Load balancers on your own servers.
Address, certificate and DNS in one plan.
A gateway is one plan: an IPv4 and IPv6 address from your site, a wildcard certificate and DNS records come with it. Routes stay a few lines in your Git, and every LoadBalancer Service in a project cluster gets its address the same way.
$ frazer kubernetes gateways create public --cluster acme-staging-1
Address + 203.0.113.18 · 2001:db8:8d10::18 · ovh-vint-hill
Bind /32 and /128 pools for the gateway’s Service
Listener https *.staging.acme.example · http → https
Cert wildcard-staging · public ACME CA · DNS-01
DNS A + AAAA to the pair · *.staging CNAME
? Apply? yes ✓ Accepted · Programmed
Hostname *.staging.acme.example · DNS check ✓ · TLS check ✓# frazer kubernetes gateways create public --cluster acme-staging-1 · YAML view
name: public
exposure: direct # direct | cloudflare (optional edge)
addresses: ["203.0.113.18", "2001:db8:8d10::18"]
listeners:
- name: https
hostname: "*.staging.acme.example"
certificate: wildcard-staging
environments: [staging] # who may attach routes
certificates:
- name: wildcard-staging
dnsNames: ["*.staging.acme.example"]
issuer: acme-dns# envs/staging/apps/gateway-rest/api/values.yaml
gateway:
enabled: true
hostnames: [api.staging.acme.example]
paths:
base: /# rendered by the chart, applied by the cluster’s GitOps
kind: HTTPRoute
metadata: {name: api-gw-rest, namespace: acme}
spec:
parentRefs:
- {name: public, namespace: gateway-system, sectionName: https}
hostnames: [api.staging.acme.example]
rules:
- backendRefs: [{name: api-gw-rest, port: 8443}]One plan for the front door.
Your Git for the routes.
Creating a gateway reserves an address pair, binds it to the gateway’s Service, renders its listeners with a certificate and writes the DNS records. A request then takes a short path: to the address on your server, through an L4 load balancer that keeps the client’s IP, into the cluster's gateway, where TLS ends and your route picks the service.
Every frontend, with its backends.
Health and owner on one screen.
Clusters ask for load balancers through Gateways and LoadBalancer Services. The cloud controller manager Frazer runs in every cluster creates them, so each address has one owner and a reason.
A load balancer’s page shows its frontends in both families, the L4 hop with its health check, the backends that serve, and the certificate with its expiry.
Your domain, three ways.
A certificate in every one.
Every gateway also answers on a default hostname under a Frazer-owned domain, kept apart from frazer.ai so your content never shares cookies with the console. For your own domain, pick how its records are kept.
| Way | How | Certificates |
|---|---|---|
| Delegate a subdomain to Frazer DNS | Point apps.acme.example at Frazer’s name servers. Frazer writes the records from your gateways and routes. | DNS-01 inside the zone, through a solver that may only answer challenges |
| Keep your DNS provider | The cluster’s DNS controller and certificate manager run with your provider’s token, stored in your secrets and limited to one zone. | DNS-01 at your provider |
| Manage records yourself | The console shows the exact A, AAAA and CNAME records to add. | One _acme-challenge CNAME into Frazer’s challenge zone, so no provider token is needed |
Zones, records and DNSSEC live in DNS and certificates.
L4 and L7, TLS included.
On the servers you already have.
Address pairs
Every gateway and external load balancer gets one IPv4 and one IPv6 address from your site’s pool.
LoadBalancer Services
Service type=LoadBalancerin any project cluster gets an address and an L4 load balancer.Routes from your Git
Each service lists its hostnames in its values; a policy admits only names its environment may claim.
Certificates included
A wildcard certificate per listener over DNS-01 from a public ACME authority, with a second one as a fallback.
Client IP kept
The L4 hop passes traffic through, so your services and logs see the real client address.
An ops gateway behind sign-in
Each cluster gets
publicandops;opsserves tools such as GitOps behind Frazer sign-in.gRPC between services
frazer-xds hands proxyless gRPC clients the ready pods of each Service: no sidecar, no extra hop.
Frazer Shield on a gateway
Rate limits, IP, geo and ASN rules and the OWASP Core Rule Set, each previewed before it enforces.
One owner for every address.
Every route checked.
Who may do what
- Project admins
- Create, change and delete gateways and addresses, each as a plan. Attaching an address needs
addresses.use. - Developers
- Add routes in their service’s values through a pull request. A policy refuses hostnames their environment may not claim.
- The cloud controller manager
- The only writer of address pools in a cluster. Frazer Policy refuses anyone else.
- The certificate solver
- May write only
_acme-challengerecords, so a leaked token can only answer challenges.
What is logged
- Every gateway change: a plan, then a numbered revision.
- Every route with its status, and the reason when it is refused, its certificate is pending or its DNS is missing.
- Failed renewals and expiring certificates, emailed to project admins.
- Shield decisions in your project’s logs: every deny, allows sampled at 1 %.
At the cap
- Public addresses per project and region: 2 IPv4 and 64 IPv6.
- An address in use cannot be deleted; a released one is quarantined for 24 hours.
- Shield: 10 policies per project, 200 rules per policy, 50 rate-limit rules.
- Rate limits count an IPv6 client by its /64, never by one address.
Gateways are included.
IPv6 addresses are free.
Gateways, load balancers and certificates have no fee of their own and no per-GB charge. A public IPv4 address has one monthly price, and Shield's baseline protection comes with every gateway.
See every priceLoad balancers, answered.
Do I write Gateway API objects myself?
Not for the gateway. A gateway is a Frazer resource because it uses things outside the cluster: an address, a certificate and DNS records. A chart renders its gateway settings, Gateway, listeners, wildcard Certificate and client traffic policy.
Routes are yours: a few lines in each service’s values, rendered into an HTTPRoute and applied by the cluster’s GitOps.
How are certificates issued and renewed?
The cluster’s certificate manager issues a wildcard certificate for each listener over DNS-01: through Frazer DNS, through your own DNS provider, or after a one-time CNAME into Frazer’s challenge zone. A public ACME authority is the default issuer, with a second one as a fallback, and project admins hear about a renewal that fails.
Does my service see the client’s IP address?
Yes. The external L4 load balancer passes traffic through to the gateway without a proxy hop, so the gateway and your logs see the client’s real address, over IPv4 and IPv6.
Can I keep Cloudflare in front?
Yes, per gateway: exposure is direct by default, or Cloudflare as an optional edge. Every hostname also works direct, with no third party in the path.
What happens to the address when I delete a gateway?
It goes back to your site’s pool after a 24-hour quarantine. An address that is still attached cannot be deleted, and the error names what uses it.
Can I load-balance VMs too?
Yes. Internal and external L4 load balancers send traffic to VMs, with health checks, and an external L7 load balancer for VMs adds a WAF. In clusters, gateways and LoadBalancer Services do the same job.