Kubernetes ingress, TLS and DNS

Ingress is where the outside world meets the cluster. Getting it right means one controller, automatic TLS certificates, DNS records that follow the application and a way to rate-limit or block abuse.

We standardize on ingress-nginx or Traefik with cert-manager for Let's Encrypt certificates and external-dns to publish records, and add a WAF layer such as Cloudflare or ModSecurity when the application is exposed to the public.

At a glance

What RackLedge does

• Ingress controller deployment and hardening
• Certificate automation including wildcard via DNS-01
• DNS automation
• Traffic policies and WAF integration

How we work

Every cluster we build starts from Git. Infrastructure as code creates the cluster, Flux or Argo CD reconciles everything inside it, and no change reaches production without a pull request. That is what makes a rebuild after a bad day a matter of hours instead of weeks.

Operations are the product: monitoring with alerts that mean something, backups of cluster state and persistent volumes, upgrades on a quarterly cadence and an on-call engineer who already knows the environment. We run production Kubernetes for our own platforms, so the runbooks are ones we use ourselves.

We are honest about fit. A handful of stable services on a couple of VMs does not need Kubernetes, and we will say so. Teams that ship weekly, need to scale or run many services get real value from it.

Related services

More on kubernetes

Frequently asked questions