I'm running Traefik v1.7 in a v1.16 kubernetes cluster. TLS certificates are managed by cert-manager. Traefik mounts the secrets that cert-manager creates. All this is working fine, the problem arises when the certificates get refreshed.
Based on https://github.com/containous/traefik/pull/2233 and some related issues, I figured that Traefik v1 is capable of automatically updating the served certificate when the underlying secret gets updated. This does not seem to be the case with my current configuration though.
I've tested two traefik.toml configurations, the first one, which apparently uses a 'static' tls configuration:
# traefik.toml
defaultEntryPoints = ["http","https"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[entryPoints.https.tls.certificate]
certFile = "/certs/tls.crt"
keyFile = "/certs/tls.key"
and what I thought was a dynamic config (as per https://docs.traefik.io/v1.7/configuration/entrypoints/#dynamic-certificates ):
# traefik.toml
defaultEntryPoints = ["http","https"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[file]
[[tls]]
entryPoints = ["https"]
[tls.certificate]
certFile = "/certs/tls.crt"
keyFile = "/certs/tls.key"
Neither of these seem to work, the old certificate keeps getting served until I restart my traefik-ingress-controller pods. How exactly does one configure automatically updating external certificates?
I've tested with the alpine version of the images, and the content of the .crt and .key files within the pod reflect the changes of the underlying secret, as one would expect.
Based on the log output, some configuration reloading does happen during the certificate renewal:
time="2020-07-12T11:01:58Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:01:59Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:01:59Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:01:59Z" level=info msg="Server configuration reloaded on :80"
time="2020-07-12T11:01:59Z" level=info msg="Server configuration reloaded on :443"
time="2020-07-12T11:01:59Z" level=info msg="Server configuration reloaded on :8080"
time="2020-07-12T11:02:00Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:01Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:01Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:02Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:03Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:03Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:04Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:05Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:05Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:06Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:07Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:07Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:08Z" level=info msg="Server configuration reloaded on :80"
time="2020-07-12T11:02:08Z" level=info msg="Server configuration reloaded on :443"
time="2020-07-12T11:02:08Z" level=info msg="Server configuration reloaded on :8080"
time="2020-07-12T11:02:21Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:21Z" level=error msg="Service not found for kube-system/cm-acme-http-solver-cp4bz"
time="2020-07-12T11:02:21Z" level=info msg="Server configuration reloaded on :8080"
time="2020-07-12T11:02:21Z" level=info msg="Server configuration reloaded on :80"
time="2020-07-12T11:02:21Z" level=info msg="Server configuration reloaded on :443"
time="2020-07-12T11:02:23Z" level=info msg="Server configuration reloaded on :80"
time="2020-07-12T11:02:23Z" level=info msg="Server configuration reloaded on :443"
time="2020-07-12T11:02:23Z" level=info msg="Server configuration reloaded on :8080"
time="2020-07-12T11:05:03Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-pxs2t"
time="2020-07-12T11:05:03Z" level=info msg="Server configuration reloaded on :443"
time="2020-07-12T11:05:03Z" level=info msg="Server configuration reloaded on :8080"
time="2020-07-12T11:05:03Z" level=info msg="Server configuration reloaded on :80"
time="2020-07-12T11:05:04Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-pxs2t"
time="2020-07-12T11:05:05Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-pxs2t"
time="2020-07-12T11:05:05Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-pxs2t"
time="2020-07-12T11:05:05Z" level=info msg="Server configuration reloaded on :80"
time="2020-07-12T11:05:05Z" level=info msg="Server configuration reloaded on :443"
time="2020-07-12T11:05:05Z" level=info msg="Server configuration reloaded on :8080"
time="2020-07-12T11:05:26Z" level=warning msg="Endpoints not available for kube-system/cm-acme-http-solver-pxs2t"
time="2020-07-12T11:05:26Z" level=error msg="Service not found for kube-system/cm-acme-http-solver-pxs2t"
time="2020-07-12T11:05:26Z" level=info msg="Server configuration reloaded on :80"
time="2020-07-12T11:05:26Z" level=info msg="Server configuration reloaded on :443"
time="2020-07-12T11:05:26Z" level=info msg="Server configuration reloaded on :8080"
time="2020-07-12T11:05:28Z" level=info msg="Server configuration reloaded on :80"
time="2020-07-12T11:05:28Z" level=info msg="Server configuration reloaded on :443"
time="2020-07-12T11:05:28Z" level=info msg="Server configuration reloaded on :8080"