// the find
l7mp/stunner
A Kubernetes media gateway for WebRTC. Contact: info@l7mp.io
STUNner is a STUN/TURN gateway that runs inside Kubernetes, solving the genuinely hard problem of getting WebRTC media traffic in and out of a cluster without hostNetwork, hostPort, or 30,000-port NodePort services. It implements the Kubernetes Gateway API, so you configure it with the same YAML patterns as your ingress controllers. Built on pion/turn under the hood.
The core architecture insight is sound: funnel all UDP media through a single TURN ingress point, then route it to media servers (Janus, LiveKit, mediasoup, etc.) as normal ClusterIP traffic — this is genuinely the right way to do WebRTC in Kubernetes. Gateway API conformance means configuration lives in standard CRDs alongside the rest of your cluster config, not a bespoke operator DSL. The tutorial coverage is unusually thorough — working examples for Janus, Jitsi, LiveKit, mediasoup, and Kurento rather than just a hello-world demo. The eBPF TURN offload in the enterprise tier (10 Gbps/core claim) suggests the dataplane design is serious, even if that path requires a commercial license.
The free/paid tier split is a problem for anyone evaluating production readiness: the eBPF acceleration, and likely other performance features, are behind a commercial license with pricing that isn't public. You're adopting open-source infrastructure that may require a vendor conversation before it handles your load. The control plane is a separate operator (stunner-gateway-operator) that needs to be running and healthy — adding another failure domain and upgrade surface. Multi-cluster support appears in demos but the docs are thin on how failover and session affinity actually work when a TURN pod dies mid-call. There's also no first-party support for DTLS certificate rotation without restarting the dataplane pods, which matters for long-running clusters.