When I only add the TLS secret to the Ingress, Traefik serves it's default certificate.
kind: Ingress
spec:
rules:
....
tls:
- secretName: ingress-mgt-server-keysOnly when I mount the secret and add below parameter, does Traefik start serving the real certificate.
entryPoints.https.tls.certificates
Are TLS secrets to be define in both Ingress and Ingress-controller? This forces me to repeat the keys as secrets to all the ingress namespaces as well as the ingress-controller namespace.
[Update]: Traefik has RBAC to read secrets from the target namespace.
Hmm, that does not seem to be the case.
https://docs.traefik.io/user-guide/kubernetes/#add-a-tls-certificate-to-the-ingress
In addition to the modified ingress you need to provide the TLS certificate via a Kubernetes secret in the same namespace as the ingress.
The TLS Secret isn't needed to be set up in the target (ingress) namespaces.
Only the ingress controller namespace needs the TLS Secret.