skills.rest
wcygan
wcyganCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

expose-service

Expose workloads via Envoy, Tailscale, and Cloudflare with TLS routing.

3|Updated May 13, 2025
Search Tags:#cloudflare#tailscale#tls#envoy#expose#httproute#dnsendpoint
One-click install
npx skills add https://github.com/wcygan/anton --skill expose-service
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: expose-service
Source: https://github.com/wcygan/anton/tree/main/.claude/skills/expose-service
Command: npx skills add https://github.com/wcygan/anton --skill expose-service

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Expose a workload to multiple access paths using Envoy and Tailnet/Cloudflare.

Core Features & Use Cases

  • Exposes workloads via LAN (envoy-internal), off-LAN HTTP admin UI (Tailscale Ingress), off-LAN raw TCP (Tailscale Service annotation), and public access (envoy-external + Cloudflare tunnel).
  • Handles HTTPRoute authoring, DNSEndpoint for secondary domains, and per-domain cert wiring for TLS across domains.

Quick Start

Configure and apply the HTTPRoute or Tailscale exposure path for your workload following the policy documented in this skill.

Frequently Asked Questions about expose-service

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I expose a Kubernetes workload both internally and publicly?▼

You can expose workloads via multiple access paths by configuring envoy-internal for LAN routing and envoy-external with a Cloudflare tunnel for public routing. This requires creating HTTPRoute definitions and wiring TLS certificates per-domain.

What is the best way to route off-LAN raw TCP traffic using Tailscale?▼

Routing off-LAN raw TCP traffic is achieved by applying a Tailscale Service annotation to your workload. This exposes the TCP service directly to your Tailnet without requiring an HTTP ingress layer or gateway TLS configuration.

Does this approach support secondary domains with TLS certificates?▼

Yes, secondary domains are supported by creating DNSEndpoint resources and performing per-domain TLS cert wiring with cert-manager. This ensures valid gateway TLS configuration across all secondary domains exposed through the Envoy proxy.

How do I configure an HTTP admin UI for off-LAN access via Tailscale Ingress?▼

You configure an off-LAN HTTP admin UI by deploying a Tailscale Ingress routing definition. This involves authoring an HTTPRoute policy to securely expose the admin interface to your Tailnet without making it publicly accessible.

When should I use Cloudflare tunnels instead of Tailscale for exposing services?▼

Use Cloudflare tunnels with envoy-external when you need genuinely public internet access to your workload. Use Tailscale Ingress or Service annotations when access must remain restricted to your Tailnet users.

Related Skills

Explore More Software Engineering Skills→
missBergmissBerg
3

eg-tls

Configure Envoy Gateway TLS termination, passthrough, and mTLS with cert-manager integration.

Community
Advanced
shepherdjerredshepherdjerred
127

tailscale-networking

Manage Tailscale ingress for private Tailnet and public Funnel exposure.

Community
Intermediate
ionfuryionfury
24

gateway-routing

Expose Kubernetes services via Gateway API with TLS and Coraza WAF.

Community
Advanced
WbunkerWbunker

istio-expert

Provide expert Istio service mesh assistance for architecture, traffic, security, and observability.

Community
Advanced