Are the LE certs stored persistently with k8s?

Traefik Traefik v2
1

I assume so but couldn't find anything about it.

Does Traefik uses k8s' secrets for this or volumes? Does they stay persistent (1) after I deleted all deployments and (2) after I resetted k8s?

Or are the other extreme, are they requested again and again with every new run?

2

am having the same issue. Not only that I want to be able to use the secrets across different clusters. we are spinning up clusters on demand. Constantly hitting the rate limit...

Would love to hear what is the solution

3

I just checked myself, just applied/deleted manifests 2 times and voila, it generates new certificates everytime and doesn't save the prior one. I kept k8s running inbetween:

1st run:
image

2nd run:
image

The certs serial number also differ

I alos checked the debug log for legolog and both runs are identical, hence Traefik let LE everytime generate new certs :confused:

4

just posted a feature request in their issues, I think this is a must feature since k8s and other orchestrators offer a pers storage: https://github.com/containous/traefik/issues/6189

5

I had the same problem. The only way I have found to solve it is using a volume to store the certificate (Azure files in my case).

6

so how did you do this? putting acme.json into somefolder/ and somefolder/ is a volume mapped to the physical system?

8

Yes. I mount a volume mapped to a directory previouly configured in traefik to save the certificates.

volumeMounts:
  - mountPath: "/certs"
    name: certs

Configured volume:

volumes:
  - name: certs
    persistentVolumeClaim:
      claimName: traefik-certs
1 Like
9

That's actually how its ment to be :slight_smile: Mount a volume to store the file and it will be persistent

1 Like
10

I wanted to do just that but I ready the following ticket

11

Either a persistent volume or a backend like Consul or Etcd is the recommended way of doing it. If you run multiple instances that share a configuration, I would highly recommend to not just use a volume as that might create some issues with read/write deadlocks etc.