<p>I'm trying to get Let's Encrypt working on a K3s cluster of mine. I've been following the below tutorial but since it's more than a year old I'm using a later version of <code>cert-manager</code>.</p>
<p><a href="https://pascalw.me/blog/2019/07/02/k3s-https-letsencrypt.html" rel="nofollow noreferrer">https://pascalw.me/blog/2019/07/02/k3s-https-letsencrypt.html</a></p>
<p>I'm executing the following commands</p>
<pre><code>kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.0.1/cert-manager.crds.yaml
helm repo add jetstack https://charts.jetstack.io
kubectl create namespace cert-manager
helm install cert-manager jetstack/cert-manager --namespace cert-manager

echo &quot;apiVersion: cert-manager.io/v1beta1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    email: my-email@gmail.com
    privateKeySecretRef:
      name: staging-issuer-account-key
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    http01: {}
    solvers:
      - http01:
          ingress:
            class: traefik
        selector: {}
&quot; | kubectl apply --validate=false -f -
</code></pre>
<p>My generated ingress resource looks as the following</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/acme-challenge-type: http01
    certmanager.k8s.io/issuer: letsencrypt-staging
    kubernetes.io/ingress.class: traefik
    meta.helm.sh/release-name: whoami-mn
    meta.helm.sh/release-namespace: whoami-mn-dev
  creationTimestamp: &quot;2020-09-13T08:49:27Z&quot;
  generation: 3
  labels:
    app.kubernetes.io/instance: whoami-mn
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: whoami-mn
    app.kubernetes.io/version: &quot;0.1&quot;
    helm.sh/chart: whoami-mn-0.4.0
  managedFields:
  - apiVersion: extensions/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:loadBalancer:
          f:ingress: {}
    manager: traefik
    operation: Update
    time: &quot;2020-09-13T10:08:21Z&quot;
  - apiVersion: networking.k8s.io/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:certmanager.k8s.io/acme-challenge-type: {}
          f:certmanager.k8s.io/issuer: {}
          f:kubernetes.io/ingress.class: {}
          f:meta.helm.sh/release-name: {}
          f:meta.helm.sh/release-namespace: {}
        f:labels:
          .: {}
          f:app.kubernetes.io/instance: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/version: {}
          f:helm.sh/chart: {}
      f:spec:
        f:rules: {}
        f:tls: {}
    manager: Go-http-client
    operation: Update
    time: &quot;2020-09-13T12:37:32Z&quot;
  name: whoami-mn
  namespace: whoami-mn-dev
  resourceVersion: &quot;1127785&quot;
  selfLink: /apis/extensions/v1beta1/namespaces/whoami-mn-dev/ingresses/whoami-mn
  uid: d4ff44a2-a45e-4ef4-ac53-e76c7603d91a
spec:
  rules:
  - host: whoami-mn.myhost.com
    http:
      paths:
      - backend:
          serviceName: whoami-mn
          servicePort: 8080
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - whoami-mn.myhost.com
    secretName: whoami-mn-tls
status:
  loadBalancer:
    ingress:
    - ip: 192.168.0.100
</code></pre>
<p>But the endpoint returns 404 and the logs from traefik contains multiple entries like the following</p>
<pre><code>{&quot;level&quot;:&quot;error&quot;,&quot;msg&quot;:&quot;Error configuring TLS for ingress whoami-mn-dev/whoami-mn: secret whoami-mn-dev/whoami-mn-tls does not exist&quot;,&quot;time&quot;:&quot;2020-09-13T14:44:10Z&quot;}
</code></pre>
<p>Any clue about what I'm doing wrong? Also please let me know if I should post anything else</p>

<p>The key to get this working was annotating my ingress resource correctly.</p>
<pre><code>cert-manager.io/cluster-issuer: letsencrypt-staging
</code></pre>
<p>And NOT the following</p>
<pre><code>certmanager.k8s.io/issuer: letsencrypt-staging
</code></pre>
<p>Version 1.0.1 of cert-manager was used.</p>
