Ingress Tunnels

Podmin does not include an ingress controller and does not open any inbound ports.

You can expose an application to the internet by deploying a tunnel client as a Pod.

This guide uses a remotely managed Cloudflare Tunnel.

Using the podmin install cloudflared component installation command, it creates outbound-only connections to a remotely managed Cloudflare Tunnel - Cloudflare's published application routes can point directly to any Podmin Service, so applications retain complete control over their own hostnames and routing.

This guide publishes the Hello application from Getting Started. Deploy it first so this origin exists:

https://hello.default.svc.cluster.local

Create a Cloudflare Tunnel

You'll need a domain managed by Cloudflare to do this.

Note: This guide is intentionally simple. Cloudflare's Create a tunnel (dashboard) guide is the up-to-date, comprehensive source for these dashboard steps.

In the Cloudflare dashboard:

  1. Go to Networking > Tunnels and select Create a tunnel.
  2. Name the tunnel and create it.
  3. On the connector setup page, copy only the token from the displayed cloudflared command. Do not run that command locally.

Store the Tunnel Token

Store the token at the predefined identity used by Podmin's component:

podmin secret create tunnel-token \
  --for cloudflared \
  --namespace platform-cloudflared

Enter the token at the hidden prompt. Use --stdin to read it from standard input or --file PATH to read it from a file. The current context's secrets provider is used unless --provider overrides it. The resulting provider path is:

/<cluster>/platform-cloudflared/cloudflared/tunnel-token

The value is mounted from host tmpfs and never written into a Pod manifest or object storage.

Install cloudflared

Install one connector on every VM in the selected NodeGroup:

podmin install cloudflared --nodegroup default

Podmin verifies the token exists, automatically downloads and mirrors its pinned multi-platform cloudflared image if necessary, and commits the platform-cloudflared/cloudflared workload. Re-running the command safely reuses an already mirrored image and commits the same desired configuration. Use --provider here too if the token was created with a provider other than the context default.

Wait for the tunnel to show Healthy in Cloudflare before continuing. Every VM in the NodeGroup is a connector for the same tunnel, and Cloudflare can route through any healthy connector. See Cloudflare's replica and high-availability documentation for availability details.

Publish Hello

In the Cloudflare dashboard:

  1. Open the tunnel's Routes tab.

  2. Add a Published application route and choose its public hostname, such as hello.example.com.

  3. Set Service URL to:

    https://hello.default.svc.cluster.local

  4. Save the route, then open the public hostname. It should display Hello, World!.

Follow Cloudflare's published application instructions and origin parameters reference for current routing options, TLS settings, timeouts, and other origin behavior.

No ingress controller or shared ingress proxy is required. Add more published application routes directly to each Service:

https://<service>.<namespace>.svc.cluster.local:<port>

Use https:// in every Service URL. Podmin Services can send a connection to any ready Pod in their NodeGroup, including one on another VM, even when cloudflared runs in that same NodeGroup. HTTPS keeps this traffic between VMs encrypted. Configure the origin (i.e. your app) to serve the Podmin workload certificate and key mounted at /var/run/secrets/podmin.dev/tls; the built-in cloudflared Pod trusts that certificate automatically. Use the full Service DNS name in the URL so it matches the certificate.

If an application needs host- or path-based routing behind one origin, deploy your reverse proxy of choice, such as Traefik, as an ordinary Podmin workload and point Cloudflare at its Service.

Next Steps