DNS records and wildcard certificates, no console needed

• Which DNS providers are supported?

  Registered zones are Cloudflare zones. Hosts in other zones work too: you create the record yourself, Clusterward waits for it to resolve and renders the ingress and certificate. Only the automatic creation of records requires a Cloudflare zone.

• Does Clusterward ever delete a record I created?

  No. Only records that Clusterward created itself and noted in its registry are ever deleted. If a foreign record already exists for a host, the cockpit reports a conflict and leaves it in place. If you adopt it, Clusterward may change it, for example during a controller switch – but it still never deletes it; on removal it only forgets it.

• Can Clusterward adopt existing records?

  Yes. The zone page lists records someone else created, and “Adopt” puts one of them under Clusterward’s management after a confirmation. It is then changed like its own but never deleted at the provider. The hourly comparison with Cloudflare keeps the registry current.

• When do I need a wildcard certificate?

  As soon as many subdomains of a base domain come into being, for example one host per customer. Let’s Encrypt limits new certificates per registered domain and week; a wildcard certificate covers all subdomains with a single issuance. Clusterward issues it via DNS-01 and mirrors the secret into every namespace.

• What does TLS mode “auto” mean?

  When the host is registered, Clusterward queries DNS once. If the host points to Cloudflare’s proxy, TLS terminates at the edge and Clusterward does not issue a certificate of its own. Otherwise a Let’s Encrypt certificate is requested. The decision is recorded on the host.

• How do redirects work?

  If the host lies in a registered zone and its record runs through Cloudflare’s proxy, Clusterward writes a redirect rule into the zone on every deploy: one 301 to https, the start page goes to the target path, every other page keeps its path and query. A foreign rule for the same host stays in place as a conflict. The zone token needs the additional “Dynamic URL Redirects: Edit” permission for this. The cluster answers all other redirects with a plain 301 to https, there without the path of the requested page. The Domains card shows where a redirect is answered.

• Can I restrict a host to specific IP ranges?

  Yes, per domain, with a list of allowed source ranges. It only takes effect if the cluster sees real client addresses, i.e. with the proxy protocol active and for hosts not behind the Cloudflare proxy. Locking out your own address is deliberately not prevented.

• What happens when the ingress controller is switched?

  A cutover: first a plan per host shows who moves the record. Then the previous controller keeps rendering with its own class, the new one is added, and both load balancers serve the hosts with valid certificates. Clusterward moves its own and adopted records, creates a record of its own for a host that only a wildcard answered, and closes the cutover one hour after every host points to the new address. Switching the controller via a simple setting is refused.

• How do I find out about expiring certificates?

  A daily run checks all certificates and managed wildcards. If one expires within 14 days or is not ready, a notification goes to the subscribed channels once a day.

Can’t find your question? Write to us – we usually reply on the same business day.