Put the model on your domain

Alice, the platform engineer, verifies apps.example.com and installs Certificates, Gateway and DNS Automation on eks-prod (your cluster's name), so the model qwen-chat gets an HTTPS address at qwen-chat.apps.example.com.

Before you start

• Certificates and Model Serving on eks-prod, on a Kubernetes version the console marks compatible with both add-ons.
• A domain you own, with a public Route 53 hosted zone for the name you will use (below).

Give your domain a Route 53 hosted zone

Certificates and DNS Automation write records in Route 53, so the name your models answer on needs a public hosted zone there. If your domain's DNS is already in Route 53, use that zone. Otherwise (ours is on Cloudflare), delegate a subdomain such as apps.example.com (a subdomain of a domain you own, like apps.yourcompany.com) to its own zone; your apex domain stays with its current DNS provider.

1. Create a public hosted zone for the subdomain. In the AWS console: Route 53 > Hosted zones > Create hosted zone, Domain name apps.example.com, Type Public hosted zone. Or:

   Terminal

   aws route53 create-hosted-zone --name apps.example.com --caller-reference "apps-$(date +%s)"

2. Copy the zone's four name servers from its NS record, such as:

   ns-2048.awsdns-64.com
   ns-2049.awsdns-65.net
   ns-2050.awsdns-66.org
   ns-2051.awsdns-67.co.uk

3. At the parent domain's DNS provider, add four NS records named apps, one per name server. On Cloudflare that is DNS > Records > Add record, Type NS, Name apps. Comment each one, for example delete at teardown.

4. Wait until all four answer, usually minutes:

   Terminal

   dig NS apps.example.com +short

Remove the zone and its NS records together

An NS record left pointing at a deleted zone lets someone else take the name.

1. Alice verifies the domain

Path: Integrations > Domains

1. Add domain, Domain name apps.example.com, Claim domain.
2. Publish the TXT record the card shows in your Route 53 zone (ours was named _astro-verification.apps.example.com), then Verify. Ours resolved in about a minute.

Once verified, the domain reads Ready to use.Open zoom view

Once verified, the domain reads Ready to use.

Claim once

Each claim gets a new TXT value, so claiming again makes an earlier record stop matching.

2. Alice configures the issuer

Path: Infrastructure > Kubernetes > eks-prod > Add-ons > Certificates > Configure

1. Enable cluster issuer: on.
2. Issuer type: Let's Encrypt staging while you test.
3. Email: platform@example.com (your contact email for certificate notices).
4. DNS solver: Provider AWS Route 53.
5. Hosted zone ID: Z0123456789ABCDEFGHIJ (yours from the zone you created). Leave it empty to find the zone by name.
6. On Review, select Continue to apply once the dry run passes, type cert-manager, then select Update cert-manager.

Staging and DNS-01 while testing.Open zoom view

Staging and DNS-01 while testing.

Staging first, then production

Once issuance works, set Issuer type to Let's Encrypt: clients don't trust staging. Production limits retries per hostname, so use a fresh hostname for each attempt. Self-signed needs no DNS, and browsers do not trust it.

3. Alice installs Gateway

Path: Infrastructure > Kubernetes > eks-prod > Add-ons > Install Add-on

1. Select Gateway.
2. Auto scaling: leave Enabled off for this walkthrough, which runs one proxy pod.
3. Leave Enable node port as it is.
4. On Review, select Continue to deploy once the dry run passes, then Deploy gateway.

Scaling off for now; the rest at its defaults.Open zoom view

Scaling off for now; the rest at its defaults.

Gateway turns healthy, with an Addresses entry on its Access card.

Scale the gateway before launch

Off, one proxy pod carries every exposed model's traffic. With Enabled on, you set Metric, Min replicas, Max replicas and Target CPU percent.

4. Alice installs DNS Automation (optional)

DNS Automation publishes the record for the model's hostname; without it, create the record by hand.

Path: Infrastructure > Kubernetes > eks-prod > Add-ons > Install Add-on

1. Provider AWS Route 53, Domain filter apps.example.com.
2. Gateway routes: on.
3. Cloud access: None. A registered cluster uses Workload identity with an AWS role ARN.

Provider and domain filter.Open zoom view

Provider and domain filter.

Gateway routes, on.Open zoom view

Gateway routes, on.

Dry run logs without writing. Policy defaults to Sync and can be Upsert only.

Install Gateway on eks-prod, and DNS Automation for apps.example.com on Route 53.

Ask Nova

It shows the plan and installs them when you approve. Claim and verify the domain in the console first.

Clean up

Delete the model first. Then under Integrations > Domains select Release on each hostname, then Delete domain and confirm with Delete; it works once no hostnames are bound. Remove the TXT verification record from your Route 53 zone, and the model's record if DNS Automation did not. For the full order, see Clean up.

Next

• Let only your customers call it