Cluster networking is highlighted; its page is below.

Cluster networking

Pods talk through Cilium. Services that need an address on the home network get one from MetalLB, and web interfaces are published by Traefik under one wildcard name.

The pieces#

Cilium as the CNI. Its kube-proxy replacement needs BTF, which the Raspberry Pi kernel is built without, so kube-proxy stays.
MetalLB in layer 2 mode hands out addresses from a small reserved range in the server network.
Traefik implements the Gateway API. One wildcard certificate covers every *.apps.internal name, and DNS points all of them at Traefik.
kube-vip holds the API server's floating address, so kubectl keeps working when a control plane goes down.

In the configuration#

HTTPRoute for the SIEM's dashboards

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: opensearch-dashboards
  namespace: logging
spec:
  parentRefs:
    - name: homelab
      namespace: traefik
  hostnames: ["dashboards.apps.internal"]
  rules:
    - backendRefs:
        - name: opensearch-dashboards
          port: 5601

Publishing a new web app is one of these files: no DNS change and no new certificate.