<p>When I only add the TLS secret to the Ingress, Traefik serves it's default certificate.</p>

<pre><code>kind: Ingress
spec:
  rules:
    ....
  tls:
  - secretName: ingress-mgt-server-keys
</code></pre>

<p>Only when I mount the secret and add below parameter, does Traefik start serving the real certificate.</p>

<blockquote>
  <p>entryPoints.https.tls.certificates</p>
</blockquote>

<p><strong>Are TLS secrets to be define in both Ingress and Ingress-controller</strong>? This forces me to repeat the keys as secrets to all the ingress namespaces as well as the ingress-controller namespace.</p>

<p>[Update]: Traefik has RBAC to read secrets from the target namespace.</p>

<p>Hmm, that does not seem to be the case.</p>

<p><a href="https://docs.traefik.io/user-guide/kubernetes/#add-a-tls-certificate-to-the-ingress" rel="nofollow noreferrer">https://docs.traefik.io/user-guide/kubernetes/#add-a-tls-certificate-to-the-ingress</a></p>

<p><code>In addition to the modified ingress you need to provide the TLS certificate via a Kubernetes secret in the same namespace as the ingress.</code></p>
