Skip to content

Traffic Flow & TLS

How a request reaches a customer pod, and how TLS is terminated without cert-manager.

Traffic enters at Cloudflare's edge, crosses to a DigitalOcean Load Balancer over an encrypted origin link, and is routed at L7 by Envoy Gateway by hostname to the customer's Service and Pod.

flowchart TB
  classDef built fill:#3434DC22,stroke:#3434DC,color:#5B5EE8;
  classDef third fill:transparent,stroke:#808080,color:#808080;

  USER["User browser"]:::third
  DNS["DNS · Cloudflare"]:::third
  EDGE["Cloudflare Edge<br/>TLS termination · CDN · WAF · DDoS"]:::third
  LB["DO Load Balancer<br/>$12/mo · auto-provisioned by Gateway Service"]:::third
  ENVOY["Envoy Gateway<br/>L7 routing by hostname · HTTPRoute"]:::third
  SVC["Customer Service"]:::third
  POD["Customer Pod"]:::third

  USER --> DNS
  DNS --> EDGE
  EDGE -- "Cloudflare Origin Certificate · encrypted" --> LB
  LB -- "forwarded to worker nodes" --> ENVOY
  ENVOY --> SVC
  SVC --> POD
Diagram — Traffic flow. Cloudflare edge → DO Load Balancer (over the Origin Certificate) → Envoy Gateway (L7 by hostname) → customer Service → Pod. All boxes are third-party here; the LB is auto-provisioned by the Gateway Service (§34).

TLS strategy — no cert-manager needed

  • *.starform.app subdomains: Cloudflare wildcard edge certificate (automatic, free)
  • Custom domains (myapp.com): Cloudflare for SaaS custom hostnames — customer CNAMEs to Starform's proxy hostname; Cloudflare validates, issues, and renews the edge cert, and the domain stays behind the WAF (post-MVP, §39.3 #27)
  • Cloudflare → origin encryption: Cloudflare Origin Certificate (free, 15-year validity, stored as K8s Secret on Gateway listener)
  • Zone minimum TLS 1.2, TLS 1.3 enabled (FR-061)

Cross-region service-to-service traffic uses public hostnames through this same edge path — there is no private networking between regions (FR-078); the dashboard discloses it when services in one environment span regions.

Cross-references

VPC & IP plan that this traffic lands in → §4.4 · Gateway architecture (the Envoy hop) → §33 · Load Balancer lifecycle → §34 · HTTPRoute naming (how a hostname maps to a route) → §20.2. Canonical map: Canonical Sources.