Answers: <p>My not-very-elegant solution was to uninstall portainer</p>
  <pre class="lang-sh prettyprint-override"><code>kubectl delete namespace portainer
  kubectl delete ClusterRoleBinding portainer
  </code></pre>
  <p>and reinstall it using helm:</p>
  <pre class="lang-sh prettyprint-override"><code>helm upgrade --install --create-namespace -n portainer portainer portainer/portainer \
      --set tls.force=true \
      --set tls.existingSecret=portainer-tls-secret 
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2023-09-23T19:36:00.520Z
Answers: 2023-09-23T19:36:00.520Z
Answers: JoSSte
Body: <p>I have a running k3s cluster with portainer and helm, and I just got cert-manager with letsencrypt set up as a <code>ClusterIssuer</code></p>
  <p>Now I would like to enforce https and use the certificate I created for portainer:</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    name: portainer-tls-secret
    namespace: portainer
  spec:
    secretName: portainer-tls-secret
    duration: 2160h # 90d
    renewBefore: 360h # 15d
    subject:
      organizations:
        - &lt;redacted&gt;
    commonName: portainer.k8s.mydomain.tld
    isCA: false
    privateKey:
      algorithm: RSA
      encoding: PKCS1
      size: 4096
    usages:
      - server auth
      - client auth
    dnsNames:
      - portainer.k8s.mydomain.tld
    issuerRef:
      name: letsencrypt-prod
      kind: ClusterIssuer
      group: cert-manager.io
  </code></pre>
  <p>This works beautifully:<br />
  <code>kubectl get Certificate --all-namespaces</code></p>
  <blockquote>
  <pre><code>NAMESPACE      NAME                                  READY   SECRET                                    AGE
  portainer      portainer-tls-secret                  True    portainer-tls-secret                      11m
  </code></pre>
  </blockquote>
  <p>But according to <a href="https://docs.portainer.io/advanced/ssl#using-your-own-ssl-certificate-on-kubernetes-via-helm" rel="nofollow noreferrer">the documentation</a> I have to supply it with a parameter:</p>
  <p><code>helm install -n portainer portainer portainer/portainer --set tls.existingSecret=portainer-tls-secret</code></p>
  <p>(OR upload a single file using the settings, which I doubt very much will autorenew using cert-manager)</p>
  <p>As I understand it, the <code>--set &lt;variablename&gt;=&lt;value&gt;</code> is for setting environment variables - can I just &quot;deploy&quot; it by running the helm chart? - even though it is not installed via helm:</p>
  <blockquote>
  <pre><code>$ helm upgrade -n portainer portainer portainer/portainer --set tls.existingSecret=portainer-tls-secret
  Error: UPGRADE FAILED: &quot;portainer&quot; has no deployed releases
  </code></pre>
  </blockquote>
  
Tags: <kubernetes><cert-manager>
Title: Enforce https on portainer with cert-manager and letsencrypt after initial setup
UserDisplayName: JoSSte
ThreadText: # Enforce https on portainer with cert-manager and letsencrypt after initial setup
  
  (Asked by: username_0 on 2023-09-23)
  
  I have a running k3s cluster with portainer and helm, and I just got cert-manager with letsencrypt set up as a `ClusterIssuer`
  
  Now I would like to enforce https and use the certificate I created for portainer:
  
  ```yaml
  apiVersion: cert-manager.io/v1
  kind: Certificate
  metadata:
    name: portainer-tls-secret
    namespace: portainer
  spec:
    secretName: portainer-tls-secret
    duration: 2160h # 90d
    renewBefore: 360h # 15d
    subject:
      organizations:
        - <redacted>
    commonName: portainer.k8s.mydomain.tld
    isCA: false
    privateKey:
      algorithm: RSA
      encoding: PKCS1
      size: 4096
    usages:
      - server auth
      - client auth
    dnsNames:
      - portainer.k8s.mydomain.tld
    issuerRef:
      name: letsencrypt-prod
      kind: ClusterIssuer
      group: cert-manager.io
  
  ```
  
  This works beautifully:  
  `kubectl get Certificate --all-namespaces`
  
  > ```
  > NAMESPACE      NAME                                  READY   SECRET                                    AGE
  > portainer      portainer-tls-secret                  True    portainer-tls-secret                      11m
  >
  > ```
  
  But according to [the documentation](https://docs.portainer.io/advanced/ssl#using-your-own-ssl-certificate-on-kubernetes-via-helm) I have to supply it with a parameter:
  
  `helm install -n portainer portainer portainer/portainer --set tls.existingSecret=portainer-tls-secret`
  
  (OR upload a single file using the settings, which I doubt very much will autorenew using cert-manager)
  
  As I understand it, the `--set <variablename>=<value>` is for setting environment variables - can I just "deploy" it by running the helm chart? - even though it is not installed via helm:
  
  > ```
  > $ helm upgrade -n portainer portainer portainer/portainer --set tls.existingSecret=portainer-tls-secret
  > Error: UPGRADE FAILED: "portainer" has no deployed releases
  >
  > ```
  
  **Tags:** kubernetes, cert-manager
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2023-09-23. Score: 0 | Accepted answer
  
  My not-very-elegant solution was to uninstall portainer
  
  ```sh
  kubectl delete namespace portainer
  kubectl delete ClusterRoleBinding portainer
  
  ```
  
  and reinstall it using helm:
  
  ```sh
  helm upgrade --install --create-namespace -n portainer portainer portainer/portainer \
      --set tls.force=true \
      --set tls.existingSecret=portainer-tls-secret 
  
  ```
  
  
  ---
  
  