Migration issue from v2 to v3 on kubernetes

Traefik Traefik v3 (latest)
1

Hi all ,

i'm in the middle of upgrading "old" v2.11.x traefik proxies, running in google kubernetes to v3.6.15. Most of the migrations where fine , thanks to the backwards compatibility of traefik.

now when doing the upgraded on of the last k8s cluster, i got these errors every second :frowning:

WRN RootCAsSecrets option is deprecated, please use the RootCA option instead. namespace=default providerName=kubernetescrd serversTransport=mytransport
2026-05-20T02:43:11Z ERR Error while loading CA Secret error="secret 'default/foobar' not found" namespace=default providerName=kubernetescrd secret=foobar serversTransport=mytransport
2026-05-20T02:43:11Z ERR Error while loading CA Secret error="secret 'default/foobar' not found" namespace=default providerName=kubernetescrd secret=foobar serversTransport=mytransport
2026-05-20T02:43:11Z ERR Error while loading certificates foobar error="secret 'default/foobar' does not exist" namespace=default providerName=kubernetescrd serversTransport=mytransport
2026-05-20T02:43:11Z ERR Error while loading certificates foobar error="secret 'default/foobar' does not exist" namespace=default providerName=kubernetescrd serversTransport=mytransport

investigating this i noticed that

  • we don't use default namespace, and that was empty
  • all the complains are about "foobar" ressources/secrets etc... , again we don't have foobar
  • doing kubectl get all --namespace default gives empty list

so its seems kubernetescrd is seeing "things" that i can not find or see when analyzing the k8s resouces with kubectl and k9s tool ???

i noticed that this foobar stuff "was" long ago in version 2.6 part of the preloaded CRD as resources.yaml , but again this was long time ago and those resources where removed.

for now i have set loglevel to FATAL because this errors are floating gcloud logging , which is already overwelming with details/useless logging.

now i'm currently not suspecting this to be a bug in traefik but maybe somebody else has got this experience and got explain this or provide a solution .

if have this cli options in my deployment
- --providers.kubernetesingress=true
- --providers.kubernetesingress.ingressclass=traefik-internal
- --providers.kubernetesingress.allowexternalnameservices=true

and multiple namespaces , but do not use default namespace.