Adding SSL to Traefik using Let's Encrypt and Route53 via Helm chart

how-to-add-ssl-to-traefik.md

How to Add Let's Encrypt ACME SSL to Traefik (via Helm)

1. Update the helm chart values file with the ssl and acme block.

---
apiVersion: helm.fluxcd.io/v1
kind: HelmRelease
metadata:
  name: traefik
  namespace: kube-system
spec:
  releaseName: traefik
  chart:
    repository: https://kubernetes-charts.storage.googleapis.com
    name: traefik
    version: 1.82.3
  values:
    # ... your other values here, etc.
    ssl:
      enabled: true
      enforce: true

    acme:
      enabled: true
      email: your_email@gmail.com
      challengeType: dns-01
      staging: false
      logging: true
      domains:
        enabled: true
        domainsList:
          - main: "www.mydomain.com"
      dnsProvider:
        name: route53
        existingSecretName: "traefik-secrets"

IMPORTANT: If you set staging: true this will use a fake cert and will persist in the PersistentVolume and will not be replaced when you turn staging off. I would not bother with staging at all, and just set it to false regardless. Save yourself the headache!

2. Create a kube secrets using kubeseal: https://github.com/bitnami-labs/sealed-secrets#usage

kubectl create secret generic -o yaml > traefik-secrets.yaml

Edit this file traefik-secrets.yaml and add the appropriate values for the data field. Remember they need to be base64 encoded.

Should create a file like this:

apiVersion: v1
data:
  AWS_ACCESS_KEY_ID: base64encodedXXXXXXXXX=
  AWS_REGION: base64encodedregion
  AWS_SECRET_ACCESS_KEY: base64encodedsecretaccesskey
kind: Secret
metadata:
  name: traefik-secrets
  namespace: kube-system

NOTE: The namespace must be the same as wherever you have Traefik deployed (in this case, kube-system)

3. Seal it using kubeseal <traefik-secrets.yaml >traefik-sealed-secrets.yaml
4. Create it in K8s using kubectl create -f traefik-sealed-secrets.yaml.
5. Check to see it has been created: kubectl get secret traefik-secrets --namespace kube-system

That should do it. Redeploy your Helm chart and tail the log to make sure it hits the Let's Encrypt API server to get the cert.