Overview

Use Gateway API routing while Kupe operates the public gateway, DNS entrypoint, and TLS lifecycle.

The model is intentionally simple:

platform hostnames under your cluster’s dedicated subdomain *.<cluster>.<tenant>.clusters.kupe.cloud work with the shared gateway
custom domains use the same HTTPRoute model
you manage routes and services
Kupe manages the gateway, public entrypoint, and certificate flow

How networking works

Create an HTTPRoute in the same namespace as your workload.
Reference external-gateway in kube-system.
Point the route at a backend Service.
Choose either a platform hostname (under your cluster’s dedicated subdomain) or a custom hostname.
Let Kupe handle the shared ingress and TLS flow.

You do not create or operate a dedicated public gateway for each application.

Path	What you do	What Kupe does
Platform domains	Create an `HTTPRoute` with a hostname under `*.<cluster>.<tenant>.clusters.kupe.cloud`	Serves traffic through the shared gateway and your cluster’s wildcard certificate
Custom domains	Create the same route with your own hostname, then add the DNS records shown in the console	Issues the certificate, adds the HTTPS listener, and serves traffic on your domain

Component	What it does
HTTPRoute	Defines hostname, path matching, and backend service targets
external-gateway	The shared public gateway serving tenant traffic over HTTPS
Platform DNS	Provides the stable public entrypoint behind Kupe-hosted traffic
TLS automation	Handles platform wildcard certs and per-domain certificate issuance

Kupe provides the shared networking layer:

the public gateway infrastructure
the stable public DNS entrypoint behind that gateway
platform-managed TLS via a per-cluster wildcard certificate (*.<cluster>.<tenant>.clusters.kupe.cloud)
certificate issuance and renewal for custom domains
the supporting automation behind gateway DNS and custom-domain lifecycle

Your team still controls application traffic behavior: