fleet-edge
Experimental: public routing, DNS, firewall, and TLS behavior require deployment-specific validation.
fleet-edge turns a FleetApp route intent into FleetAppRoute resources and controller-managed hub or site ingress configuration. The target cluster is the one named on the FleetApp; the edge controller does not place workloads. FleetAppRoute uses edge.umkim.com/v1alpha1.
Site edge
Section titled “Site edge”Each FleetSite declares how that location reaches the WAN. Inventory examples: examples/site-profiles/.
| Site edge field | Meaning |
|---|---|
hubGateway |
Public HTTP/S on the hub can forward to spokes over WireGuard |
ingress[] port_forward |
WAN port-forwards to spoke Traefik NodePorts (30080/30443); one cluster per entry |
ingress[] reverse_proxy |
External reverse proxy terminates TLS and reaches cluster ingress |
| Neither | No fleet-managed WAN exposure at the site |
Clusters bind with FleetClusterJoin.spec.edge.ingressId.
Per-app routing modes
Section titled “Per-app routing modes”| Mode | Intended result | Hub required for public URL? |
|---|---|---|
hub |
Route through the hub gateway to the selected workload cluster | Yes |
site |
Route through the cluster’s bound site ingress | No |
none |
The workload owns its own ingress; no FleetAppRoute is created |
No |
Use route.mode: hub when the site has hubGateway and DNS for hubHost is ready. Use route.mode: site when the cluster has a port_forward or reverse_proxy binding and siteHost is configured.
The controller does not create external DNS records, NAT, cloud firewall rules, or third-party reverse-proxy configuration. Validate the route, certificate, authentication challenge, and workload health after every relevant change.
Set route.requireAuth: true only after the ingress-auth stack is ready. See ingress auth.
Multi-cluster hub routing is active–backup behavior, not active–active load sharing. Failover is optional and limited in v0.2.