Ingress

Ingress is how traffic from the outside world reaches Supervisely running inside your cluster. The Helm chart generates the right ingress resources for you — you just tell it which controller you use and which domain to serve.

The chart does not install an ingress controller. You need one already running in the cluster (see the links below). The chart only creates the routing rules for it.

The two values you almost always set

ingress:
  enabled: true              # set false only if you handle routing yourself
  controller: traefik        # which controller to generate rules for
  host: supervisely.mycompany.com   # your domain

• ingress.controller — which ingress controller you have. This decides which kind of resources the chart generates.

• ingress.host — the domain name where Supervisely is reachable. This becomes the host in the generated ingress rule. Create a DNS record for it pointing at your ingress controller's external address.

Supported controllers

ingress.controller	Controller	Install docs
traefik (default)	Traefik	install
nginx	NGINX Ingress	install
projectcontour	Contour	install
gateway	Kubernetes Gateway API	docs
istio	Istio	install

Sensible defaults for each controller are applied automatically, so most installs only need controller and host.

For a new cluster, prefer Traefik (the default) or the Gateway API. The upstream ingress-nginx controller is being retired by the Kubernetes project (end of maintenance ~March 2026). The chart still supports nginx for clusters that already run it, but it's not recommended for fresh deployments.

Per-controller options

Extra options go under ingress.options. You only need these if the defaults don't match your setup.

NGINX

ingress:
  controller: nginx
  host: supervisely.mycompany.com
  options:
    ingressClassName: nginx     # default: nginx
    tlsSecretName: ""           # set to enable TLS (see below)

Traefik

ingress:
  controller: traefik
  host: supervisely.mycompany.com
  options:
    entrypoint: websecure       # default: websecure
    ingressClassName: traefik
    tlsSecretName: ""           # set to enable TLS

Istio

Istio routes through an existing Gateway, so you reference it instead of setting a TLS secret:

ingress:
  controller: istio
  host: supervisely.mycompany.com
  options:
    gateway: istio-ingress/private-gateway   # <namespace>/<gateway-name>

Gateway API

Gateway API is the official successor to the Ingress API and the direction the ecosystem is moving in. Note that it's a specification, not a controller — you run an implementation of it (Traefik, Envoy Gateway, Istio, NGINX Gateway Fabric, the AWS Load Balancer Controller, and others all support it). Install the Gateway API CRDs and an implementation, create a Gateway, then point the chart at it:

ingress:
  controller: gateway
  host: supervisely.mycompany.com
  options:
    gateway: my-gateway            # name of your existing Gateway
    gatewayNamespace: default
    sectionName: https
    port: 443

The chart generates HTTPRoutes that attach to the Gateway you reference — it does not install the CRDs, the implementation, or the Gateway itself.

Contour

ingress:
  controller: projectcontour
  host: supervisely.mycompany.com
  options:
    tls: {}     # configure TLS on the HTTPProxy

Enabling HTTPS (TLS)

For nginx and traefik, create a Kubernetes TLS secret with your certificate and reference it:

kubectl -n supervisely create secret tls supervisely-tls \
  --cert=fullchain.pem --key=privkey.pem

ingress:
  options:
    tlsSecretName: supervisely-tls

For istio, gateway and projectcontour, TLS is configured on the Gateway / HTTPProxy that you reference, not on the chart — follow your controller's documentation.

Supervisely also has a built-in HTTPS option that terminates TLS inside the platform. For Kubernetes deployments, terminating TLS at the ingress controller (as above) is usually simpler. See HTTPS for the built-in option.

Custom annotations

You can add your own annotations to the generated ingress resources — for example, to work with external-dns or cert-manager:

ingress:
  annotations:
    external-dns.alpha.kubernetes.io/target: "203.0.113.10"
    cert-manager.io/cluster-issuer: letsencrypt-prod

Checking it works

kubectl -n supervisely get ingress

Confirm the resource shows your host and an external address, then verify DNS for that host resolves to your ingress controller. If the site doesn't load, double-check that the ingress controller is installed and its external IP/hostname is reachable.