<p>I am trying to work on simplest possible <a href="https://github.com/codeaprendiz/kubernetes-kitchen/tree/master/gcp/task-004-traefik/traefik-2.2/part3-traefik-whoami-lets-encrypt" rel="nofollow noreferrer">example</a> of implementing let's encrypt with Traefik on GKE using this <a href="https://docs.traefik.io/v2.0/user-guides/crd-acme/" rel="nofollow noreferrer">article</a>. I have made some changes to suit my requirement but I am unable to get the ACME certificate.</p>

<p>What I have done so far</p>

<ul>
<li>Run the following command and create all the resource objects except ingress-route</li>
</ul>

<pre class="lang-sh prettyprint-override"><code>$ kubectl apply -f 00-resource-crd-definition.yml,05-traefik-rbac.yml,10-service-account.yaml,15-traefik-deployment.yaml,20-traefik-service.yaml,25-whoami-deployment.yaml,30-whoami-service.yaml
customresourcedefinition.apiextensions.k8s.io/ingressroutes.traefik.containo.us created
customresourcedefinition.apiextensions.k8s.io/middlewares.traefik.containo.us created
customresourcedefinition.apiextensions.k8s.io/ingressroutetcps.traefik.containo.us created
customresourcedefinition.apiextensions.k8s.io/tlsoptions.traefik.containo.us created
customresourcedefinition.apiextensions.k8s.io/traefikservices.traefik.containo.us created
clusterrole.rbac.authorization.k8s.io/traefik-ingress-controller created
clusterrolebinding.rbac.authorization.k8s.io/traefik-ingress-controller created
serviceaccount/traefik-ingress-controller created
deployment.apps/traefik created
service/traefik created
deployment.apps/whoami created
service/whoami created
</code></pre>

<ul>
<li>Get the IP of the Traefik Service exposed as Load Balancer</li>
</ul>

<pre class="lang-sh prettyprint-override"><code>$ kubectl get service
NAME         TYPE           CLUSTER-IP      EXTERNAL-IP    PORT(S)                                     AGE
kubernetes   ClusterIP      10.109.0.1      &lt;none&gt;         443/TCP                                     6h16m
traefik      LoadBalancer   10.109.15.230   34.69.16.102   80:32318/TCP,443:32634/TCP,8080:32741/TCP   70s
whoami       ClusterIP      10.109.14.91    &lt;none&gt;         80/TCP                                      70s
</code></pre>

<ul>
<li>Create a DNS record for this IP</li>
</ul>

<pre class="lang-sh prettyprint-override"><code>$ nslookup k8sacmetest.gotdns.ch
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   k8sacmetest.gotdns.ch
Address: 34.69.16.102
</code></pre>

<ul>
<li>Create the resource ingress-route</li>
</ul>

<pre class="lang-sh prettyprint-override"><code>$ kubectl apply -f 35-ingress-route.yaml
ingressroute.traefik.containo.us/simpleingressroute created
ingressroute.traefik.containo.us/ingressroutetls created
</code></pre>

<ul>
<li>Logs of traefik</li>
</ul>

<pre class="lang-sh prettyprint-override"><code>time="2020-04-25T20:10:31Z" level=info msg="Configuration loaded from flags."
time="2020-04-25T20:10:32Z" level=error msg="subset not found for default/whoami" providerName=kubernetescrd ingress=simpleingressroute namespace=default
time="2020-04-25T20:10:32Z" level=error msg="subset not found for default/whoami" providerName=kubernetescrd ingress=ingressroutetls namespace=default
time="2020-04-25T20:10:52Z" level=error msg="Unable to obtain ACME certificate for domains \"k8sacmetest.gotdns.ch\": unable to generate a certificate for the domains [k8sacmetest.gotdns.ch]: acme: Error -&gt; One or more domains had a problem:\n[k8sacmetest.gotdns.ch] acme: error: 400 :: urn:ietf:params:acme:error:connection :: Timeout during connect (likely firewall problem), url: \n" routerName=default-ingressroutetls-08dd2bb9eecaa72a6606@kubernetescrd rule="Host(`k8sacmetest.gotdns.ch`) &amp;&amp; PathPrefix(`/tls`)" providerName=default.acme
</code></pre>

<p>What i have acheived</p>

<ul>
<li>Traefik Dashboard</li>
</ul>

<p><a href="https://github.com/codeaprendiz/kubernetes-kitchen/blob/master/gcp/task-004-traefik/traefik-2.2/part3-traefik-whoami-lets-encrypt/.ReadMe_images/dashboard.png" rel="nofollow noreferrer">link</a></p>

<ul>
<li>Whoami with notls</li>
</ul>

<p><a href="https://github.com/codeaprendiz/kubernetes-kitchen/blob/master/gcp/task-004-traefik/traefik-2.2/part3-traefik-whoami-lets-encrypt/.ReadMe_images/whoami-server-notls.png" rel="nofollow noreferrer">link</a></p>

<h2>NOT ABLE TO GET THE ACME CERTIFICATE USING FOR TLS WHOAMI</h2>

<p><a href="https://github.com/codeaprendiz/kubernetes-kitchen/blob/master/gcp/task-004-traefik/traefik-2.2/part3-traefik-whoami-lets-encrypt/.ReadMe_images/unsuccessful-output-tls-try.png" rel="nofollow noreferrer">my-pain</a></p>

<h2>INFRA Details</h2>

<ul>
<li>I am using Google Kubernetes Cluster (the one being talked about here -cloud.google.com/kubernetes-engine, click on Go to Console). </li>
<li>Traefik version is 2.2. </li>
<li>And I am using "CloudShell" to access the cluster". </li>
</ul>

<h2>ASK:</h2>

<p>1) Where am i going wrong to get the TLS Certificate? </p>

<p>2) If its firewall issue how to resolve?</p>

<p>3) If you have any other better example for <code>Treafik Let's encrypt simplest example on GKE</code> please let me know</p>

codeaprendiz
<p>Just run <code>sudo</code> before <code>kubectl port-forward</code> command. You are trying to bind to privileged ports, so you need more permissions.</p>

<p>It is not the simplest example for GKE, because you could use GKE LoadBalnacer instead of <code>kubectl port-forward</code>.</p>

<p>Try with this:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Service
metadata:
  name: traefik
spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
      targetPort: web
    - protocol: TCP
      name: websecure
      port: 443
      targetPort: websecure
  selector:
    app: traefik
  type: LoadBalancer
</code></pre>

<p>Then you can find your new IP with <code>kubectl get svc</code> in <code>EXTERNAL-IP</code> column, add proper DNS record for your domain and you should be fine.</p>
