Kubernetes traefik tls acme.json permission denied

Traefik Traefik v2
, ,
3 
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    additionalArguments:
      - --log.level=ERROR
      - --accesslog=false
      - --global.checknewversion
      - --global.sendAnonymousUsage=false
      - --entrypoints.web.http.redirections.entryPoint.to=:443
      - --entrypoints.web.http.redirections.entryPoint.scheme=websecure
      - --providers.file.directory=/file
      - --certificatesresolvers.le.acme.httpchallenge=true
      - --certificatesresolvers.le.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.le.acme.email=mail@mail.com
      - --certificatesresolvers.le.acme.tlschallenge=true
      - --certificatesresolvers.le.acme.storage=/le/acme.json
      - --certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
    volumes:
      - name: config-file
        mountPath: file/
        type: configMap
    persistence:
      enabled: true
      name: le
      accessMode: ReadWriteOnce
      size: 128Mi
      path: /le
    securityContext:
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsUser: 0
      runAsNonRoot: false

that's how a file is created
, but there are no such instructions in traefik

and all this makes sense if the file provider will receive tls
, but nothing happens

image

  ittools.yaml: |-
    http:
      routers:
        ittools-router:
          entryPoints:
          - web
          service: ittools-service
          rule: Host(`ittools.domen.com`)
	  tls:
	    certResolver: le
      services:
        ittools-service:
          loadBalancer:
            servers:
            - url: http://192.168.88.3:8888
	    passHostHeader: true