# Use traefik as a proxy and letsencrypt ssl certificate manager with kubernetes **URL:** \ **Category:** Traefik v3 (latest)\ **Tags:** kubernetes-ingress\ **Created:** [December 6, 2024, 11:13am UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439 "2024-12-06T11:13:36Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![LearningNetrunner](https://avatars.discourse-cdn.com/v4/letter/l/eada6e/32.png) [@LearningNetrunner](https://community.traefik.io/u/LearningNetrunner)\ **Post date:** [December 6, 2024, 11:13am UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439/1 "2024-12-06T11:13:36Z")
Hello, I am learning kubernetes and traefik. I would like to deploy traefik in kubernetes. Right now I have a test environment on digitalocean but the questions are about traefik and kubernetes in general. I have currently this situation. ```auto kubectl get pods,services NAME READY STATUS RESTARTS AGE pod/app-frontend-5d5584888d-9mzhv 1/1 Running 0 114m pod/app-backend-67b59df8b5-59lh2 1/1 Running 0 114m pod/cm-acme-http-solver-qh8ms 1/1 Running 0 63m pod/company-service-855864d49-mrkrp 1/1 Running 0 114m pod/edge-service-5cd9945fbc-tzthl 1/1 Running 0 114m pod/location-service-68db8f867b-wzf4j 1/1 Running 0 114m pod/tomcat-deployment-69677f796c-57xh7 1/1 Running 0 39m pod/traefik-5d86ff94c5-c6m9f 1/1 Running 0 22h pod/traefik-deployment-c8bdf66f5-kgng2 1/1 Running 0 4h46m pod/user-service-5f5c46df5f-j2lqg 1/1 Running 1 (113m ago) 114m NAME TYPE EXTERNAL-IP PORT(S) AGE service/app-frontend LoadBalancer app-ext-ip 3000:32459/TCP 114m service/app-backend ClusterIP 5432/TCP 114m service/cm-acme-http-solver-fcgpr NodePort 8089:30577/TCP 63m service/company-service ClusterIP 9003/TCP 114m service/edge-service ClusterIP 9000/TCP 114m service/kubernetes ClusterIP 443/TCP 23h service/location-service ClusterIP 9002/TCP 114m service/traefik LoadBalancer traefik-ext-ip 80:32591/TCP,443:30716/TCP 22h service/traefik-dashboard-service LoadBalancer traefik-dashboard-ext-ip 8080:31431/TCP 4h44m service/traefik-web-service LoadBalancer traefik-web-ext-ip 80:31211/TCP 4h44m service/user-service ClusterIP 9001/TCP 114m ``` so far I followed this guide: [Secure Web Apps: Traefik Proxy, cert-manager & Let’s Encrypt](https://traefik.io/blog/secure-web-applications-with-traefik-proxy-cert-manager-and-lets-encrypt/) and I'm reading the documentation. What I'm trying to understand and achieve Is how to get traefik act as a proxy and ssl into app-frontend. Can you point me to some further documentation? ---
**Author:** ![LearningNetrunner](https://avatars.discourse-cdn.com/v4/letter/l/eada6e/32.png) [@LearningNetrunner](https://community.traefik.io/u/LearningNetrunner)\ **Post date:** [December 10, 2024, 8:59am UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439/3 "2024-12-10T08:59:20Z")
I have a question about this part of that beautiful guide: HTTP challenge For most common scenarios the [HTTP-01](https://cert-manager.io/docs/configuration/acme/http01/?ref=traefik.io) challenge is a convenient start to solve an ACME based validation. To make this scenario work, Traefik Proxy needs to be reachable from the internet on HTTP port 80, and the used DNS domain has to be configured to point to it. So, I have to make a dns record that points to app.domain.example using the traefik-web-ext-ip or using the traefik-ext-ip ? ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [December 10, 2024, 9:23am UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439/4 "2024-12-10T09:23:32Z")
For LetsEncrypt `httpChallenge` and `tlsChallenge` to work, you need to have purchased a domain name at a DNS provider and point the A/AAAA record to the public IP of the Traefik server, which is reachable on the Internet. Traefik will request a TLS cert from LetsEncrypt and LetsEncrypt will request a verification via the domain name and public IP from Traefik. ---
**Author:** ![LearningNetrunner](https://avatars.discourse-cdn.com/v4/letter/l/eada6e/32.png) [@LearningNetrunner](https://community.traefik.io/u/LearningNetrunner)\ **Post date:** [December 10, 2024, 9:40am UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439/5 "2024-12-10T09:40:50Z")
thank you for clarifing that. at this moment I have 2 public ip for traefik. ```auto service/traefik LoadBalancer traefik-ext-ip 80:32591/TCP,443:30716/TCP service/traefik-web-service LoadBalancer traefik-web-ext-ip 80:31211/TCP ``` Should I use the one of the traefik service, or the one of the traefik-web-service? I think dns record A should point to traefik-web-service but I'm searching for documentation. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [December 10, 2024, 10:07am UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439/6 "2024-12-10T10:07:43Z")
I think in general in k8s the TLS certs are handled by cert-manager ([guide](https://doc.traefik.io/traefik/user-guides/cert-manager/)), not Traefik directly. But I am not a k8s user. ---
**Author:** ![LearningNetrunner](https://avatars.discourse-cdn.com/v4/letter/l/eada6e/32.png) [@LearningNetrunner](https://community.traefik.io/u/LearningNetrunner)\ **Post date:** [December 10, 2024, 12:27pm UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439/7 "2024-12-10T12:27:49Z")
you are right. I am now trying to figure out how traefic can act as a proxy https. I see the certificate in certificate manager. If I type [http://traefik-web-ext-ip](http://traefik-web-ext-ip) i get to the app through traefic. If I type [https://traefik-web-ext-ip](https://traefik-web-ext-ip) i get timeout. ---
**Author:** ![LearningNetrunner](https://avatars.discourse-cdn.com/v4/letter/l/eada6e/32.png) [@LearningNetrunner](https://community.traefik.io/u/LearningNetrunner)\ **Post date:** [December 10, 2024, 2:13pm UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439/8 "2024-12-10T14:13:04Z")
hello @bluepuma77 do you happen to know the apiVersion I should use in traefik v3 to create via file.yml the following? ```auto apiVersion: I_DO_NOT_KNOW kind: Middleware metadata: name: app-frontend spec: redirectScheme: permanent: true scheme: https --- apiVersion: I_DO_NOT_KNOW kind: IngressRoute metadata: name: app-frontend spec: entryPoints: - web routes: - match: Host(`traefik-web-ext-fqdn`) kind: Rule services: - name: app-frontend port: 80 middlewares: - name: app-frontend ``` or where I could find it? ---
**Author:** ![LearningNetrunner](https://avatars.discourse-cdn.com/v4/letter/l/eada6e/32.png) [@LearningNetrunner](https://community.traefik.io/u/LearningNetrunner)\ **Post date:** [December 10, 2024, 2:57pm UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439/9 "2024-12-10T14:57:37Z")
```auto traefik.io/v1alpha1 ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [December 13, 2024, 2:57pm UTC](https://community.traefik.io/t/use-traefik-as-a-proxy-and-letsencrypt-ssl-certificate-manager-with-kubernetes/25439/10 "2024-12-13T14:57:58Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.