---
title: Setting up Traefik v2 and cert-manager on Kapsule
description: This page explains how to set up and configure Traefik v2 and cert-manager on Kapsule
tags: k8s Kapsule Traefik cert-manager Load-Balancer
hero: assets/scaleway_traefik.webp
products:
  - kubernetes
  - domains-and-dns
  - load-balancer
dates:
  validation: 2025-08-05
  posted: 2020-07-01
  validation_frequency: 12
difficulty: beginner
usecase:
  - resource-management
ecosystem:
  - third-party
---
import Requirements from '@macros/iam/requirements.mdx'

Traefik (pronounced traffic) is a modern HTTP reverse proxy and Load Balancer designed to make the deployment of microservices easy. Traefik integrates with any HTTP and TCP-based applications and every major cluster technology.

Our goal in this tutorial is to:

- Expose [Traefik 2](https://doc.traefik.io/traefik/v2.2/) using a Scaleway Load Balancer
- Deploy a test application on our cluster
- Expose this test application through an ingress object, using [Traefik 2](https://doc.traefik.io/traefik/v2.2/) (deployed by Kapsule)
- Expose this application securely (with `https` and [Let's Encrypt](https://letsencrypt.org/), using [cert-manager](https://github.com/jetstack/cert-manager/))

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- A [Kubernetes Kapsule cluster](/kubernetes/how-to/create-cluster/) with an ingress controller (Traefik 2)
- Downloaded the corresponding [kubeconfig](/kubernetes/how-to/edit-cluster/) file and ensured the [kubectl](/kubernetes/how-to/connect-cluster-kubectl/) is configured and working


### Deploying Traefik 2 using the Easy Deploy feature

1. Log into the [Scaleway console](https://console.scaleway.com/) and navigate to the **Kubernetes** section under **Containers**.
2. Click on your cluster name to view the cluster overview.
3. Go to the **Easy Deploy** tab.
4. Click **Deploy an Application**.
5. Search for **Traefik**  in the **Application Library**, and select **Traefik 2 Ingress**.
6. Name the application `traefik` and set the namespace to `kube-system`.
7. Click **Deploy an application** to deploy Traefik 2.

### Creating a wildcard DNS record

In this step, we will create a wildcard DNS record to point to the external IP address of our Traefik load balancer. This DNS record will allow us to route traffic to our Kubernetes services using custom domain names.

1. Retrieve the external IP of your LoadBalancer:
    ```bash
    kubectl get svc traefik -n kube-system
    ```
    The external IP will be listed under the `EXTERNAL-IP` column.

2. Use a DNS provider to create a wildcard DNS record pointing to your LoadBalancer's IP address.

3. Create a wildcard DNS entry (`*.mytest.com`) pointing to this IP address.

    - Using Scaleway’s Domains and DNS product:
        1. Navigate to the [Domains and DNS product](https://console.scaleway.com/domains/external/).
        2. Create a new DNS zone if you haven't already.
        3. Add a new DNS record with the following details:
            - Type: `A`
            - Name: `*`
            - Value: `your_loadbalancer_ip`

    - Using another DNS provider
        1. Log in to your DNS account and select your domain.
        2. Go to the DNS tab.
        3. Add a new DNS record with the following details:
            - Type: `A`
            - Name: `*`
            - Value: `your_loadbalancer_ip`
        4. Save the record.

### Installing cert-manager

1. Install a recent version of cert-manager, in this example v1.16:
    ```bash
    kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.16.0/cert-manager.yaml
    ```
2. Verify the installation:
    ```bash
    kubectl get pods --namespace cert-manager
    ```

### Creating a Let's Encrypt issuer

1. Open a text editor and create a new file for the ClusterIssuer:
    ```bash
    nano cluster-issuer.yaml
    ```
2. Add the following content to the `cluster-issuer.yaml` file:
    ```yaml
    apiVersion: cert-manager.io/v1
    kind: ClusterIssuer
    metadata:
      name: letsencrypt-prod
    spec:
      acme:
        email: mymail@test.com
        server: https://acme-v02.api.letsencrypt.org/directory
        privateKeySecretRef:
          name: issuer-account-key
        solvers:
          - http01:
              ingress:
                class: traefik
    ```
3. Apply the issuer configuration:
    ```bash
    kubectl apply -f cluster-issuer.yaml
    ```

### Creating and using a Let's Encrypt certificate

1. Open a text editor and create a new file for the certificate:
    ```bash
    nano mycert.yaml
    ```
2. Add the following content to the `mycert.yaml` file:
    ```yaml
    apiVersion: cert-manager.io/v1
    kind: Certificate
    metadata:
      name: teacoffee-cert
      namespace: default
    spec:
      commonName: teacoffee.mytest.com
      secretName: teacoffee-cert
      dnsNames:
        - teacoffee.mytest.com
      issuerRef:
        name: letsencrypt-prod
        kind: ClusterIssuer
    ```
3. Apply the certificate configuration:
    ```bash
    kubectl apply -f mycert.yaml
    ```
4. Verify the certificate creation:
    ```bash
    kubectl describe certificate teacoffee-cert
    ```

### Creating an HTTPS ingress

1. Deploy the "tea coffee" test application:
    ```bash
    kubectl create -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/main/examples/ingress-resources/complete-example/cafe.yaml

2. Open a text editor and create a new file for the HTTPS ingress object:
    ```bash
    nano mysite.yaml
    ```
3. Add the following content to the `mysite.yaml` file:
    ```yaml
    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: testcoffee
      namespace: default
      annotations:
        traefik.ingress.kubernetes.io/router.entrypoints: websecure
    spec:
      tls:
        - secretName: teacoffee-cert
      rules:
        - host: teacoffee.mytest.com
          http:
            paths:
              - path: /tea
                pathType: Prefix
                backend:
                  service:
                    name: tea-svc
                    port:
                      number: 80
              - path: /coffee
                pathType: Prefix
                backend:
                  service:
                    name: coffee-svc
                    port:
                      number: 80
    ```
4. Apply the HTTPS ingress configuration:
    ```bash
    kubectl apply -f mysite.yaml
    ```
5. Test the HTTPS endpoint:
    ```bash
    curl -v https://teacoffee.mytest.com/tea
    ```

### Accessing the Traefik dashboard

1. Retrieve the name of the Traefik Pod:
    ```bash
    kubectl get pods -n kube-system --selector "app.kubernetes.io/name=traefik" --output=name
    ```
    An output similar to the following should display: `pod/traefik-xxxxxxxxx-yyyyy`.

2. Use the exact Pod name from the previous command to port-forward:
    ```bash
    kubectl port-forward -n kube-system <traefik-pod-name> 9000:9000
    ```
    For example:
    ```bash
    kubectl port-forward -n kube-system pod/traefik-xxxxxxxxx-yyyyy 9000:9000
    ```

3. Access the Traefik dashboard at [http://127.0.0.1:9000/dashboard/](http://127.0.0.1:9000/dashboard/).

This corrected approach ensures you are specifying both the resource name and the ports correctly for the `kubectl port-forward` command.

### Conclusion

You have successfully set up Traefik v2 and cert-manager on Scaleway Kubernetes Kapsule, exposed a test application using Traefik, and secured it with a Let's Encrypt certificate. For further information, you may refer to the [official documentation for Let's Encrypt](https://letsencrypt.org/), [Traefik 2](https://doc.traefik.io/traefik/v2.2/), and [cert-manager](https://cert-manager.io/docs/).