This guide describes how to expose applications on your Kubernetes cluster using an Ingress Controller or the Gateway API, with the Hetzner Cloud Load Balancer configuration required to work with Syself Autopilot.

You can use any Ingress Controller or Gateway API implementation; this guide uses Traefik as an example.

## Prerequisites

- [Helm installed](https://helm.sh/docs/intro/install/)
- Access to a running Kubernetes cluster via kubectl

## Step 1: Add the Traefik Helm Repository

```console
$ helm repo add traefik https://traefik.github.io/charts
$ helm repo update
```

## Step 2: Create a Namespace (optional)

```console
$ kubectl create namespace traefik
```

## Step 3: Install Traefik with Required Annotations

Install the chart with a custom `values.yaml` to apply the Hetzner Load Balancer annotations, replacing `fsn1` and `lb11` with your desired region and load balancer type:

```yaml
service:
  type: LoadBalancer
  annotations:

    load-balancer.hetzner.cloud/location: fsn1

    load-balancer.hetzner.cloud/type: lb11

providers:
  kubernetesGateway:
    enabled: true
gateway:
  listeners:
    web:
      namespacePolicy:
        from: All
```

Then install with:

```console
$ helm install traefik traefik/traefik \
  --namespace traefik \
  -f values.yaml
```

For more information on the annotations, refer to the [Configuring a Hetzner Load Balancer](/docs/hetzner/apalla/network/load-balancing/configure-a-load-balancer) guide.

## Step 4: Verify Installation

After a few seconds, run:

```console
$ kubectl get svc -n traefik
```

You should see an external IP assigned to the Traefik service. This means the Hetzner Load Balancer is provisioned and working.

## Exposing a sample application

Apply the following `sample.yaml` file to the cluster:

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: whoami
spec:
  replicas: 2
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: whoami
spec:
  ports:
    - port: 80
  selector:
    app: whoami
```

```console
$ kubectl apply -f sample.yaml
```

### Using Ingress API

Apply the sample `ingress.yaml` to your cluster:

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: whoami
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
  ingressClassName: traefik
  rules:
    - host: example-ingress.test
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: whoami
                port:
                  number: 80
```

```console
$ kubectl apply -f ingress.yaml
```

Then access the sample application:

```console
$ curl http://example-ingress.test
```

You can also visit http://example-ingress.test in your browser to verify that the application is exposed correctly.

> [!NOTE]
> You can reach the application only if a DNS record points from the domain to the load balancer's IP address.

### Using Gateway API

First, install the Gateway API CRDs in your cluster:

```console
$ kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml
```

Then create a Gateway and an HTTPRoute. The following example `gateway.yaml` contains both:

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: traefik-gateway
  namespace: traefik
spec:
  gatewayClassName: traefik
  listeners:
    - name: web
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: example
spec:
  parentRefs:
    - name: traefik-gateway
      namespace: traefik
  hostnames:

    - "example-gatewayapi.test"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: whoami
          port: 80
```

```console
$ kubectl apply -f gateway.yaml
```

Then access the sample application:

```console
$ curl http://example-gatewayapi.test
```

You can also visit http://example-gatewayapi.test in your browser to verify that the application is exposed correctly.

> [!NOTE]
> You can reach the application only if a DNS record points from the domain to the load balancer's IP address.