--- title: "Load balancers: gateways with addresses, TLS and DNS · Frazer" description: "Gateways and load balancers for every cluster on your own servers: an IPv4 and IPv6 address from your site, a wildcard certificate and DNS records in one plan, routes from your Git, and no per-GB fees." url: https://frazer.ai/network/gateways index: https://frazer.ai/llms.txt tokens: 2482 --- > For agents: every page on frazer.ai is indexed at https://frazer.ai/llms.txt. # Load balancers: gateways with addresses, TLS and DNS · Frazer **Load balancers** frazer.ai # Load balancers on your own servers. Address, certificate and DNS in one plan. A gateway is one plan: an IPv4 and IPv6 address from your site, a wildcard certificate and DNS records come with it. Routes stay a few lines in your Git, and every LoadBalancer Service in a project cluster gets its address the same way. [Add a gateway](https://frazer.ai/start?product=load-balancers) [Read the docs](https://frazer.ai/docs) ``` $ frazer kubernetes gateways create public --cluster acme-staging-1 Address + 203.0.113.18 · 2001:db8:8d10::18 · ovh-vint-hill Bind /32 and /128 pools for the gateway’s Service Listener https *.staging.acme.example · http → https Cert wildcard-staging · public ACME CA · DNS-01 DNS A + AAAA to the pair · *.staging CNAME ? Apply? yes ✓ Accepted · Programmed Hostname *.staging.acme.example · DNS check ✓ · TLS check ✓ ``` ``` # frazer kubernetes gateways create public --cluster acme-staging-1 · YAML view name: public exposure: direct # direct | cloudflare (optional edge) addresses: ["203.0.113.18", "2001:db8:8d10::18"] listeners: - name: https hostname: "*.staging.acme.example" certificate: wildcard-staging environments: [staging] # who may attach routes certificates: - name: wildcard-staging dnsNames: ["*.staging.acme.example"] issuer: acme-dns ``` ``` # envs/staging/apps/gateway-rest/api/values.yaml gateway: enabled: true hostnames: [api.staging.acme.example] paths: base: / ``` ``` # rendered by the chart, applied by the cluster’s GitOps kind: HTTPRoute metadata: {name: api-gw-rest, namespace: acme} spec: parentRefs: - {name: public, namespace: gateway-system, sectionName: https} hostnames: [api.staging.acme.example] rules: - backendRefs: [{name: api-gw-rest, port: 8443}] ``` One gateway, from the CLI and as files demo organization 01 · How it works Fig. 1 ## One plan for the front door. Your Git for the routes. Creating a gateway reserves an address pair, binds it to the gateway’s Service, renders its listeners with a certificate and writes the DNS records. A request then takes a short path: to the address on your server, through an L4 load balancer that keeps the client’s IP, into the cluster's gateway, where TLS ends and your route picks the service. **Fig. 1** What the plan creates, above the path a request takes 02 · Load balancers Fig. 2 ## Every frontend, with its backends. Health and owner on one screen. Clusters ask for load balancers through Gateways and LoadBalancer Services. The cloud controller manager Frazer runs in every cluster creates them, so each address has one owner and a reason. A load balancer’s page shows its frontends in both families, the L4 hop with its health check, the backends that serve, and the certificate with its expiry. *Load balancers of the project acme-production in the Frazer console: the public gateway api-acme, the internal ops gateway and a database endpoint, all healthy and created by the cloud controller manager. The detail of api-acme shows its IPv4 and IPv6 frontends with the client IP kept, an external L4 load balancer with a health check handing over to the cluster gateway, two of seven nodes serving, and a wildcard certificate from a public ACME certificate authority.* Load balancers of a project, and the detail of its public gateway product UI, demo organization 03 · Your domain ## Your domain, three ways. A certificate in every one. Every gateway also answers on a default hostname under a Frazer-owned domain, kept apart from frazer.ai so your content never shares cookies with the console. For your own domain, pick how its records are kept. Three ways to point your own domain at a gateway | Way | How | Certificates | | --- | --- | --- | | Delegate a subdomain to Frazer DNS | Point `apps.acme.example` at Frazer’s name servers. Frazer writes the records from your gateways and routes. | DNS-01 inside the zone, through a solver that may only answer challenges | | Keep your DNS provider | The cluster’s DNS controller and certificate manager run with your provider’s token, stored in your secrets and limited to one zone. | DNS-01 at your provider | | Manage records yourself | The console shows the exact A, AAAA and CNAME records to add. | One `_acme-challenge` CNAME into Frazer’s challenge zone, so no provider token is needed | Zones, records and DNSSEC live in [DNS and certificates](https://frazer.ai/network/dns). 