Expose a cluster to the internet
Your cluster is on a private network. This guide publishes it, and asks you one real question along the way: where should TLS terminate?
Prerequisites
Section titled “Prerequisites”- A running cluster with an ingress controller exposed as a
NodePort(previous guide) - A domain whose DNS is hosted here, if you want TLS at the load balancer (domain guide)
Choose where TLS terminates
Section titled “Choose where TLS terminates”| TLS at the load balancer | TLS in the cluster | |
|---|---|---|
| Listener protocol | https with a hostname | tcp on 443 |
| Certificates | Obtained and renewed by the panel | cert-manager, your responsibility |
| Cluster sees | Plain HTTP | The original TLS connection |
| Client address | X-Forwarded-For | Preserved end-to-end at the TCP layer |
| Several domains on one port | Yes, routed by Host | Yes, routed by SNI |
Terminate at the load balancer unless something inside the cluster genuinely needs the original TLS connection — mutual TLS, or a protocol that is not HTTP.
Option A — TLS at the load balancer
Section titled “Option A — TLS at the load balancer”1. Create the load balancer
Section titled “1. Create the load balancer”Ağ → Yük Dengeleyiciler → Kur. Choose a subnet in the same private network as the cluster — a load balancer reaches its own network and nothing else. Leave Dışarıya açık (publicly reachable) ticked.
2. Add the listener
Section titled “2. Add the listener”| Field | Value |
|---|---|
| Port | 443 |
| Alan adı (Hostname) | app.example.com |
| TLS burada sonlansın | ticked |
| Hedef (Target) | Kubernetes cluster |
| Küme | your cluster |
| NodePort | 30080 — your ingress controller’s HTTP port |
Note the NodePort: TLS ends at the load balancer, so the cluster is sent plain HTTP. Pointing this at 30443 would have the load balancer speak plain HTTP to a port expecting TLS.
The target list is derived from the cluster’s workers and stays current as they change.
3. Point the domain at it
Section titled “3. Point the domain at it”From Alan Adları → DNS Kayıtları, use the LB control on the record for
app.example.com, or create an A record pointing at the load balancer’s address.
4. Wait for the certificate
Section titled “4. Wait for the certificate”The listener shows sertifika alınıyor (DNS doğrulaması) while the challenge record is published and observed, then sertifika geçerli with an expiry date. Minutes, not seconds — Let’s Encrypt is asked to look only after public resolvers can see the record.
5. Test
Section titled “5. Test”curl -I https://app.example.comYour ingress needs a rule for that host, serving HTTP.
Option B — TLS in the cluster
Section titled “Option B — TLS in the cluster”1. Create the listener
Section titled “1. Create the listener”| Field | Value |
|---|---|
| Port | 443 |
| Alan adı | leave empty, or set it to route by SNI |
| TLS burada sonlansın | unticked |
| NodePort | 30443 — the ingress controller’s HTTPS port |
Traffic passes through untouched.
2. Install cert-manager as usual
Section titled “2. Install cert-manager as usual”Your ingress controller obtains its own certificates. Note that an HTTP-01 challenge needs port 80 reaching the cluster too, so add a second listener on port 80 pointing at 30080.
Mixing the two
Section titled “Mixing the two”You cannot mix protocols on one port. All listeners on 443 are either all https or
all tcp; the API refuses otherwise. HAProxy can do it only through a two-stage
loop-back arrangement, and the result is not something you would be able to reason about
from the panel.
If you need both models, use different ports, or a second load balancer.
Troubleshooting
Section titled “Troubleshooting”502 or connection refused. The NodePort is wrong or the ingress service is not exposed as a NodePort. Check the listener’s health column — it shows how many targets are up.
Certificate stuck at “alınıyor”. The domain’s DNS must be hosted here. Check the error text on the listener; after fixing it use the explicit retry rather than waiting out the backoff.
Works over HTTP, not HTTPS. With TLS at the load balancer, the ingress rule must serve plain HTTP for that host and must not redirect to HTTPS — that redirect would loop.