Networking

Satusky traffic enters through Cloudflare and site networking, then reaches Kubernetes routes inside the clusters.

Current routing state

Component	Current role
Cloudflare	DNS, WAF, Tunnel, and global edge services.
ingress-nginx	Still carries major customer and internal traffic on cluster-01.
kgateway	Deployed and being migrated toward as the target Gateway API path.
Cilium	Cluster networking and ClusterMesh foundation.
WireGuard / Tailscale	Site-to-site and machine-management connectivity.

The platform is in a migration period: kgateway exists, but ingress-nginx is still operationally important today.

Route ownership

For a hostname attached with 1ctl domains add, SatuSky owns the route reconciliation and TLS intent. Do not add a second Ingress or HTTPRoute for the same app and hostname: competing routes make backend ownership and readiness ambiguous. Use 1ctl domains setup for the expected external DNS target, then use 1ctl domains check <host> --probe to observe the entire public path.

Managed DNS records are a separate control plane from app routing. A record change can affect any workload using that zone, so list the zone before a mutation and keep DNS changes distinct from app-domain attachment changes.

Domain readiness

A public app URL is healthy only when all of these agree:

Dimension	Meaning
Backend attachment	Domain is attached to the expected app/deployment record.
Route attachment	Kubernetes route exists and points at the workload Service.
DNS	Public DNS resolves to the expected edge target.
TLS	Certificate is issued and served.
HTTP probe	Optional reachability check succeeds.

Use:

1ctl domains check api.example.com --probe

Pod readiness alone does not guarantee public URL readiness.

Default-hostname DNS observation

For a platform-allocated default hostname, the control plane observes the persisted hostname and expected public target in the background. It records the latest DNS condition durably. No manual DNS refresh or API/CLI polling is required for that hostname to converge; status requests only display the observation already being collected.

DNS condition	Meaning	What to do
verified	The hostname resolves to its expected public target.	Continue with route and application checks.
pending	No conclusive observation has been recorded yet.	Wait, then inspect status again if you need to see the latest result.
nxdomain	The hostname was not found in public DNS.	Wait for a later observation; if it persists for a platform hostname, collect status output for support.
wrong_target	DNS resolves, but not to the expected target.	For a custom domain, correct its record using 1ctl domains setup; for a platform hostname, collect status output for support.
error	The platform could not complete the observation.	Retry inspection later; report a persistent error with the deployment details.

These are observed conditions, not DNS record-management promises. In particular, a non-verified condition does not say that the platform will create, change, or delete a DNS record.

Route readiness evidence

Route readiness reports live routing-controller evidence independently from workload and application readiness. For Gateway API routes, it evaluates the current HTTPRoute generation and controller conditions; for compatibility Ingresses, it can only report load-balancer admission evidence.

Code	Evidence	Remediation
ROUTE_ACCEPTED	The current HTTPRoute is accepted and its references are resolved.	Continue with DNS and application checks.
ROUTE_REJECTED	The route’s Accepted condition is false.	Review the parent Gateway/listener acceptance and collect deployment status for support; do not create a competing route.
ROUTE_UNRESOLVED_REFS	The route’s ResolvedRefs condition is false.	Verify the app Service and any cross-namespace references, then inspect deployment status.
ROUTE_STALE	Controller conditions or programming do not reflect the current route generation.	Wait for the Gateway controller to reconcile; collect status for support if it remains stale.
INGRESS_ADMITTED	An Ingress has a published load-balancer address.	Continue with DNS and application checks.
INGRESS_UNKNOWN	An Ingress has no published load-balancer address.	Wait for its controller, then inspect status again.

Even ROUTE_ACCEPTED or INGRESS_ADMITTED is not proof of workload readiness, application readiness, DNS verification, TLS issuance, or a successful HTTP request.