<p>My not-very-elegant solution was to uninstall portainer</p>
<pre class="lang-sh prettyprint-override"><code>kubectl delete namespace portainer
kubectl delete ClusterRoleBinding portainer
</code></pre>
<p>and reinstall it using helm:</p>
<pre class="lang-sh prettyprint-override"><code>helm upgrade --install --create-namespace -n portainer portainer portainer/portainer \
    --set tls.force=true \
    --set tls.existingSecret=portainer-tls-secret 
</code></pre>

CC BY-SA 4.0
2023-09-23T19:36:00.520Z
2023-09-23T19:36:00.520Z
JoSSte
<p>I have a running k3s cluster with portainer and helm, and I just got cert-manager with letsencrypt set up as a <code>ClusterIssuer</code></p>
<p>Now I would like to enforce https and use the certificate I created for portainer:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: portainer-tls-secret
  namespace: portainer
spec:
  secretName: portainer-tls-secret
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  subject:
    organizations:
      - &lt;redacted&gt;
  commonName: portainer.k8s.mydomain.tld
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 4096
  usages:
    - server auth
    - client auth
  dnsNames:
    - portainer.k8s.mydomain.tld
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
    group: cert-manager.io
</code></pre>
<p>This works beautifully:<br />
<code>kubectl get Certificate --all-namespaces</code></p>
<blockquote>
<pre><code>NAMESPACE      NAME                                  READY   SECRET                                    AGE
portainer      portainer-tls-secret                  True    portainer-tls-secret                      11m
</code></pre>
</blockquote>
<p>But according to <a href="https://docs.portainer.io/advanced/ssl#using-your-own-ssl-certificate-on-kubernetes-via-helm" rel="nofollow noreferrer">the documentation</a> I have to supply it with a parameter:</p>
<p><code>helm install -n portainer portainer portainer/portainer --set tls.existingSecret=portainer-tls-secret</code></p>
<p>(OR upload a single file using the settings, which I doubt very much will autorenew using cert-manager)</p>
<p>As I understand it, the <code>--set &lt;variablename&gt;=&lt;value&gt;</code> is for setting environment variables - can I just &quot;deploy&quot; it by running the helm chart? - even though it is not installed via helm:</p>
<blockquote>
<pre><code>$ helm upgrade -n portainer portainer portainer/portainer --set tls.existingSecret=portainer-tls-secret
Error: UPGRADE FAILED: &quot;portainer&quot; has no deployed releases
</code></pre>
</blockquote>

<kubernetes><cert-manager>
Enforce https on portainer with cert-manager and letsencrypt after initial setup
JoSSte
# Enforce https on portainer with cert-manager and letsencrypt after initial setup

(Asked by: username_0 on 2023-09-23)

I have a running k3s cluster with portainer and helm, and I just got cert-manager with letsencrypt set up as a ClusterIssuer
Now I would like to enforce https and use the certificate I created for portainer:
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: portainer-tls-secret
  namespace: portainer
spec:
  secretName: portainer-tls-secret
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  subject:
    organizations:
      - 
  commonName: portainer.k8s.mydomain.tld
  isCA: false
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 4096
  usages:
    - server auth
    - client auth
  dnsNames:
    - portainer.k8s.mydomain.tld
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
    group: cert-manager.io

This works beautifully:
kubectl get Certificate --all-namespaces

NAMESPACE      NAME                                  READY   SECRET                                    AGE
portainer      portainer-tls-secret                  True    portainer-tls-secret                      11m


But according to the documentation I have to supply it with a parameter:
helm install -n portainer portainer portainer/portainer --set tls.existingSecret=portainer-tls-secret
(OR upload a single file using the settings, which I doubt very much will autorenew using cert-manager)
As I understand it, the --set = is for setting environment variables - can I just "deploy" it by running the helm chart? - even though it is not installed via helm:

$ helm upgrade -n portainer portainer portainer/portainer --set tls.existingSecret=portainer-tls-secret
Error: UPGRADE FAILED: "portainer" has no deployed releases

**Tags:** kubernetes, cert-manager


---

## 1 answers

### Answer by username_0 on 2023-09-23. Score: 0 | Accepted answer

My not-very-elegant solution was to uninstall portainer
kubectl delete namespace portainer
kubectl delete ClusterRoleBinding portainer

and reinstall it using helm:
helm upgrade --install --create-namespace -n portainer portainer portainer/portainer \
    --set tls.force=true \
    --set tls.existingSecret=portainer-tls-secret


---

