--- title: "Using Traefik and Letsencrypt with k3s Kubernetes" description: "Learn how to configure LetsEncrypt with K3S Kubernetes and Traefik for a flexible application management solution with this ATA Learning tutorial!" canonical: "https://adamtheautomator.com/letsencrypt-with-k3s-kubernetes/" --- # Using Traefik and Letsencrypt with k3s Kubernetes > Learn how to configure LetsEncrypt with K3S Kubernetes and Traefik for a flexible application management solution with this ATA Learning tutorial! Source: https://adamtheautomator.com/letsencrypt-with-k3s-kubernetes/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Using Traefik and Letsencrypt with k3s Kubernetes](https://adamtheautomator.com/wp-content/uploads/2023/11/letsencrypt-with-k3s-kubernetes.jpg) # Using Traefik and Letsencrypt with k3s Kubernetes [![](https://secure.gravatar.com/avatar/7546fc46bac8d5c9ebe2171a762a1dcb0f37199e1595c848b851b8c850756e0d?s=192&d=mm&r=g)Rose Chege](https://adamtheautomator.com/author/rose-chege/)3 November 20238 min. read Categories: [DevOps](/category/devops/) Tags:[Kubernetes](/tag/kubernetes/)[Letsencrypt](/tag/letsencrypt/)[Traefix](/tag/traefix/) Table of Contents * [Prerequisites](#prerequisites) * [Installing a k3s Cluster](#installing-a-k3s-cluster) * [Configuring a Cert-Manager with k3s](#configuring-a-cert-manager-with-k3s) * [Ensuring Seamless Certificate Renewals with a ClusterIssuer](#ensuring-seamless-certificate-renewals-with-a-clusterissuer) * [Configuring Your k3s Cluster with Traefik and Cert-Manager](#configuring-your-k3s-cluster-with-traefik-and-cert-manager) * [Conclusion](#conclusion) Grappling with the intricacies of managing certificates, routing, and securing your applications is a common struggle and can be a real headache. The good news is that there is a way to navigate these complexities — Traefik and LetsEncrypt with k3s Kubernetes. In this tutorial, you will learn how this trio can help streamline operations and ensure secure communication while managing certificates effortlessly. Read on and start creating a robust foundation for secure and efficient operations! ## **Prerequisites** Before you dive deeper, ensure you have the necessary components and information in place to follow along in this tutorial: * A ready domain name you want your cluster accessed over HTTPS – This tutorial uses _thriveread.site_. * A [domain DNS A record](https://www.servers.com/support/knowledge/dedicated-servers/how-to-point-your-domain-name-to-dedicated-servers-ip-address) pointing to your IP address. * A working remote server – This guide uses Ubuntu 22.00 LTS, but you can use [AWS EC2 to create a K3s](https://thriveread.com/k3s-on-aws-ec2/) cluster. Related:[How to Create a Kubernetes Cluster With the AWS EKS CLI](https://adamtheautomator.com/aws-eks-cli/) * [kubectl](https://kubernetes.io/docs/tasks/tools/) installed and configured on your server. * [Traefik](https://doc.traefik.io/traefik/getting-started/install-traefik/) installed on your k3s Cluster. ## **Installing a k3s Cluster** Coming off the back of your prerequisites checklist, it is time to dive into the heart of the matter — installing a k3s cluster. This process is crucial to leveraging the power of Traefik and Let’s Encrypt effectively. Related:[How to Get Started Building Kubernetes Clusters with kubeadm](https://adamtheautomator.com/kubeadm/) Engineering k3s production access with valid TLS certificates creates trust in whoever is accessing your services by enhancing SSL/TLS from your k3s installation. To install a k3s cluster, carry out these steps: Open a terminal on your server, and run the below command to perform the following: * Download (`curl`) the latest k3s binaries from the _`https://get.k3s.io`_ URL silently and follow redirects if necessary (`-sfL`). Related:[CURL Linux Command : Learning By Example](https://adamtheautomator.com/curl-linux/) * Set an environment variable (`INSTALL_K3S_EXEC`), specifying the SERVER\_IP address for which TSL certificates should be generated (`--tls-san`). Thus, ensure you replace `SERVER_IP` with your server’s IP address. This way, your server IP address is added as [Subject Alternative Name (SAN)](https://www.ssl.com/article/the-essential-guide-to-san-certificates/), so k3s can securely communicate over TLS using your server IP address. * Execute shell commands (`sh`) that make the shell read commands from the standard input (`-s`) and specify the permissions mode for the generated kubeconfig file (`--write-kubeconfig-mode`). In this case, the shell command sets the mode to `644`, which sets the file to be readable and writable by the owner and readable only by others. In summary, this command immediately installs and starts a k3s cluster. ```bash curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--tls-san SERVER_IP" sh -s - --write-kubeconfig-mode 644 ``` ![letsencrypt with k3s kubernetes - Installing a k3s cluster](https://adamtheautomator.com/wp-content/uploads/2023/11/image-1.png) Installing a k3s cluster Next, run each `kubectl` command below to get all nodes in your cluster and an overview of your cluster’s configuration. ```bash # List all nodes in the cluster kubectl get nodes # View the cluster's configuration kubectl cluster-info ``` The following output, where you see a **master** node in **Ready** status, confirms your k3s cluster is correctly installed and ready to run your workload. At this point, your domain name sends traffic to your server. ![Checking if the k3s cluster is running](https://adamtheautomator.com/wp-content/uploads/2023/11/image.png) Checking if the k3s cluster is running ## **Configuring a Cert-Manager with k3s** With your k3s cluster running, it requires a way to handle certificates seamlessly. A cert-manager uses certificate issuers such as Let’s Encrypt to add certificates to your Kubernetes cluster. Imagine your applications needing to communicate securely over the internet. In such cases, SSL certificates come into play. To configure a cert-manager for secure connections, proceed with the following: 1\. Execute the below command to `create` a Kubernetes `namespace` called `cert-manager` (arbitrary) you will use to manage any generated certificates. If successful, creating a namespace does not produce output on the terminal, which applies throughout this tutorial. ```bash kubectl create namespace cert-manager ``` > _💡 Note that you can also get a [cert-manager](https://cert-manager.io/docs/installation/helm/) using Helm charts._ 2\. Next, run the `kubectl apply` command to create Custom Resource Definitions (CRDs) and deploy the cert-manager and its components to your k3s cluster. ```bash kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.1/cert-manager.yaml ``` ![Deploying the cert-manager and its components to the k3s cluster](https://adamtheautomator.com/wp-content/uploads/2023/11/image-3.png) Deploying the cert-manager and its components to the k3s cluster Related:[Kubernetes Helm : A Getting Started Guide](https://adamtheautomator.com/kubernetes-helm/) 3\. Finally, run the following command to query your k3s cluster and `get` a list of all the `pods` in the `cert-manager` namespace. ```bash kubectl get pods --namespace cert-manager ``` The **Running** state below verifies your deployed cert-manager runs as expected. ![Verifying the cert-manager pods](https://adamtheautomator.com/wp-content/uploads/2023/11/image-2.png) Verifying the cert-manager pods ## **Ensuring Seamless Certificate Renewals with a `ClusterIssuer`** After laying the foundation for secure communication with your cert-manager, you need a bridge between your cert-manager and your k3s cluster — a `ClusterIssuer`. This bridge ensures your certificates are issued and renewed seamlessly. In this example, you use the [ACME issuer](https://cert-manager.io/docs/configuration/acme/) server to generate cert-manager keys over [HTTP01](https://cert-manager.io/docs/configuration/acme/http01//) (Ingress solver) challenge validation. Related:[Gearing up NGINX Kubernetes Ingress Controller](https://adamtheautomator.com/kubernetes-ingress/) To ensure seamless certificate renewals, follow the steps below: 1\. Create a _certs.yml_ file with your preferred editor (i.e., Visual Studio Code), populate the following configuration, and save and close the file. This configuration establishes a `ClusterIssuer` named `letsencrypt-certificate` associated with a Let’s Encrypt account. Moreover, this configuration defines the settings for certificate issuance. These settings include how to handle challenges for validation through an Ingress controller (`traefik`). ```yaml apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: # Name your ClusterIssuer resource name: letsencrypt-certificate # Add the cert-manager namespace you created earlier namespace: cert-manager spec: acme: # Let's Encrypt ACME server (The server URL) server: https://acme-v02.api.letsencrypt.org/directory # Replace this with your email to be associated with the Let's Encrypt account email: exmaple@gmail.com privateKeySecretRef: # Name a secret key you'll use on Ingress to access ClusterIssuer # This key's name tells ClusterIssuer where the private key is stored name: example.letsencrypt.key.tls solvers: - selector: {} # Add http01 challenge for key validation http01: ingress: # Specify the Ingress controller that will use the HTTP01 challenges class: traefik ``` 2\. Next, execute the below `kubectl apply` command to deploy the `ClusterIssuer` resource in your `certs.yml` configuration file to your k3s cluster. ```bash kubectl apply -f certs.yml ``` ![Deploying a ClusterIssuer resource to the k2s cluster](https://adamtheautomator.com/wp-content/uploads/2023/11/image-6.png) Deploying a `ClusterIssuer` resource to the k2s cluster 3\. Once deployed, run the