Let's encrypt, Kubernetes and Traefik on GKE

Question

I am trying to setup Traefik on Kubernetes with Let's Encrypt enabled. I managed yesterday to retrieve the first SSL certificated from Let's Encrypt but am a little bit stuck on how to store the SSL certificates.

I am able to create a Volume to store the Traefik certificates but that would mean that I am limited to a single replica (when having multiple replicas am I unable to retrieve a certificate since the validation goes wrong most of the times due to that the volume is not shared).

I read that Traefik is able to use something like Consul but I am wondering if I have to setup/run a complete Consul cluster to just store the fetched certificates etc.?

Answer 1

You can store the certificate in a kubernetes secret and you reference to this secret in your ingress.

spec:
  tls:
  - secretName: testsecret

The secret has to be in same namespace the ingress is running in. See also https://docs.traefik.io/user-guide/kubernetes/#add-a-tls-certificate-to-the-ingress

Answer 2

You can set up the ingress with controller and apply for the SSL certificate of let's encrypt.

You can use cluster issuer to manage the SSL certificates and store that tls certificate on ingress.you can also use different ingress controllers like nginx also can use service mess istio.

For more details you can check : https://docs.traefik.io/user-guide/kubernetes/