Dunno how well it would work with kubernates internal networks, but my DNS is configured with different views for internal and external clients. So, when letsencrypt does a lookup, they get the external IP, but when an internal client looks up the same name, they get the internal IP. TLS is happy, because the certificate matches the name. I’m happy because it works even when the ISP is down.