Expose it

To serve https://app.example.com end to end you need three things: an ingress controller (with TLS), an Ingress for your app, and DNS pointing at the cluster’s ingress IP.

1 · Ensure the add-ons

kubrain addon install prod ingress-nginx                       # +€3.50/mo for the LB IP
kubrain addon install prod cert-manager --issuer-email you@example.com   # free TLS

ingress-nginx gets a dedicated public LoadBalancer IP; cert-manager issues Let’s Encrypt certificates via HTTP-01 through it. Both idempotent. See Add-ons.

2 · Declare the Ingress

In kubrain.yaml:

ingress:
  enabled: true
  host: app.example.com
  # hosts: [app.example.com, www.app.example.com]   # several names on one SAN cert
  tls: true

kubrain deploy ship creates the Ingress and requests the certificate automatically. (For anything the preset doesn’t cover — extra paths, custom annotations — drop an ingress.yaml override in kubrain/k8s-templates/.)

3 · Host the DNS zone

kubrain zone create example.com        # idempotent, free; prints the NS set to delegate

At your domain registrar, set the domain’s NS records to the nameservers zone create returns (currently ns1.kubrain.dev and ns2.kubrain.dev — always use the exact list it prints). Delegation typically propagates in minutes to a few hours.

4 · Point a record at the ingress IP

Find the ingress LoadBalancer’s EXTERNAL-IP:

kubrain cluster kubeconfig prod --output kubeconfig
kubectl --kubeconfig kubeconfig get svc -n ingress-nginx

Then create the record:

kubrain zone set example.com app A <EXTERNAL-IP>

Records go live on both nameservers immediately. cert-manager solves the challenge and issues the certificate within a minute or two — then the URL serves valid TLS.

Record types & syntax

zone set <zone> <name> <type> <value> [--ttl] upserts a whole RRset (replacing by name+type). Types: A, AAAA, CNAME, TXT, MX, SRV, CAA. @ is the apex, * a wildcard leftmost label; TTL is 30–86400 (default 300). Repeat values for a round-robin set. kubrain zone records <zone> lists; kubrain zone unset deletes.

Raw TCP/UDP

A non-HTTP service can skip ingress entirely: give it a Service of type: LoadBalancer and it allocates its own dedicated public IP (€3.50/mo).