This shows a working example of a traefik-config.yaml override for k3s, this should be stored in /var/lib/rancher/k3s/server/manifests and allows letsencrypt via a web httpChallenge. The resolver is named letsencryptweb.

example-ingress-traefik.yaml

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  namespace: apps
  name: example-ingress
spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`your-own-awesome-domain.com`)
    kind: Rule
    services:
    - name: your-awesome-service
      port: port-of-your-service
  tls:
    certResolver: letsencryptweb

traefik-config.yaml

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    logs:
      access:
        enabled: true
    ports:
      web:
        port: 80
      websecure:
        port: 443
    persistence:
      enabled: true
    certResolvers:
      letsencryptweb:
        email: "yourownvalidemail"
        httpChallenge:
          entrypoint: "web"
        storage: /data/acme.json

Installation:

• Modify traefik-config.yaml to reference a valid email that will receive ACME notifications.
• Modify example-ingress-traefik.yaml to reference to your own service and port