DNS records and wildcard certificates, no console needed

• Which DNS providers are supported?

  Cloudflare and Scaleway DNS. In zones at either, Clusterward creates records itself, compares them every hour, adopts foreign records on request and moves them on a controller switch. Only the proxy and redirects at the edge exist at Cloudflare alone. Hosts in other zones work too: you create the record yourself, Clusterward shows the target address, waits for it to resolve and renders the ingress and certificate.

• What do I need for a zone at Scaleway DNS?

  The zone must exist in Scaleway Domains & DNS: a domain bought there has one, a domain registered elsewhere is added as an external domain, with the nameservers ns0.dom.scw.cloud and ns1.dom.scw.cloud set at the registrar. Add an IAM application with the permission set DomainsDNSFullAccess on the zone’s project and an API key for it. In the cockpit under DNS you register the zone with access and secret key; Clusterward first checks that the key sees the zone, and writes records with a 300-second TTL so a move takes effect within minutes.

• How is a wildcard certificate issued for a zone at Scaleway DNS?

  Via DNS-01, as with Cloudflare. Because cert-manager has no built-in Scaleway solver, you install the Scaleway DNS webhook once from the cluster’s setup card; it answers the challenge with the zone’s key. Until it runs, Clusterward refuses to issue with a clear hint. The certificate is issued for *.example.com and example.com and mirrored into every namespace.

• Does Clusterward ever delete a record I created?

  No. Only records that Clusterward created itself and noted in its registry are ever deleted. If a foreign record already exists for a host, the cockpit reports a conflict and leaves it in place. If you adopt it, Clusterward may change it, for example during a controller switch – but it still never deletes it; on removal it only forgets it.

• Can Clusterward adopt existing records?

  Yes. The zone page lists records someone else created, and “Adopt” puts one of them under Clusterward’s management after a confirmation. It is then changed like its own but never deleted at the provider. The hourly comparison with the provider keeps the registry current.

• Can I add records myself on the zone page?

  Yes, A and CNAME records: “Add record…” on the zone page, the name relative to the zone (www, or @ for the zone itself), the target and an optional comment. Clusterward creates the record at the provider and manages it from then on – you change the target with “Edit record…”, and “Delete record” removes it at the provider. If the name already has someone else’s record of that type, adopt that record instead. Other types such as MX or TXT stay in the provider’s console; the zone’s other A records are listed under “Other records in the zone”.

• When do I need a wildcard certificate?

  As soon as many subdomains of a base domain come into being, for example one host per customer. Let’s Encrypt limits new certificates per registered domain and week; a wildcard certificate covers all subdomains with a single issuance. Clusterward issues it via DNS-01 and mirrors the secret into every namespace.

• What does TLS mode “auto” mean?

  When the host is registered, Clusterward queries DNS once. If the host points to Cloudflare’s proxy, TLS terminates at the edge and Clusterward requests no Let’s Encrypt certificate; the host answers with a self-signed certificate that is enough for Cloudflare’s “Full” mode – for “Full (strict)”, choose Let’s Encrypt or a wildcard. Otherwise a Let’s Encrypt certificate is requested. The decision is recorded on the host.

• How do redirects work?

  If the host lies in a registered zone and its record runs through Cloudflare’s proxy, Clusterward writes a redirect rule into the zone on every deploy: one 301 to https, the start page goes to the target path, every other page keeps its path and query. A foreign rule for the same host stays in place as a conflict. The zone token needs the additional “Dynamic URL Redirects: Edit” permission for this. The cluster answers all other redirects with a plain 301 to https, there without the path of the requested page. The Domains card shows where a redirect is answered.

• Can I restrict a host to specific IP ranges?

  Yes, per domain, with a list of allowed source ranges. It only takes effect if the cluster sees real client addresses, i.e. with the proxy protocol active and for hosts not behind the Cloudflare proxy. Locking out your own address is deliberately not prevented.

• What happens when the ingress controller is switched?

  A cutover: first a plan per host shows who moves the record. Then the previous controller keeps rendering with its own class, the new one is added, and both load balancers serve the hosts with valid certificates. Clusterward moves its own and adopted records, creates a record of its own for a host that only a wildcard answered, and closes the cutover one hour after every host points to the new address. Switching the controller via a simple setting is refused.

• How do I find out about expiring certificates?

  A daily run checks all certificates and managed wildcards. If one expires within 14 days or is not ready, a notification goes to the subscribed channels once a day.

Can’t find your question? Write to us – we usually reply on the same business day.