You can use whatever ingress controller you like to expose the service - we use Contour/Envoy currently but most things should work. It just needs to be something that can proxy http2 traffic, and can re-encrypt if you’re using TLS on the backend