Why teams replace assembled cloud services with KERNSTACK Gateway
Teams otherwise hand-assemble an edge and DNS layer per project: a gateway product here, a CDN distribution there, certificates and rewrite rules in a third console. On KERNSTACK the whole public surface is one list in the manifest, identical in preview and production.
The route vocabulary
http routes carry APIs; making one private requires an API key, and keys are declared per route (name, optional expiry, rotation) with the raw key printed once at first deploy. domains bind verified hostnames — whole-host or under a path_prefix, at most ten prefixes per hostname, with one catch-all required. Requests arrive with X-Forwarded-For, X-Forwarded-Proto, and IP-based viewer location headers attached.
Prefix routes: sites as routes
A prefix route serves a bucket like a website: default_key for the index document, an optional key prefix restriction, canonical redirects onto one URL spelling, fallback_mode between SPA shell and truthful 404, block_alias_url to confine traffic to the custom domain, and cdn_enabled for cached delivery. A project’s site, its API, and its websockets are neighbours in one routes list.
- Removing a hostname needs the destructive confirmation; moving one needs an explicit takeover flag
- Routes exist identically per environment target — previews get real URLs, not tunnels
- Route names are stable handles other configuration references (ref-api-key://route/key)
SDKs & Language Integration
Every KERNSTACK environment vendors typed SDK packages into .kernstack/ so both engineers and coding agents in Agent Sandboxes can call Gateway without external credentials:
- Go SDK:
github.com/coding-berlin/kernstack-sdk-go/sdk_stacks - Node.js SDK:
kernstack-sdk - Python SDK:
kernstack_sdk - PHP SDK:
kernstack/sdk (Composer)
European alternatives to the hyperscaler equivalent
Implementation guides for Gateway
Frequently asked questions
Declared on the route: name, optional expires_at, and rotate to mint a replacement on the next deploy. The raw key prints once. One route’s key can be referenced by another route that must call it.
Yes — bind routes under path prefixes (for example /api) beside exactly one catch-all route for the host. Prefixes are stripped before invocation and passed along in a header.
No. It is the routes block of the file you already maintain. Everything public about the project — every hostname, key, and socket — is enumerable from that one list, which is precisely what reviewers and agents need.
Related capabilities, architectures, and comparisons
Ship your stack on the Software Lifecycle Cloud.
Closed preview on dedicated European infrastructure. Bring a repository or start from a blueprint.