Public Edge Open source · Kubernetes + DNS

Route public traffic by health, not hope.

Kubernetes can expose workloads, but it does not decide which regional edge is reachable, has capacity and is healthy right now. Public Edge Manager turns that evidence into deterministic DNS answers and auditable PublicEdge status.

Quick startExplore the code
Authoritative DNSUDP+TCP
Helm chart0.8.4
Publishes by defaultOff
ReleasesSigned
Edge selectorClick an edge to change its evidence.
A model of the selection rules. Names and domains are placeholders.

Components

One authority, one egress fabric, read-only views.

Each part has one job. The decision lives in Kubernetes status, and the views never become the source of truth.

01

PublicEdgeManager

Kubernetes controller and authoritative DNS. Discovers candidates from Kubernetes facts, excludes stale, unreachable or unready ones, and selects by locality, capacity and priority.

public-edge-manager →
02

Mihomos Cluster

Egress fabric. Every labelled node consumes a node-local proxy; Ready-only providers offer healthy regional and global exits next to Cilium routing.

mihomos-cluster →

Boundaries

It chooses the edge. It does not run the network.

Public Edge Manager is application- and DNS-provider-agnostic. Optional integrations add evidence or publication; none of them is required.

Public Edge Manager does

  • Candidate discovery · from Nodes, Gateways and Services, not a private inventory
  • Exclusion on evidence · stale, unreachable or unready candidates never publish
  • Controlled failover · last-known-good through short probe failures
  • Authoritative DNS · delegated zone over UDP and TCP

It never configures

  • Routers, NAT and BGP · owned by their existing operators
  • Certificates and app routes · owned by their controllers
  • DNS provider credentials · ExternalDNS writes to PowerDNS; the credential stays there
  • Path evidence · read from AdvFab NetworkPathAssessment resources

Install

Nothing is published until the evidence is there.

The chart defaults to enabled: false. An edge is only published once the service directory, nameserver fallback and readiness evidence are configured.

  1. Copy the example values and replace every documentation address and domain.
  2. Install the signed OCI chart.
  3. Register a service and inspect the derived status from the least-privilege CLI pod.
CLI guide →
install.sh
helm install public-edge-manager \
  oci://ghcr.io/public-edge/charts/public-edge-manager \
  --version 0.8.4 \
  --namespace public-edge-system --create-namespace \
  --values values-production.yaml

# Register a service, then inspect
kubectl -n public-edge-system exec deploy/public-edge-manager-cli -- \
  edgectl service-register app.example.com \
  --service app --class web --probe-path /healthz
kubectl -n public-edge-system exec deploy/public-edge-manager-cli -- \
  edgectl status

Open-source cloud family

Three contracts that compose.

AdvFab produces path evidence, Public Edge consumes it to answer DNS, and Among Clusters connects clusters without sharing their keys. RE8CH Cloud runs all three as a managed service.

AdvFab

Network evidence controller for Kubernetes.

Open source Public Edge

Health-aware public ingress and authoritative DNS.

Open source Among Clusters

Sovereign cluster peering for BYOC services.

Open source RE8CH Cloud

The managed cluster network built on these projects.

Managed

Show capability. Protect infrastructure.

The site and roadmap contain product contracts, sanitized diagrams and reviewed evidence only. Internal addresses, routing tables, tenants, credentials and raw telemetry stay in their systems of record.

RoadmapSimulation study