Networking

How traffic reaches a pod and how clusters are wired. The path is Cloudflare → DO Load Balancer → Envoy Gateway → customer pod; clusters, resold Managed DBs, and telemetry droplets share a per-region /16 VPC (Cilium overlay; pods SNAT to the node IP), with the control-plane VPC peered to each regional VPC.

This tab covers Traffic Flow & TLS (§5), DNS & Domains (the two-domain split, per-hostname region routing, and the PSL — DNS & Domains), the Gateway architecture (§33), the Load Balancer lifecycle (§34), and the VPC & IP topology (§4.4). Use the left sidebar to navigate.

Load-bearing

TLS is Cloudflare edge + Origin Certs (no cert-manager); the HTTPRoute name carries tenant identity for metrics attribution — read from Envoy's route metadata via the access-log CEL operator; confirm the CEL path on any EG bump (§20.2). The HTTPRoute naming contract stays canonical under Shuttle.