TRAEFIK DEFAULT CERT on domain that have Let's encrypt cert-manager certificate issued

Traefik Traefik v2
1

Hi,

I have a problem with host have certificate generated using cert-manager, but when opened in browser TRAEFIK DEFAULT CERT is used on domain.

Some details of my setup:
K3s Version:
k3s version v1.23.6+k3s1

Node(s) CPU architecture, OS, and Version:
Linux instance 5.13.0-1030-oracle #35~20.04.1-Ubuntu SMP Wed May 25 23:19:48 UTC 2022 aarch64 aarch64 aarch64 GNU/Linux

Cluster Configuration just single master.

Steps To Reproduce:

Installed K3s:
curl -sfL https://get.k3s.io/ | INSTALL_K3S_EXEC="--tls-san 130.61.84.XX --node-external-ip 130.61.84.XX" sh -s -

Installed cert-manager:
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.8.0
setup letsencrypt-prod ClusterIssuer with solvers:

...
     solvers:
        - http01:
            ingress:
                ingressTemplate:
                    metadata:
                        annotations:
                            kubernetes.io/ingress.class: traefik

-- Run app deployment, ingress looks like this:

    ingressClassName: traefik
    rules:
    - host: api.example.dev
      http:
        paths:
        - backend:
            service:
              name: yyy-backend-api
              port:
                number: 80
          path: /
          pathType: Exact
    tls:
    - secretName: yyy-backend-api-tls
  status:
    loadBalancer: {}

Certificate is created:

Normal  Issuing    134m  cert-manager-certificates-issuing          The certificate has been successfully issued

I would expected that when visiting api.example.dev let's encrypt cert should be used.

Instead self-signed TRAEFIK DEFAULT CERT is used.
When I tried to call api from api.example.dev in postman I got 404.
When port-forward is done or called from host on Pod IP, api responds ok.

Any help or suggestions would be appreciated.

1 Like
2

I'm having the same issue with my setup.
It seems to work if I use the Ingress annotation

kubernetes.io/ingress.class: traefik

instead of the ingressClassName

ingressClassName: traefik

I could not figure out yet if it is config issue or a bug in either traefic or cert-manager.

3

Update:
there seems to be some issue between cert-manager and traefik for supporting the new field ingressClassName, please up-vote: