Traefik

Traefik is the ingress controller that terminates TLS and routes incoming traffic to the right in-cluster service based on hostname.

Runs as a single replica with a websecure entrypoint on port 443, and every web-facing app gets its own IngressRoute matching a kei-space.com hostname, with TLS certificates supplied by cert-manager.

Kubernetes-native IngressRoute objects let each app's own manifests declare its routing instead of maintaining one central ingress config by hand.