Skip to main content

Provide Certificates

There are two ways to provide user-defined TLS certificates to Traefik Hub API Gateway in Kubernetes:

To create a TLS Secret, please refer to the official Kubernetes documentation.

Attach a TLS Certificate to an IngressRoute

You can provide a TLS certificate to Traefik Hub API Gateway using the tls option in an IngressRoute. The secret that contains the TLS certificate must belong to same namespace as the IngressRoute.

As explained here, it does not mean that the certificate is only attached to this IngressRoute. It can be served when another route, with the same host name, is reached through Hub API Gateway.

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: my-tls-route
namespace: apps
spec:
entryPoints:
- websecure
routes:
- match: Host(`whoami.localhost`)
kind: Rule
services:
- name: whoami
port: 80
tls:
secretName: secret-tls

Attach TLS certificates to a certificate store

You can provide TLS certificates to Traefik Hub API Gateway using a TLSStore. The secrets that contains the TLS certificates must belong to same namespace as the TLSStore.

The TLSStore must be named default, and it must belong to the namespace as Traefik Hub API Gateway.

"Restriction"

Any store definition other than the default one (named default) will be ignored, and there is therefore only one globally available TLS store.

Default Certificate

You can override the self-signed certificates provided by default by Traefik Hub API Gateway using the options defaultCertificate or the defaultGeneratedCert.

See the dedicated documentation for more information.

apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
name: default # Only the store with the name default is taken into account
namespace: traefik
spec:
certificates:
- secretName: secret-tls-01
- secretName: secret-tls-02
defaultCertificate:
secretName: secret-tls-default