Put Your Kubernetes App on the Internet

The journey a request makes — name, port, binding — before your app ever hears it.

A URL hides four real stages before it ever reaches your code: DNS resolving the name, a port acting as the door, a bind decision deciding who can reach it, and a path routing to a handler. This route follows one request through all four.

Resolution, records, and TTLs — how a name you own becomes an address that answers.

DNS is a tree of delegations with caches at every layer — records don't 'propagate,' caches simply expire on their TTL. Four questions explain every DNS mystery you'll meet: who answers, with what, for how long, and who controls it.

The machine in front of your machines — the first thing a public IP usually hits.

A load balancer makes two decisions, repeated forever: who's healthy (via probes) and who's next (via an algorithm), while an L4/L7 split decides what it can even see about the traffic. That frame travels — a cloud console's load balancer and Kubernetes' are the same two decisions.

Why key exchange is the hard problem, and what a certificate actually asserts.

Two machines that have never met can agree on a secret while an attacker reads every packet — the answer is one-way functions, public key exchange, and digital signatures, and it's less math-heavy than its reputation. This is the theory a certificate is actually built on.

The handshake that turns that theory into a padlock in the browser.

The TLS handshake turns the previous step's cryptography into a padlock: a certificate asserts identity, a key exchange creates a shared secret in public, and a chain of trust decides whether any of it is believable. Nearly every TLS failure you'll meet is one specific verification step saying no.

Inside the cluster first: the stable address your Pods hide behind.

Pod IPs are unreliable by design — they die and get replaced constantly — so a Service gives a stable name and address to a group of them instead. This is the cluster-internal version of the load balancing already covered outside it.

type: LoadBalancer looks like magic — see what actually gets provisioned.

type: LoadBalancer is a request, not a built-in feature — Kubernetes ships nothing that fulfills it. On managed cloud, a controller provisions a real load balancer automatically; on bare metal, MetalLB (or you) has to become the fulfiller.

The current-standard front door: one Gateway, an HTTPRoute per app.

Gateway API splits the front door into two objects, two owners: a Gateway the platform team manages, and an HTTPRoute each app team claims for itself. This replaces one Ingress-per-app with a single Gateway serving every app, and is the current standard.

The legacy front door you will inherit — read it, route with it, migrate from it.

Ingress is the front door you'll inherit in existing clusters, not the one to build new — ingress-nginx's maintenance is winding down, and the migration path runs straight through Gateway API. Reading it fluently still matters, because it's everywhere.

How a machine proves it owns your domain — the protocol that ended certificate expiry.

ACME is the protocol that solved certificate expiry: a machine proves domain ownership automatically (HTTP-01 or DNS-01) and Let's Encrypt issues a certificate with no human in the loop. Every ACME client you'll ever meet, from a cron job to a cluster controller, is this same protocol in different packaging.

One annotation on the Gateway, and its certificates issue and renew themselves.

cert-manager brings the ACME protocol from the last step inside the cluster as a native resource — one annotation on a Gateway, and its certificates issue and renew themselves. Issuers, Certificates, and a debug chain are the entire operational surface.

Close the loop: the name you own points at the Gateway you built — automatically.

external-dns closes the last manual step: it watches your Gateway and keeps your real DNS provider's records pointed at it automatically, using a TXT ownership record so it never fights other tools for the same name.

Ship the whole edge stack the production way: one versioned artifact, zero manual commands.

The entire edge stack from this pathway — Traefik, cert-manager, external-dns — ships as one versioned OCI artifact that Flux reconciles, with zero manual kubectl commands. The rule underneath everything here: if it is not in the artifact, it does not exist.