Ingress

The Helm chart can expose services with Kubernetes Ingress or Gateway API HTTPRoutes. Current production-shaped installs enable Gateway API (route.enabled: true) and disable classic Ingress for those components.

Gateway API (recommended)

Point each component’s route.parentRefs at your Traefik Gateway, for example:

gateway:
  route:
    enabled: true
    parentRefs:
      - name: traefik-gateway
        namespace: kube-system

Use the same parentRefs on matrix-authentication-service, elementWeb, elementAdmin, and matrixRTC when those components are enabled.

Leave route.hostnames empty to use the derived names from global.serverName, or set them explicitly if the public host differs.

Classic Ingress

Each of those components also has an ingress block (enabled, host / hostnames, className, TLS). Enable Ingress instead of route when the cluster does not use Gateway API. Do not enable both for the same hostname unless you know the controller will not conflict.

Matrix RTC media

The LiveKit SFU also exposes TCP and UDP NodePorts for WebRTC media (matrixRTC.sfu.exposedServices). Those ports are cluster-wide; pick values that do not collide with other installs on the same nodes, and allow them through any firewall in front of the cluster.

TLS

Terminate TLS on the Gateway or Ingress. Vesicle expects HTTPS on every public hostname listed in DNS and hostnames.