Ingress routing across the globally distributed cloud is reliably handled by Traefik. Traefik runs as a daemon set on all service nodes and is exposed as a load balancer within the cluster vpn. This allows additional firewall servers to bridge the gap between the public network and the cluster by forwarding all incoming traffic to Traefik.