My homelab K3s cluster originally used Kubernetes Ingress objects with the NGINX controller, then I switched those objects to Traefik and eventually migrated from Ingress resources to Traefik IngressRoute resources. The original Ingress objects still had cert-manager annotations, and I expected their generated Certificate resources to be deleted automatically when the Ingresses were removed. However, the Certificate resources—and their TLS Secrets—are still present. This is convenient, but I have no Certificate manifests to restore if the cluster is lost. I plan to create proper manifests, but I would like to understand why the Certificates were not cascade-deleted.
2 Answers
IngressRoute is a separate custom resource and does not automatically replace or adopt the old Ingress's dependents. Kubernetes garbage collection only follows explicit owner references. If the old Ingress was deleted with orphaning enabled, or if cert-manager's ownership reference was removed or never established, the Certificate remains as a standalone resource. For recovery manifests, keep the Certificate name, namespace, and intended `spec`, but omit `status`, UIDs, resource versions, timestamps, and old owner references.
The key thing to inspect is the Certificate's `metadata.ownerReferences`, not the replacement IngressRoute. Run `kubectl -n NAMESPACE get certificate NAME -o yaml` and check whether the owner reference still points to the old Ingress and its UID. Also check for `deletionTimestamp` and finalizers. If there is no deletion timestamp or finalizer, the Certificate was not actually marked for deletion. It may have been created independently, or the Ingress was removed using orphan propagation, which deliberately leaves dependents behind. An IngressRoute referencing the same TLS Secret does not create an ownership relationship.
The surviving Certificates still list the deleted Ingress objects in `ownerReferences`, including `blockOwnerDeletion: true`, but they have no finalizers or deletion timestamps. That makes them look like orphaned resources rather than resources waiting for cleanup.
That explains why the Certificates were created automatically but have no relationship to the new IngressRoute objects. They are effectively leftover resources, even though their Secrets continue to work.