Exposing applications using Ingress or Gateway API

This guide describes how to expose applications on your Kubernetes cluster using an Ingress Controller or the Gateway API, with the Hetzner Cloud Load Balancer configuration required to work with Syself Autopilot.

You can use any Ingress Controller or Gateway API implementation; this guide uses Traefik as an example.

Prerequisites#

Helm installed⁠
Access to a running Kubernetes cluster via kubectl

Step 1: Add the Traefik Helm Repository#

		$ helm repo add traefik https://traefik.github.io/charts
$ helm repo update

Step 2: Create a Namespace (optional)#

		$ kubectl create namespace traefik

Step 3: Install Traefik with Required Annotations#

Install the chart with a custom values.yaml to apply the Hetzner Load Balancer annotations, replacing fsn1 and lb11 with your desired region and load balancer type:

yaml

		service:
  type: LoadBalancer
  annotations:
    load-balancer.hetzner.cloud/location: fsn1
    load-balancer.hetzner.cloud/type: lb11
providers:
  kubernetesGateway:
    enabled: true
gateway:
  listeners:
    web:
      namespacePolicy:
        from: All

Then install with:

		$ helm install traefik traefik/traefik \
  --namespace traefik \
  -f values.yaml

For more information on the annotations, refer to the Configuring a Hetzner Load Balancer guide.

Step 4: Verify Installation#

After a few seconds, run:

		$ kubectl get svc -n traefik

You should see an external IP assigned to the Traefik service. This means the Hetzner Load Balancer is provisioned and working.

Exposing a sample application#

Apply the following sample.yaml file to the cluster:

yaml

		apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoami
spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: whoami
spec:
  ports:
    - port: 80
  selector:
    app: whoami

		$ kubectl apply -f sample.yaml

Using Ingress API#

Apply the sample ingress.yaml to your cluster:

yaml

		apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: whoami
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
  ingressClassName: traefik
  rules:
    - host: example-ingress.test
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: whoami
                port:
                  number: 80

		$ kubectl apply -f ingress.yaml

Then access the sample application:

		$ curl http://example-ingress.test

You can also visit http://example-ingress.test⁠ in your browser to verify that the application is exposed correctly.

Note

You can reach the application only if a DNS record points from the domain to the load balancer's IP address.

Using Gateway API#

First, install the Gateway API CRDs in your cluster:

		$ kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml

Then create a Gateway and an HTTPRoute. The following example gateway.yaml contains both:

yaml

		apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: traefik-gateway
  namespace: traefik
spec:
  gatewayClassName: traefik
  listeners:
    - name: web
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: example
spec:
  parentRefs:
    - name: traefik-gateway
      namespace: traefik
  hostnames:
    - "example-gatewayapi.test"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: whoami
          port: 80

		$ kubectl apply -f gateway.yaml

Then access the sample application:

		$ curl http://example-gatewayapi.test

You can also visit http://example-gatewayapi.test⁠ in your browser to verify that the application is exposed correctly.

Note

You can reach the application only if a DNS record points from the domain to the load balancer's IP address.

Baremetal Servers Rescue Mode

Fix a Hetzner bare-metal server that will not boot the rescue system.

Configuring a Hetzner Load Balancer

Configure a Hetzner Load Balancer to expose your workload effectively. Annotate the Service for correct IP assignment. Example manifest provided for guidance.