Gateway routes and DNS

Ingress is two Gateway objects, both from the Cilium class, one on the home LAN and one on the OCI VM. Each terminates TLS with the same certificate and accepts routes from every namespace, so an application owns its HTTPRoute and nothing else.

Addresses and what serves them

entry	address	class	notes
cilium-gateway-svt	192.168.107.200	io.cilium/l2-announcer	dedicated VIP from gateway-svt-pool, announced on the LAN
cilium-gateway-oracle	node IPs	io.cilium/node	Node IPAM; only nodes without the external-load-balancer exclusion label

The difference is not cosmetic. The svt gateway owns an address of its own, so it is reachable from the LAN regardless of which node runs the proxy. The oracle gateway advertises node addresses instead, which is what the OCI NAT forwards to, and Node IPAM skips any node labelled node.kubernetes.io/exclude-from-external-load-balancers, a label Talos puts on control-plane nodes.

Certificate

*.kubexa.tech alone does not cover the apex. The certificate carries *.kubexa.tech, kubexa.tech and *.chat.kubexa.tech as extra names, and the same Secret is referenced by both gateways.

Hostnames come from routes

external-dns watches HTTPRoute objects, reads their hostnames, and writes the records. Two annotations decide the shape: the origin the record should carry, and whether Cloudflare proxies it. Because the record is derived, deleting a route removes the hostname on the next reconcile.

A wildcard listener does not match the apex, so kubexa.tech and www.kubexa.tech have their own listener entries (https-apex, http-apex, http-www). Without them the route attaches to nothing and the hostname answers nothing.

Meshes

Three network paths exist for different reasons. Tailscale carries the tailnet, subnet-router mode from the Flint 3, which is how a laptop reaches 192.168.107.0/24 without a VPN config. NetBird is the newer mesh, self-hosted on the oracle node, with groups fed from Zitadel claims. KubeSpan is Talos's own WireGuard mesh between the nodes themselves.