Skip to main content
Updated August 24, 2026 Every cluster sits behind a managed gateway with one public IP. Ports 80 and 443 are forwarded into the cluster; how traffic is routed from there is up to you.

​
Option 1 — Traefik ingress (HTTP/HTTPS)

If the cluster was created with Traefik, it is the standard IngressClass and plain Kubernetes Ingress resources work as-is — the recommended production shape is Services as ClusterIP + Traefik Ingress through the managed endpoint; no separate load balancer is needed. Custom domains & TLS: point your domain’s A record at the cluster endpoint and use the cluster’s cert-manager/Let’s Encrypt issuer for automatic certificates:
Every cluster also gets a wildcard subdomain under <cluster-id>.k8s.raffusercloud.com out of the box.

​
Option 2 — App Hub expose (simplest)

For apps installed from App Hub, click Expose — the platform creates the ingress and TLS certificate for you at https://<app>.<cluster-id>.k8s.raffusercloud.com, or forwards a raw TCP port (e.g. PostgreSQL 5432) on the public IP. Without an expose, the app stays private to the cluster.

​
Option 3 — MetalLB (LoadBalancer services)

With MetalLB enabled, Service type=LoadBalancer gets a private IP from the cluster’s address pool — useful inside the VPC or behind your own port forwards. Manage the pool size on the cluster’s settings (up to 32 addresses).
The gateway’s firewall controls what reaches the cluster from the internet — see Networking.
Last modified on August 24, 2026