Networking on a bare-metal home cluster is one of those areas where cloud assumptions break down immediately. There is no cloud load balancer to provision. There is no managed ingress controller spun up from an annotation. You have to build the stack yourself, which turns out to be a useful exercise in understanding what cloud providers are actually doing for you.
The CNI is Cilium, which handles pod networking, network policy, and — importantly — L2 load balancer announcements. When a LoadBalancer service is created, Cilium advertises the assigned IP over L2 to the rest of the home network. This is how services like Plex, qBittorrent, and Music Assistant get stable IPs that are reachable from the rest of the house without any external load balancer hardware.
HTTP traffic is routed through Envoy Gateway using the Kubernetes Gateway API rather than the older Ingress resource. There are two gateways: one for internal traffic and one for external. Most applications only get an internal route. The few that face the internet go through the external gateway, which sits behind the router’s port forwarding.
ExternalDNS watches Gateway HTTPRoute resources and automatically creates or updates DNS records when routes are added or changed. cert-manager handles TLS, issuing certificates via Let’s Encrypt. Between the two, adding a new application to HTTP routing is mostly a matter of writing the HTTPRoute — the DNS record and certificate appear on their own.
The split between internal and external gateways is simple but effective. It makes it obvious at a glance which applications are internet-facing, and it means tightening or loosening external exposure is a one-line change rather than a firewall rule hunt.
One thing worth noting is that the Gateway API resources are still maturing. Some integrations assume Ingress and need adapter logic or workarounds. This is gradually becoming less of an issue as the ecosystem catches up, but it occasionally surfaces with older Helm charts.