K3s with Let's Encrypt

Question

I'm trying to get Let's Encrypt working on a K3s cluster of mine. I've been following the below tutorial but since it's more than a year old I'm using a later version of cert-manager.

https://pascalw.me/blog/2019/07/02/k3s-https-letsencrypt.html

I'm executing the following commands

kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.0.1/cert-manager.crds.yaml
helm repo add jetstack https://charts.jetstack.io
kubectl create namespace cert-manager
helm install cert-manager jetstack/cert-manager --namespace cert-manager

echo "apiVersion: cert-manager.io/v1beta1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    email: my-email@gmail.com
    privateKeySecretRef:
      name: staging-issuer-account-key
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    http01: {}
    solvers:
      - http01:
          ingress:
            class: traefik
        selector: {}
" | kubectl apply --validate=false -f -

My generated ingress resource looks as the following

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/acme-challenge-type: http01
    certmanager.k8s.io/issuer: letsencrypt-staging
    kubernetes.io/ingress.class: traefik
    meta.helm.sh/release-name: whoami-mn
    meta.helm.sh/release-namespace: whoami-mn-dev
  creationTimestamp: "2020-09-13T08:49:27Z"
  generation: 3
  labels:
    app.kubernetes.io/instance: whoami-mn
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: whoami-mn
    app.kubernetes.io/version: "0.1"
    helm.sh/chart: whoami-mn-0.4.0
  managedFields:
  - apiVersion: extensions/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:loadBalancer:
          f:ingress: {}
    manager: traefik
    operation: Update
    time: "2020-09-13T10:08:21Z"
  - apiVersion: networking.k8s.io/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:certmanager.k8s.io/acme-challenge-type: {}
          f:certmanager.k8s.io/issuer: {}
          f:kubernetes.io/ingress.class: {}
          f:meta.helm.sh/release-name: {}
          f:meta.helm.sh/release-namespace: {}
        f:labels:
          .: {}
          f:app.kubernetes.io/instance: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/version: {}
          f:helm.sh/chart: {}
      f:spec:
        f:rules: {}
        f:tls: {}
    manager: Go-http-client
    operation: Update
    time: "2020-09-13T12:37:32Z"
  name: whoami-mn
  namespace: whoami-mn-dev
  resourceVersion: "1127785"
  selfLink: /apis/extensions/v1beta1/namespaces/whoami-mn-dev/ingresses/whoami-mn
  uid: d4ff44a2-a45e-4ef4-ac53-e76c7603d91a
spec:
  rules:
  - host: whoami-mn.myhost.com
    http:
      paths:
      - backend:
          serviceName: whoami-mn
          servicePort: 8080
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - whoami-mn.myhost.com
    secretName: whoami-mn-tls
status:
  loadBalancer:
    ingress:
    - ip: 192.168.0.100

But the endpoint returns 404 and the logs from traefik contains multiple entries like the following

{"level":"error","msg":"Error configuring TLS for ingress whoami-mn-dev/whoami-mn: secret whoami-mn-dev/whoami-mn-tls does not exist","time":"2020-09-13T14:44:10Z"}

Any clue about what I'm doing wrong? Also please let me know if I should post anything else

Answer 1

The key to get this working was annotating my ingress resource correctly.

cert-manager.io/cluster-issuer: letsencrypt-staging

And NOT the following

certmanager.k8s.io/issuer: letsencrypt-staging

Version 1.0.1 of cert-manager was used.