, I have been trying to figure out how to set it up without any luck.

Thank you for sharing, looks great. I wonder how you configured access to the Kubernetes services. You mentioned you leverage WIreguard VPN but is it possible to configure SSL certificates for the VPN services?