command below to retrieve (`describe`) detailed information about your `ClusterIssuer` resource (`letsencrypt-certificate`). ```bash kubectl describe clusterissuer letsencrypt-certificate ``` If successfully deployed, your `ClusterIssuer` will have properly applied certificate keys and ACME server **Ready**, as shown below. ![Checking a deployed ClusterIssuer](https://adamtheautomator.com/wp-content/uploads/2023/11/image-5.png) Checking a deployed ClusterIssuer 4\. Now, run the following command to retrieve a list of CRDs related to the `cert-manager`. ```bash kubectl get cert-manager ``` The output below demonstrates that the CRDs for cert-manager have been properly configured and are accessible within your k3s cluster. This configuration is an essential prerequisite for your cert-manager to manage TLS certificates correctly. ![Verifying CRDs for cert-manager are accessible within the k3s cluster](https://adamtheautomator.com/wp-content/uploads/2023/11/image-4.png) Verifying CRDs for cert-manager are accessible within the k3s cluster ## **Configuring Your k3s Cluster with Traefik and Cert-Manager** Like deploying a `ClusterIssuer` for certificate renewals, seamless and secure certificate management is equally crucial. Configuring Traefik for routing and cert-manager is critical to a robust and secure Kubernetes setup. By now, you have LetsEncrypt ready to expose your Ingress controller and deliver secure Kubernetes traffic to your cluster. But imagine having a perfectly orchestrated symphony of tools working harmoniously in your k3s cluster — sheer convenience! To configure your k3s cluster with Traefik and cert-manager, you must create a deployment and a service for your application using NGINX as follows: Related:[The Getting Started Guide to Kubernetes Services](https://adamtheautomator.com/kubernetes-services/) 1\. Execute the following command to `create` a `namespace` called `deployment` (arbitrary) for your application. ```bash kubectl create namespace deployment ``` Related:[A Getting Started Guide to Kubernetes Namespaces](https://adamtheautomator.com/kubernetes-namespaces/) 2\. Next, create a _deployment.yml_ file, add the following configurations, save the file, and close the editor. These configurations create a `Deployment` and a `Service` to run and expose your NGINX container. ```yaml # Define a Deployment resource apiVersion: apps/v1 kind: Deployment metadata: # Name of the Deployment resource name: nginx-dep spec: # Create one replica of the pod replicas: 1 selector: # Label used to select pods controlled by this Deployment matchLabels: app: nginx template: metadata: labels: # Label applied to pods created by this Deployment app: nginx spec: containers: - name: nginx # Use the latest NGINX image image: nginx:latest ports: - containerPort: 80 # Define a Service resource --- apiVersion: v1 kind: Service metadata: # Name of the Service resource name: nginx-srv spec: selector: # Label used to select pods that this service applies to app: nginx ports: - protocol: TCP # Service listens on port 80 port: 80 # Forward traffic to pods on port 80 targetPort: 80 # Type of the Service (ClusterIP in this case) type: Cluster ``` 3\. Now, run the below command to `apply` the configurations defined in the `deployment.yml` file, which creates and exposes your NGINX container. ```bash kubectl apply -f deployment.yml ``` ![Creating a Kubernetes deployment](https://adamtheautomator.com/wp-content/uploads/2023/11/image-14.png) Creating a Kubernetes deployment 4\. Once created, invoke each command below to retrieve (`get`) information about your Kubernetes resources, which are `deployment` (`nginx-dep`) and `service` (`nginx-srv`). ```bash kubectl get deployment nginx-dep kubectl get service nginx-srv ``` The output below confirms your NGINX resources have been created successfully. ![Checking the Kubernetes deployment and service resources](https://adamtheautomator.com/wp-content/uploads/2023/11/image-13.png) Checking the Kubernetes deployment and service resources 5\. Create an _ingress.yml_ file, populate the following configuration, save the file, and close the editor. This configuration adds Let’s Encrypt to the Traefik Ingress controller. Ensure you replace the following with your own accordingly: * `letsencrypt-certificate` – The ClusterIssuer resource name. * `example.letsencrypt.key.tls` – The `secretName` added as `privateKeySecretRef` name in your ClusterIssuer. * `domain_name` – The domain name you used to access your k3s server via IP address. * `nginx-srv` – The service name for exposing your NGINX container. ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: # Name the Ingress resource name: nginx-ingress annotations: # Use Traefik as the Ingress controller kubernetes.io/ingress.class: traefik # Add Cert-Manager SSL certificates as the name of the ClusterIssuer resource cert-manager.io/cluster-issuer: letsencrypt-certificate spec: # TLS configuration for HTTPS tls: # TLS secretName used on ClusterIssuer - secretName: example.letsencrypt.key.tls hosts: # Replace with your domain name - domain_name # Create Ingress routing rules rules: # Replace with your domain name - host: domain_name http: paths: - path: / pathType: Prefix backend: service: # Name of your service resource name: nginx-srv port: # Port number to forward traffic to number: 80 ``` 6\. Now, run the below command to `apply` the configurations defined in the `ingress.yml` file, which deploys the Ingress controller. ```bash kubectl apply -f ingress.yml ``` ![Deploying the Ingress controller](https://adamtheautomator.com/wp-content/uploads/2023/11/image-12.png) Deploying the Ingress controller 7\. Following the deployment, run the command below to retrieve (`get`) a list of `ingress` resources in your k3s cluster. ```bash kubectl get ingress ``` The output below indicates that the Ingress resources have been successfully created. ![Checking a running Ingress](https://adamtheautomator.com/wp-content/uploads/2023/11/image-11.png) Checking a running Ingress 8\. Next, run the following command to view (`describe`) detailed information about the specified `certificate` resource. This command is useful for inspecting the status and details of certificates within your k3s cluster. ```bash kubectl describe certificate ``` As shown below, Let’s Encrypt verifies that the TLS certificate has been successfully applied to your Ingress. ![Checking whether Let’s Encrypt works within Ingress ](https://adamtheautomator.com/wp-content/uploads/2023/11/image-10.png) Checking whether Let’s Encrypt works within Ingress At the same time, the **Status** and **Events** sections confirm the cert-manager is successfully issued and ready to route traffic to your k3s cluster securely. ![Verifying the cert-manager is ready to route traffic to the k3s cluster](https://adamtheautomator.com/wp-content/uploads/2023/11/image-9.png) Verifying the cert-manager is ready to route traffic to the k3s cluster 9\. Head over to your domain name and verify if a valid certificate was deployed to your cluster. If everything works well, you can access your cluster over secure HTTPS connections with a valid certificate by Let’s Encrypt, as shown below. ![Accessing K3s over secure HTTPS](https://adamtheautomator.com/wp-content/uploads/2023/11/image-8.png) Accessing K3s over secure HTTPS 10\. Finally, expand **Connection is secure,** and you can verify the certificate is valid as follows. ![Verifying connection is secure over HTTPS](https://adamtheautomator.com/wp-content/uploads/2023/11/image-7.png) Verifying connection is secure over HTTPS ## **Conclusion** You have just completed an exhilarating journey through the intricacies of setting up a robust and secure Kubernetes environment with Traefik and Let’s Encrypt with k3s Kubernetes. From installing the k3s cluster to configuring a cert-manager and ensuring seamless certificate renewals with a `ClusterIssuer`. Now, armed with this newfound knowledge, there are endless possibilities to explore. Why not consider [fine-tuning your configurations](https://kubernetes.io/docs/concepts/configuration/overview/) to suit specific project requirements? Or dive deeper and elevate Kubernetes security by [keeping Kubernetes Secrets Safe](https://adamtheautomator.com/kubernetes-secrets/)? The sky’s the limit, and your newly acquired skills are the launchpad to even more exciting Kubernetes adventures! Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fletsencrypt-with-k3s-kubernetes%2F&text=Using%20Traefik%20and%20Letsencrypt%20with%20k3s%20Kubernetes)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fletsencrypt-with-k3s-kubernetes%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fletsencrypt-with-k3s-kubernetes%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/07/featured_image-3.png) ### [Build Your First Internal Developer Platform](/build-first-internal-developer-platform/) Build your first Internal Developer Platform with Backstage, a software catalog, software templates, CI/CD handoffs, and Kubernetes deployment manifests. ![](https://adamtheautomator.com/wp-content/uploads/2026/06/featured_image-9.png) ### [DevOps to Platform Engineer: 2026 Transition Roadmap](/devops-platform-engineer-2026-transition-roadmap/) Learn how to move from DevOps to platform engineering in 2026 with a practical roadmap covering transferable skills, internal developer platforms, Backstage, Crossplane, and portfolio projects. ![](https://adamtheautomator.com/wp-content/uploads/2024/02/kubernetes-blue-green.jpg) ### [Learning the Kubernetes Blue Green Deployment Strategy](/kubernetes-blue-green/) Dive into Kubernetes blue-green deployments for smooth updates. Enhance your release process with this smart Kubernetes strategy! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)