<p>I'm deploying taefik to my kubernetes cluster using helm.  Here's what I have at the moment:</p>

<pre><code>helm upgrade --install load-balancer --wait --set ssl.enabled=true,ssl.enforced=true,acme.enabled=true,acme.email=an@email.com stable/traefik
</code></pre>

<p>I'm trying to configure letsencrypt. According to this <a href="https://docs.traefik.io/user-guide/examples/#lets-encrypt-support" rel="nofollow noreferrer">documentation</a> - you add the domains to the bottom of the .toml file.</p>

<p>Looking at the code for the helm <a href="https://github.com/kubernetes/charts/blob/master/stable/traefik/templates/configmap.yaml" rel="nofollow noreferrer">chart</a>, there's no provision for such configuration.</p>

<p>Is there another way to do this or do I need to fork the chart to create my own variation of the .toml file?</p>

<p>Turns out this is the chicken and the egg problem, described <a href="https://github.com/kubernetes/charts/issues/889" rel="noreferrer">here</a>.</p>

<p>For the helm chart, if <code>acme.enabled</code> is set to <code>true</code>, then Treafik will automatically generate and serve certificates for domains configured in Kubernetes ingress rules. This is the purpose of the <code>onHostRule = true</code> <a href="https://github.com/kubernetes/charts/blob/master/stable/traefik/templates/configmap.yaml#L55" rel="noreferrer">line</a> in the yaml file (referenced above).</p>

<p>To use Traefik with Let's Encrypt, we have to create an A record in our DNS server that points to the ip address of our load balancer. Which we can't do until Traefik is up and running. However, this configuration needs to exist <strong>before</strong> Traefik starts.</p>

<p>The only solution (at this stage) is to kill the first Pod after the A record configuration has propagated.</p>
