fleet-edge
fleet-edge-controller reconciles FleetAppRoute CRs. Hub Traefik routes app hostnames over WireGuard to spoke Traefik NodePorts.
Exposure modes and TLS policies
Section titled “Exposure modes and TLS policies”Exposure = WAN path to the cluster. TLS policy = where certificates live.
| Mode | WAN path | Default TLS (inherit) |
|---|---|---|
none |
Hub/WG only | acme_hub |
hub_gateway |
Public IP → hub Traefik | acme_hub |
port_forward |
WAN 80→30080, 443→30443 | acme_cluster |
reverse_proxy |
External RP → cluster :30080 HTTP |
external |
Supported working pairs
Section titled “Supported working pairs”| Exposure | TLS | Catalog routing.mode |
Result |
|---|---|---|---|
none |
acme_hub |
hub |
Overlay/hub only; site/dual downgraded to hub |
hub_gateway |
acme_hub |
hub |
Hub zone apps; LE on hub Traefik |
port_forward |
acme_cluster |
site / dual / hub |
DNAT to NodePorts; LE on spoke (:30443) |
reverse_proxy |
external |
site / dual / hub |
Proxy holds certs; spoke Ingress HTTP only |
Avoid mismatches such as reverse_proxy+acme_cluster or port_forward+external. Full detail lives in the umkim repo docs/components/fleet-edge.md.
Routing paths
Section titled “Routing paths”| Path | Flow |
|---|---|
| Hub gateway | Internet → hub Traefik → WG → spoke Traefik → Service |
| Site WAN | Internet → site endpoint → cluster NodePorts (needs port_forward or reverse_proxy) |
| Catalog dual-route | routing.mode: hub, site, or dual |
Key objects
Section titled “Key objects”| Object | Namespace | Role |
|---|---|---|
fleet-edge-clusters |
fleet-system |
Per-cluster upstream, exposure, bindings |
fleet-edge-domains |
fleet-system |
Site DNS zones, hub wildcard |
FleetAppRoute |
fleet-system |
Per catalog instance route |
phase6-spoke-ingress MW |
<cluster> |
Traefik NodePort on spoke |
Controller-owned ConfigMap dcm-traefik-fleet-routes holds per-route hub routers/services and optional Authelia middleware.