Issues with DO Kubernetes, Load Balancers and SSL

Hey Lucas!

From what you described, it looks like you’re using the annotation service.beta.kubernetes.io/do-loadbalancer-certificate-id to set the certificate for your Load Balancer. The behavior you’re seeing—where the old certificate ID remains even after updating the annotation—might be because the certificate ID is tied to the specific Load Balancer instance, and simply changing the annotation may not force a reload of the configuration.

The good news is that DigitalOcean recently introduced an alternative annotation that might be more stable for your use case. So instead of using service.beta.kubernetes.io/do-loadbalancer-certificate-id, try using service.beta.kubernetes.io/do-loadbalancer-certificate-name.

As per the official documentation here:

service.beta.kubernetes.io/do-loadbalancer-certificate-name (available in DOKS 1.26 and later): Specifies the certificate name used for the HTTPS protocol. We recommend using this annotation because the name of a Let’s Encrypt certificate does not change when it rotates, but the ID changes each time. The name of the certificate must be unique within an account. To list available certificates and their names, install doctl and run doctl compute certificate list.

Basically, this annotation uses the certificate’s name instead of the ID, which is helpful because:

• The ID changes every time a Let’s Encrypt certificate is renewed, but the name remains the same.
• Using the certificate name ensures that updates are automatically picked up without needing to change the ID.

Here’s how you can adjust your Service definition:

kind: Service
apiVersion: v1
metadata:
  name: https-with-cert
  annotations:
    service.beta.kubernetes.io/do-loadbalancer-protocol: "https"
    service.beta.kubernetes.io/do-loadbalancer-certificate-name: "your-certificate-name"
    service.beta.kubernetes.io/do-loadbalancer-disable-lets-encrypt-dns-records: "false"
spec:
  type: LoadBalancer
  selector:
    app: nginx-example
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 80

The main change is that you will be using the certificate name, the Load Balancer should automatically recognize the renewed certificate without you needing to update the annotation every time the certificate is rotated.

If the above solution doesn’t work immediately, you might need to:

1. Temporarily create a new Load Balancer with the updated certificate.
2. Switch over your traffic to the new Load Balancer.

For more details on using the annotations, check out the DigitalOcean docs here:

DigitalOcean Load Balancer Annotations

Let me know if this helps!

- Bobby