Skip to content

Gateway API, TLS and DNS

External traffic is handled by an external load balancer, with the Gateway API routing requests to services inside the cluster based on hostname or path. In practice, your external services use a CNAME record pointing to the load balancer.

DNS

Your cluster gets a DNS name as a sunet.se subdomain, or you can use a custom domain (just point a CNAME record at the load balancer).

We can also provide a DNS management API to automate record creation and updates; particularly useful for large deployments or frequent DNS changes. To use this with a custom domain, delegate the zone to Sunet by updating your domain's NS records to point to our nameservers.

Routing traffic to a service

Attach an HTTPRoute to the cluster's Gateway to route a hostname to one of your Services:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-app
  namespace: my-app
spec:
  parentRefs:
    - name: <cluster-gateway>
      namespace: <gateway-namespace>
  hostnames:
    - app.example.org
  rules:
    - backendRefs:
        - name: my-app
          port: 80

The Gateway and its namespace are part of what Sunet provisions; check kubectl get gateway -A for their names, or ask your delivery contact.

TLS certificates with cert-manager

cert-manager is installed for you. Request a certificate by referencing an issuer, then bind the resulting secret to the Gateway listener (or reference it from your route, depending on how the Gateway is set up):

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: my-app-tls
  namespace: my-app
spec:
  secretName: my-app-tls
  dnsNames:
    - app.example.org
  issuerRef:
    name: <issuer-name>
    kind: ClusterIssuer

cert-manager validates the domain (typically over HTTP-01 through the Gateway) and writes the certificate into the my-app-tls secret, renewing it automatically before expiry. The DNS record for the hostname must already point at the load balancer for validation to succeed. Check kubectl get clusterissuer for the issuer name configured on your cluster.