Let's Encrypt fails HTTP-01 validation for app.example.com. Which URL must be reachable from the internet?

Answer: http://app.example.com/.well-known/acme-challenge/<token> on port 80

Explanation

The ACME server fetches the token over plain HTTP on port 80. It follows redirects, but the first request must reach port 80. cert-manager runs a solver pod, which listens on 8089 inside the cluster, and routes that path to it through a temporary Ingress or HTTPRoute. If a firewall blocks port 80, or the Ingress controller sends that path somewhere else, validation fails. DNS-01 avoids this.