Set up an edge cluster

An edge cluster serves a domain whose service runs on a different cluster of the same organization. Traffic reaches the edge cluster's public address, crosses the WireGuard mesh, and arrives at the service's own cluster. TLS passes through the edge untouched, and the certificate stays on the service's own cluster. Use this when the cluster that runs your service has no public address.

Before you beginCopy Anchor Link

• Two clusters in the same organization, both connected, and both installed with the WireGuard mesh. A cluster installed before the mesh existed cannot take part. Its error reads this cluster was installed before the WireGuard mesh, so no machine can join it; create a new cluster, move its environments there, and remove this one.
• You need the admin or owner role to manage clusters, and at least the deployer role to add a domain.
• A Cloudflare connection for the organization. A domain served through another cluster always uses DNS-01. See Domains.

Make a cluster eligible as an edgeCopy Anchor Link

A cluster qualifies as an edge cluster when it is connected, on the mesh, reports a public ingress address and runs an agent that supports edge fronting. The domain dialog tells you which condition fails, so you can also start from step 3 and read the reasons.

1. If the cluster has no public address, add a Public gateway. In Clusters, select the cluster, then + Add server, choose the role Public gateway, and run the command on a node with a public IPv4 address. See Connect a cluster.
2. If the cluster shows an agent update, update its agent. An older agent fails with must run an agent build that supports edge fronting; update it first.
3. Update the agent of the cluster that runs the service as well. Its own agent must report an edge-ingress address from kube-system/nebula-edge-ingress. Until then, saving the domain fails with cannot serve this domain through another cluster yet: this environment's own cluster has not reported a valid edge-ingress address.
4. In Settings > Integrations, connect Cloudflare.

Serve a domain through the edgeCopy Anchor Link

1. Open the service's Domains and add the domain, or open Domain settings… on an existing one.
2. Under Serve through, choose the edge cluster. The default is This environment's cluster.
3. Set Certificate to DNS-01. HTTP-01 is refused with must be dns-01 for a domain served through another cluster: that cluster answers every HTTP-01 challenge on port 80 itself, so this domain would never get a certificate.
4. Save. Point the hostname at the edge cluster's public address. With Cloudflare DNS, NebulaCtrl publishes the records. With Manual DNS, the card lists them.

The steps of the domain dialog are in Domains.

A cluster that cannot be chosen shows why in the Serve through list:

What the edge needs from the networkCopy Anchor Link

No extra inbound port opens for edge fronting. The edge cluster serves ports 80 and 443 as usual, and the nodes of both clusters reach each other on the mesh port, UDP 51821. The edge cluster's Traefik forwards the TLS stream over the mesh to the service cluster's edge-ingress pods.

Change or remove an edge clusterCopy Anchor Link

• To stop using an edge, open Domain settings… and set Serve through back to This environment's cluster.
• Removing a cluster that is still an edge for domains is refused: this cluster serves N domain(s) of other clusters as their edge; switch them under Domains → Serve through, then remove this cluster.
• When a cluster's set of edge-ingress addresses changes, NebulaCtrl republishes the DNS records of the domains it serves.

VerifyCopy Anchor Link

• The domain's card reads Served through and the edge cluster's name, and the status reaches Live.
• https://HOSTNAME loads, and the certificate belongs to the hostname.
• The edge cluster's public address is the one the hostname resolves to.

Next stepsCopy Anchor Link