Custom Domains

Every kubestart cluster comes with a default wildcard domain. You can also add your own custom domains for production use.

Default domain

Each cluster is assigned a wildcard domain automatically:

*.{cluster-id}.kubestart.xyz

This domain is ready to use immediately — no configuration needed. TLS certificates are provisioned and renewed automatically.

Use it in your Ingress resources:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app
spec:
  ingressClassName: kubestart-ingress
  rules:
    - host: app.abc123.kubestart.xyz
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-app
                port:
                  number: 80

Custom domains

To use your own domain (e.g., app.example.com), you need to:

Register the domain with kubestart — contact support or use the API to add allowed hostnames for your cluster.
Create a CNAME record pointing your domain to your cluster’s default domain:
```
app.example.com  CNAME  abc123.kubestart.xyz
```
Use the hostname in your Ingress resource.

Hostname validation

Only registered hostnames can be used in Ingress resources. If you try to create an Ingress with an unregistered hostname, it will be rejected.

TLS for custom domains

The default *.{cluster-id}.kubestart.xyz domain has automatic TLS — you don’t need to configure anything.

For custom domains, you need to provide your own TLS certificate. Create a Kubernetes Secret with your certificate and reference it in the Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app
spec:
  ingressClassName: kubestart-ingress
  tls:
    - hosts:
        - app.example.com
      secretName: my-app-tls
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-app
                port:
                  number: 80

Ingress — how to expose services to the internet.
Manage Add-ons — enable cert-manager for automatic TLS.