Domains, Managed DNS, TLS, and Service Exposure

GWEB Cloud provides tenant-facing workflows for connecting approved tenant applications to public domains and supported service exposure.

These workflows remain tenant-scoped and do not require tenants to receive GWEB cloud-provider or Kubernetes administrator credentials.

Domain lifecycle

The tenant-facing lifecycle is:

application ownership
      |
      v
domain registration / attachment
      |
      v
domain verification
      |
      v
GWEB-managed DNS
      |
      v
TLS readiness
      |
      v
service exposure

Use the tenant profile assigned by GWEB for every command.

Authorization

Domain/service-exposure operations can depend on:

• authenticated tenant principal;
• tenant role/capability;
• target environment state;
• application ownership;
• service-exposure authority;
• domain verification state.

Managed DNS

GWEB-managed DNS is available through gwebc.

To create or reconcile the GWEB-managed DNS record for an authorized domain:

gwebc --profile <profile> \
  domain dns <domain_id> \
  --action UPSERT

To remove the GWEB-managed DNS record owned by that domain record:

gwebc --profile <profile> \
  domain dns <domain_id> \
  --action DELETE

The control path is:

tenant
  |
gwebc
  |
GWEB tenant broker
  |
GWEB DNS reconciler
  |
GWEB-managed DNS provider

Tenants do not need:

• GWEB AWS credentials;
• direct Route53 credentials;
• AWS CLI access;
• direct Route53 mutation;
• DNS-reconciler credentials;
• Kubernetes administrator credentials.

The DNS reconciler performs the cloud-provider mutation from the GWEB control plane. Tenant-side UPSERT and DELETE requests remain scoped by tenant authorization, application/domain ownership, and the managed-domain state.

After requesting an action, inspect the tenant-visible domain/DNS state until it reports the expected managed-DNS result.

TLS

TLS is managed by the GWEB platform after the required domain and exposure conditions are satisfied.

Tenants should inspect tenant-visible domain/TLS state rather than editing certificate-controller or Gateway resources directly.

The tenant-facing TLS path remains within GWEB control-plane workflows; tenants do not manage cert-manager, Certificate objects, Gateway listeners, or TLS Secrets directly.

Service exposure

Public service exposure is an application capability, not a grant of cluster-wide ingress administration.

The tenant must use the application/domain workflow approved for its tenant and environment.

Troubleshooting order

If exposure is not ready, verify in this order:

1. correct tenant profile;
2. application ownership;
3. environment state;
4. tenant service-exposure capability;
5. domain verification;
6. managed DNS state;
7. TLS state;
8. application/service health.

Escalate to GWEB if the tenant-facing state indicates a platform-side failure. Do not bypass the tenant workflow with direct Kubernetes or cloud-provider credentials.