> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Expose a Kubernetes service

> Publish workloads with Traefik ingress, MetalLB, or a TCP port on the cluster's public IP

<sub>Updated August 24, 2026</sub>

Every cluster sits behind a managed gateway with one public IP. Ports **80 and 443** are forwarded into the cluster; how traffic is routed from there is up to you.

## Option 1 — Traefik ingress (HTTP/HTTPS)

If the cluster was created with **Traefik**, it is the standard IngressClass and plain Kubernetes `Ingress` resources work as-is — the recommended production shape is **Services as `ClusterIP` + Traefik Ingress** through the managed endpoint; no separate load balancer is needed.

**Custom domains & TLS:** point your domain's A record at the cluster endpoint and use the cluster's cert-manager/Let's Encrypt issuer for automatic certificates:

```yaml theme={null}
metadata:
  annotations:
    cert-manager.io/cluster-issuer: raff-letsencrypt
```

Every cluster also gets a wildcard subdomain under `<cluster-id>.k8s.raffusercloud.com` out of the box.

## Option 2 — App Hub expose (simplest)

For apps installed from App Hub, click **Expose** — the platform creates the ingress and TLS certificate for you at `https://<app>.<cluster-id>.k8s.raffusercloud.com`, or forwards a raw TCP port (e.g. PostgreSQL 5432) on the public IP. Without an expose, the app stays private to the cluster.

## Option 3 — MetalLB (LoadBalancer services)

With **MetalLB** enabled, `Service type=LoadBalancer` gets a private IP from the cluster's address pool — useful inside the VPC or behind your own port forwards. Manage the pool size on the cluster's settings (up to 32 addresses).

<Note>
  The gateway's firewall controls what reaches the cluster from the internet — see [Networking](/products/build/kubernetes/concepts/networking).
</Note>