Skip to content
Documentation
Platform
Networking

Networking

Three layers, bottom to top: Cilium is the eBPF data plane — CNI, kube-proxy replacement, and the Gateway API L7 proxy in one component, with IPAM and encryption settings that aren’t optional tuning. Gateway API is the routing model everything runs on top of — GatewayClass, Gateway, HTTPRoute — including TLS termination and DNS record creation. Private Access is how that model gets used for services that should never be reachable from the public internet: two Gateways, split by Tailscale ACL tag.

Three ways into the cluster, all terminating on the same Cilium-managed Envoy: internet traffic through an AWS NLB into the platform-public Gateway, and two Tailscale paths whose ACL tags decide which of platform-tailscale-general and platform-tailscale-admin a device may reach; each Gateway matches an HTTPRoute onto a backing Service, while cert-manager supplies the certificates and ExternalDNS writes the Route53 records

Cilium
The CNI and kube-proxy replacement: prefix delegation, the load-bearing WireGuard workaround, and the Gateway API CRD startup trap.
Gateway API
GatewayClass, Gateway, and HTTPRoute; the platform’s three Gateways; TLS attachment and ExternalDNS.
Private Access
The two Tailscale-backed Gateways, the ACL model that separates them, and how to add a new private service.