ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Learn how Traefik Mesh manages short‑lived mTLS certificates for service‑to‑service traffic, what the minimal design looks like, and how to verify rotation without restarting pods.
When TraefikMesh mTLS certs expire after 24‑48 h, services break. This guide walks through symptoms, root causes, step‑by‑step checks, targeted fixes, and when to raise an incident. It covers clock skew, cert‑manager mis‑config, webhook failures, and NetworkPolicy blocks.
On Gardener v1.87+ shoots, certificate rotation via cert-manager updates the serving certificate secret, and the kube-apiserver is expected to pick it up through its TLS file watcher (Kubernetes >= v1.22) without a restart. The new CA bundle is then propagated to clients through the shoot's status credentials. My concern is the ordering gap: if the kube-a
traefikmesh
kubernetes
gardener