TRAEFIK DEFAULT CERT on domain that have Let's encrypt cert-manager certificate issued

[januszj]

Environmental Info:
K3s Version:
k3s version v1.23.6+k3s1

Node(s) CPU architecture, OS, and Version:
Linux instance 5.13.0-1030-oracle #35~20.04.1-Ubuntu SMP Wed May 25 23:19:48 UTC 2022 aarch64 aarch64 aarch64 GNU/Linux

Cluster Configuration:
Single master

Describe the bug:
Ingress host have certificate generated using cert-manager, but when checked in browser TRAEFIK DEFAULT CERT is used on domain.

Steps To Reproduce:

• Installed K3s:
  curl -sfL https://get.k3s.io/ | INSTALL_K3S_EXEC="--tls-san 130.61.84.XX --node-external-ip 130.61.84.XX" sh -s -
• Installed cert-manager:
  helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.8.0
  setup letsencrypt-prod ClusterIssuer with solvers:

...
     solvers:
        - http01:
            ingress:
                ingressTemplate:
                    metadata:
                        annotations:
                            kubernetes.io/ingress.class: traefik

-- Run app deployment, ingress looks like this:

  spec:
    ingressClassName: traefik
    rules:
    - host: api.example.dev
      http:
        paths:
        - backend:
            service:
              name: yyy-backend-api
              port:
                number: 80
          path: /
          pathType: Exact
    tls:
    - secretName: yyy-backend-api-tls
  status:
    loadBalancer: {}

Certificate is created:

Normal  Issuing    134m  cert-manager-certificates-issuing          The certificate has been successfully issued

Expected behavior:
When visiting api.example.dev let's encrypt cert should be used

Actual behavior:
When visiting api.example.dev self-signed TRAEFIK DEFAULT CERT is used.
When trying to call api from api.example.dev in postman I got 404.
When port-forward is done or called from host on Pod IP, api responds ..

[brandond]

I would probably take these questions to the traefik project. We just bundle the traefik directly from upstream; the only substantial change we make is to split the CRDs out into a separate helm chart. No-one on our team is going to be as qualified to answer questions about configuring Traefik as someone from that project.

[januszj]

Thanks, will do that.