I use ingresses like traefik and the gateway API leaving my cluster. Then a wire guard tunnel to my DMZ to get to those. With keyclock for SSO.

I want to try Teleport for finer grained access then vpn but thats a future project