Updated August 24, 2026
Each cluster runs in its own VPC; nodes have private IPs only. The gateway holds the cluster’s public IP and is the only way in or out.
Address ranges
What the gateway forwards
The gateway load-balances at TCP level across your nodes:
- 6443 → the Kubernetes API (your kubeconfig endpoint
https://<cluster-id>.k8s.raffusercloud.com:6443)
- 80 / 443 → into the cluster for ingress (Traefik, or App Hub exposes)
- Custom TCP ports → created when exposing an app over TCP (e.g. a database); manage them on the cluster page or API
- Everything else is blocked by the firewall: the platform baseline already permits exactly 80, 443 and 6443 with nothing to configure. If you attach one of your own security groups instead, make sure it allows those three ports. Change the active firewall any time in Settings → Firewall:
Health checks & failover: the gateway health-checks the nodes behind it and removes unhealthy ones from rotation automatically; nodes added by scaling or autoscaling are picked up automatically. On a standard cluster the gateway is a single managed instance, restarted automatically on failure; with HA it is a redundant pair with automatic IP failover (VRRP).
Limits: there are no platform limits on connections, requests or Ingress hosts. Throughput is bounded by your cluster’s own gateway; it is not shared with other customers.
With MetalLB enabled, Service type=LoadBalancer allocates private IPs from a reserved block inside the VPC (resizable up to 32 addresses). Combine with TCP port forwards to publish them externally. Last modified on August 24, 2026