04 · What you get ## L4 and L7, TLS included. On the servers you already have. - ### Address pairs Every gateway and external load balancer gets one IPv4 and one IPv6 address from your site’s pool. - ### LoadBalancer Services `Service type=LoadBalancer` in any project cluster gets an address and an L4 load balancer. - ### Routes from your Git Each service lists its hostnames in its values; a policy admits only names its environment may claim. - ### Certificates included A wildcard certificate per listener over DNS-01 from a public ACME authority, with a second one as a fallback. - ### Client IP kept The L4 hop passes traffic through, so your services and logs see the real client address. - ### An ops gateway behind sign-in Each cluster gets `public` and `ops`; `ops` serves tools such as GitOps behind Frazer sign-in. - ### gRPC between services frazer-xds hands proxyless gRPC clients the ready pods of each Service: no sidecar, no extra hop. - ### Frazer Shield on a gateway Rate limits, IP, geo and ASN rules and the OWASP Core Rule Set, each previewed before it enforces. 05 · Controls ## One owner for every address. Every route checked. ### Who may do what Project admins Create, change and delete gateways and addresses, each as a plan. Attaching an address needs `addresses.use`. Developers Add routes in their service’s values through a pull request. A policy refuses hostnames their environment may not claim. The cloud controller manager The only writer of address pools in a cluster. Frazer Policy refuses anyone else. The certificate solver May write only `_acme-challenge` records, so a leaked token can only answer challenges. ### What is logged - Every gateway change: a plan, then a numbered revision. - Every route with its status, and the reason when it is refused, its certificate is pending or its DNS is missing. - Failed renewals and expiring certificates, emailed to project admins. - Shield decisions in your project’s logs: every deny, allows sampled at 1 %. ### At the cap - Public addresses per project and region: **2** IPv4 and **64** IPv6. - An address in use cannot be deleted; a released one is quarantined for **24 hours**. - Shield: **10** policies per project, **200** rules per policy, **50** rate-limit rules. - Rate limits count an IPv6 client by its /64, never by one address. 06 · Pricing ## Gateways are included. IPv6 addresses are free. Gateways, load balancers and certificates have no fee of their own and no per-GB charge. A public IPv4 address has one monthly price, and Shield's baseline protection comes with every gateway. [See every price](https://frazer.ai/pricing#lines) Gateways, load balancers **Included** within fair use, no per-unit fee Certificates **Included** Traffic No per-GB fee within fair use Public IPv4 **$3.00** per address a month, billed hourly whether used or not Public IPv6 **Free** Shield baseline **Included** on every gateway Shield custom rules $3 per policy and $0.50 per rule a month; the first 5 rules in an organization are free, with no fee per request Questions ## Load balancers, answered. Do I write Gateway API objects myself? Not for the gateway. A gateway is a Frazer resource because it uses things outside the cluster: an address, a certificate and DNS records. A chart renders its gateway settings, Gateway, listeners, wildcard Certificate and client traffic policy. Routes are yours: a few lines in each service’s values, rendered into an HTTPRoute and applied by the cluster’s GitOps. How are certificates issued and renewed? The cluster’s certificate manager issues a wildcard certificate for each listener over DNS-01: through Frazer DNS, through your own DNS provider, or after a one-time CNAME into Frazer’s challenge zone. A public ACME authority is the default issuer, with a second one as a fallback, and project admins hear about a renewal that fails. Does my service see the client’s IP address? Yes. The external L4 load balancer passes traffic through to the gateway without a proxy hop, so the gateway and your logs see the client’s real address, over IPv4 and IPv6. Can I keep Cloudflare in front? Yes, per gateway: exposure is direct by default, or Cloudflare as an optional edge. Every hostname also works direct, with no third party in the path. What happens to the address when I delete a gateway? It goes back to your site’s pool after a 24-hour quarantine. An address that is still attached cannot be deleted, and the error names what uses it. Can I load-balance VMs too? Yes. Internal and external L4 load balancers send traffic to VMs, with health checks, and an external L7 load balancer for VMs adds a WAF. In clusters, gateways and LoadBalancer Services do the same job. ## More in Network - [**VPC and firewall** Subnets, rules, NAT](https://frazer.ai/network) - [**DNS and certificates** Zones and automatic TLS](https://frazer.ai/network/dns) - [**Frazer Access and VPN** Private access for people, devices and agents](https://frazer.ai/network/access) ## Give every cluster a front door. Route to it from your Git. [Add a gateway](https://frazer.ai/start?product=load-balancers) [Read the docs](https://frazer.ai/docs)