SSL certificates with traefik in kubernetes.

Hi there,

I believe that this should be doable. This tutorial here should cover most of this:

https://www.digitalocean.com/community/tutorials/how-to-secure-your-site-in-kubernetes-with-cert-manager-traefik-and-let-s-encrypt

Start by deploying Traefik via Helm:

helm repo add traefik https://helm.traefik.io/traefik
helm repo update
helm install traefik traefik/traefik --namespace traefik

This creates a LoadBalancer Service, which provisions a DigitalOcean Load Balancer to route traffic.

Traefik can directly request and manage Let’s Encrypt certificates. Add these Helm values to enable ACME:

additionalArguments:
  - "--certificatesresolvers.le.acme.email=your@email.com"
  - "--certificatesresolvers.le.acme.storage=/data/acme.json"
  - "--certificatesresolvers.le.acme.httpChallenge.entryPoint=web"

Also, make sure your domain points to the DO Load Balancer’s IP so Let’s Encrypt can validate it.

Define an Ingress rule for your Tomcat service:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "traefik"
    traefik.ingress.kubernetes.io/router.entrypoints: "web,websecure"
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.tls.certresolver: "le"
spec:
  rules:
    - host: app.mydomain.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: tomcat-service
                port:
                  number: 8080

This ensures traffic to app.mydomain.com is routed to your Tomcat pod with TLS encryption via Let’s Encrypt.

If you want Traefik to fully manage TLS, enable passthrough on the DO Load Balancer:

service.beta.kubernetes.io/do-loadbalancer-tls-passthrough: "true"
service.beta.kubernetes.io/do-loadbalancer-tls-ports: "443"

Also, enable PROXY Protocol to retain real IPs:

service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"

For a real-world example of DigitalOcean Kubernetes deployment with Ingress and SSL, check out DigitalOcean’s Mastodon on Kubernetes project:

- Bobby