> ## Documentation Index
> Fetch the complete documentation index at: https://docs.layerrail.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Expose an application using TLS

> Expose a Kubernetes workload through a LayerRail load balancer with a managed TLS certificate, custom domain, and HTTPS-only routing rules.

Use TLS when a Kubernetes service receives traffic from browsers, API clients, webhooks, or external systems.

## Recommended flow

<Steps>
  <Step title="Deploy the application">
    Deploy your workload and confirm the pods are healthy.
  </Step>

  <Step title="Create a service">
    Expose the deployment with a service.
  </Step>

  <Step title="Attach a hostname">
    Use the service hostname created by LayerRail or point a custom DNS record at the load balancer.
  </Step>

  <Step title="Enable TLS">
    Use your ingress controller or certificate manager to request and renew certificates.
  </Step>
</Steps>

## Example service

```yaml theme={null}
apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  type: LoadBalancer
  selector:
    app: web
  ports:
    - port: 80
      targetPort: 3000
```

## Certificate management

You can use standard Kubernetes tooling such as cert-manager when your cluster is configured for public DNS validation or HTTP validation.

<Info>
  Service hostnames under LayerRail-managed domains can show a waiting page until an application is attached and serving traffic.
</Info>