<p>We deploy service with helm. The ingress template looks like that:</p>
<pre><code>---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ui-app-ingress
  {{- with .Values.ingress.annotations}}
  annotations:
    {{- toYaml . | nindent 4}}
  {{- end}}
spec:
  rules:
  - host: {{ .Values.ingress.hostname }}
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name:  {{ include &quot;ui-app-chart.fullname&quot; . }}
            port:
              number: 80
  tls:
  - hosts:
      - {{ .Values.ingress.hostname }}
    secretName: {{ .Values.ingress.certname }}
</code></pre>
<p>as you can see, we already use <code>networking.k8s.io/v1</code> but if i watch the treafik logs, i find this error:</p>
<p><code> 1 reflector.go:138] pkg/mod/k8s.io/client-go@v0.20.2/tools/cache/reflector.go:167: Failed to watch *v1beta1.Ingress: failed to list *v1beta1.Ingress: the server could not find the requested resource (get ingresses.extensions)</code></p>
<p>what results in tls cert error:</p>
<pre><code>time=&quot;2022-06-07T15:40:35Z&quot; level=debug msg=&quot;Serving default certificate for request: \&quot;example.de\&quot;&quot;
time=&quot;2022-06-07T15:40:35Z&quot; level=debug msg=&quot;http: TLS handshake error from 10.1.0.4:57484: remote error: tls: unknown certificate&quot;
time=&quot;2022-06-07T15:40:35Z&quot; level=debug msg=&quot;Serving default certificate for request: \&quot;example.de\&quot;&quot;
time=&quot;2022-06-07T15:53:06Z&quot; level=debug msg=&quot;Serving default certificate for request: \&quot;\&quot;&quot;
time=&quot;2022-06-07T16:03:31Z&quot; level=debug msg=&quot;Serving default certificate for request: \&quot;&lt;ip-adress&gt;\&quot;&quot;
time=&quot;2022-06-07T16:03:32Z&quot; level=debug msg=&quot;Serving default certificate for request: \&quot;&lt;ip-adress&gt;\&quot;&quot;
PS C:\WINDOWS\system32&gt;
</code></pre>
<p>i already found out that <code>networking.k8s.io/v1beta1</code> is not longer served, but <code>networking.k8s.io/v1</code> was defined in the template all the time as ApiVersion.</p>
<p>Why does it still try to get from <code>v1beta1</code>? And how can i fix this?</p>
<p>We use this TLSOptions:</p>
<pre><code>apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
  name: default
  namespace: default

spec:
  minVersion: VersionTLS12
  maxVersion: VersionTLS13
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

</code></pre>
<p>we use helm-treafik rolled out with terraform:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: &quot;2&quot;
    meta.helm.sh/release-name: traefik
    meta.helm.sh/release-namespace: traefik
  creationTimestamp: &quot;2021-06-12T10:06:11Z&quot;
  generation: 2
  labels:
    app.kubernetes.io/instance: traefik
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: traefik
    helm.sh/chart: traefik-9.19.1
  name: traefik
  namespace: traefik
  resourceVersion: &quot;86094434&quot;
  uid: 903a6f54-7698-4290-bc59-d234a191965c
spec:
  progressDeadlineSeconds: 600
  replicas: 3
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: traefik
      app.kubernetes.io/name: traefik
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app.kubernetes.io/instance: traefik
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: traefik
        helm.sh/chart: traefik-9.19.1
    spec:
      containers:
      - args:
        - --global.checknewversion
        - --global.sendanonymoususage
        - --entryPoints.traefik.address=:9000/tcp
        - --entryPoints.web.address=:8000/tcp
        - --entryPoints.websecure.address=:8443/tcp
        - --api.dashboard=true
        - --ping=true
        - --providers.kubernetescrd
        - --providers.kubernetesingress
        - --providers.file.filename=/etc/traefik/traefik.yml
        - --accesslog=true
        - --accesslog.format=json
        - --log.level=DEBUG
        - --entrypoints.websecure.http.tls
        - --entrypoints.web.http.redirections.entrypoint.to=websecure
        - --entrypoints.web.http.redirections.entrypoint.scheme=https
        - --entrypoints.web.http.redirections.entrypoint.permanent=true
        - --entrypoints.web.http.redirections.entrypoint.to=:443
        image: traefik:2.4.8
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /ping
            port: 9000
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2
        name: traefik
        ports:
        - containerPort: 9000
          name: traefik
          protocol: TCP
        - containerPort: 8000
          name: web
          protocol: TCP
        - containerPort: 8443
          name: websecure
          protocol: TCP
        readinessProbe:
          failureThreshold: 1
          httpGet:
            path: /ping
            port: 9000
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2
        resources: {}
        securityContext:
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsGroup: 0
          runAsNonRoot: false
          runAsUser: 0
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /data
          name: data
        - mountPath: /tmp
          name: tmp
        - mountPath: /etc/traefik
          name: traefik-cm
          readOnly: true
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        fsGroup: 65532
      serviceAccount: traefik
      serviceAccountName: traefik
      terminationGracePeriodSeconds: 60
      tolerations:
      - effect: NoSchedule
        key: env
        operator: Equal
        value: conhub
      volumes:
      - emptyDir: {}
        name: data
      - emptyDir: {}
        name: tmp
      - configMap:
          defaultMode: 420
          name: traefik-cm
        name: traefik-cm
status:
  availableReplicas: 3
  conditions:
  - lastTransitionTime: &quot;2022-06-07T09:19:58Z&quot;
    lastUpdateTime: &quot;2022-06-07T09:19:58Z&quot;
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: &quot;True&quot;
    type: Available
  - lastTransitionTime: &quot;2021-06-12T10:06:11Z&quot;
    lastUpdateTime: &quot;2022-06-07T16:39:01Z&quot;
    message: ReplicaSet &quot;traefik-84c6f5f98b&quot; has successfully progressed.
    reason: NewReplicaSetAvailable
    status: &quot;True&quot;
    type: Progressing
  observedGeneration: 2
  readyReplicas: 3
  replicas: 3
  updatedReplicas: 3
</code></pre>
<pre><code>resource &quot;helm_release&quot; &quot;traefik&quot; {
  name              = &quot;traefik&quot;
  namespace         = &quot;traefik&quot;
  create_namespace  = true

  repository = &quot;https://helm.traefik.io/traefik&quot;
  chart      = &quot;traefik&quot;

  set {
    name  = &quot;service.spec.loadBalancerIP&quot;
    value = azurerm_public_ip.pub_ip.ip_address
  }

  set {
    name  = &quot;service.annotations.service\\.beta\\.kubernetes\\.io/azure-load-balancer-resource-group&quot;
    value = var.resource_group_aks
  }

  set {
    name = &quot;additionalArguments&quot;
    value = &quot;{--accesslog=true,--accesslog.format=json,--log.level=DEBUG,--entrypoints.websecure.http.tls,--entrypoints.web.http.redirections.entrypoint.to=websecure,--entrypoints.web.http.redirections.entrypoint.scheme=https,--entrypoints.web.http.redirections.entrypoint.permanent=true,--entrypoints.web.http.redirections.entrypoint.to=:443}&quot;
  }

  set {
    name = &quot;deployment.replicas&quot;
    value = 3
  }

  timeout = 600

  depends_on = [
    azurerm_kubernetes_cluster.aks
  ]
}
</code></pre>

DaveVentura
<p>I found out that the problem was the version of the traefik image:</p>
<p>i quick fixed it by setting the latest image:</p>
<p><code>kubectl set image deployment/traefik traefik=traefik:2.7.0 -n traefik</code></p>
