networking

The networking building block provides the cluster’s CNI (Cilium) and its ingress controller (Traefik, [CT-006 Ingress Controller ]), terminating every inbound HTTPS connection behind the Hetzner Load Balancer.

Applications inside the networking building block.
Figure 1. Applications inside the networking building block.
Application Chart / Source Namespace Purpose

cilium

cilium 1.20.1 (quay.io/cilium/charts)

kube-system

CNI. Runs in tunnel/vxlan routing mode with cluster-pool IPAM (10.244.0.0/16); kube-proxy replacement is disabled.

traefik

traefik 41.2.0 (traefik.github.io/charts)

traefik

Ingress controller, run with 2 replicas and set as the cluster’s default IngressClass. Its Service is annotated to create/attach a Hetzner Load Balancer (lb11, location fsn1) that is reachable only via the private network.
Traefik is the only supported ingress class ([CT-006 Ingress Controller ]). Grafana’s Helm values previously requested ingressClassName: nginx (see [TR-004 Grafana ingress class inconsistency]); this has since been corrected.