Paddy's questions

I have raised this exact query at stackoverflow as well, as, interestingly, "Traefik" and "Kubernetes-Ingress" tags are absent on ServerFault, but present on StackoVerflow.

When I only add the TLS secret to the Ingress, Traefik serves it's default certificate.

kind: Ingress
spec:
  rules:
    ....
  tls:
  - secretName: ingress-mgt-server-keys

Only when I mount the secret and add below parameter, does Traefik start serving the real certificate.

entryPoints.https.tls.certificates

Are TLS secrets to be define in both, Traefik Ingress and Ingress-controller? This forces me to repeat the keys as secrets to all the ingress namespaces as well as the ingress-controller namespace.

When I create a EKS cluster, I can access the master node from anywhere. Even though, the control plane security group only allows the worker to control plane connectivity (default configuration).

How can the access to the control plane be limited to a security group?

From Kubernetes documentation:

The selector field defines how the Deployment finds which Pods to manage.

But, when creating deployment, I already specify the pod template as part of the deployment. So, why will I need the selectors as well?

Is it supposed to be used like services, where pods are already being started separately, but later brought under the umbrella of Deployment to be managed together?