I need to some support to over from bottle neck issue, which is calls is not working saying connecting, Its new setup i did, and migrated livekit from VM based to K8s cluster. context: -------- "In the livekit design, If I am using haproxy loadbalancer beforw livekit node to manafer wss sigling and turn traffic via haproxy instead directly to livekit nodes, I have done all the setup and I deployed new Livekit setup in kubernetes , where Livekit is working with my existing deployed chat application call MMS service running os same cluster in different namespace, which is abstraction layer for managing the token, So architecture point of view I am using client (external) --------haproxy loadbalancer (wss or signaling sni media.example.com + WebRTC sni media-ntunr.external.com connection on 3478 (UDP)) -------> istioingressGateway + Virtualservice, I have created two services into the istio-system for service one service called X4-ingressgateway which is recieving the all TCPrequest + other livekit-ingressGateway service for livekit traffic, Like wss(signaling) on port 443 TCP is getting managed by livekit-istioingressgateway -------> livekit-gateway which two endpoint one for livekit-quartz.external.com for (WSS request) and other route livekit-nturn-quartz.external.com (turn request on port 3478/UDP) connection with policy externalTrafficPolicy: Local or externalTrafficPolicy: Cluster. currently livekit cluster is running and integrated by chat service, also I am not using public IP directly NAT with livekit nodes, Istead I am reusing the Haproxy Public IP and configure Haproxy public IP in the livekit config.yaml in RTC section in my livekit version v1.9.4 use_external_ip: true also external_ip: "Public_IP_Of _Haproxy", - Currently I have deployed the livekit into the K8s as daemonset along with redis+Sentinel cluster. --------- Architecture ------------------ Model A – LiveKit Behind L4 LoadBalancer (Correct) HAProxy passes: TCP 443 → WSS Signaling UDP 3478 → LiveKit TURN (From haproxy --- Livekit node on 3478 direct via hostNetwork) UDP media ports 40k - 50k → (From haproxy --- Livekit node on 40k - 50k LiveKit advertises HAProxy public IP BUT HAProxy must be a pure L4 passthrough please provide the haproxy changes which should work with UDP, Note I am using Haproxy enteprise version which is supporting UDP traffic now.] current haproxy config ------------------------ global maxconn 10000 log 127.0.0.1 local0 log 127.0.0.1 local1 notice chroot /var/empty stats socket /run/hapee-3.0/hapee-lb.sock mode 660 level admin expose-fd listeners stats timeout 10m module-path /opt/hapee-3.0/modules module-load hapee-lb-udp.so daemon nbthread 1 #cpu-map 1 0 #cpu-map 2 1 # ======================= # DEFAULTS # ======================= defaults log global option tcplog option dontlognull option redispatch option logasap timeout connect 5000 timeout client 50000 timeout server 50000 # ======================= # HTTPS / WSS / TURN-TLS FRONTEND # ======================= frontend https bind 0.0.0.0:443 mode tcp tcp-request inspect-delay 5s tcp-request content accept if { req_ssl_hello_type 1 } # ---- Matrix / App traffic ---- acl acl_synapse_matrix req_ssl_sni -i quartz1.service421.com acl acl_ntfy_matrix req_ssl_sni -i quartz1-ntfy.service421.com acl acl_sygnal_matrix req_ssl_sni -i quartz1-sygnal.service421.com use_backend bk_istio_ingress_gw if acl_synapse_matrix use_backend bk_istio_ingress_gw if acl_ntfy_matrix use_backend bk_istio_ingress_gw if acl_sygnal_matrix # ---- LiveKit ---- acl acl_livekit_wss req_ssl_sni -i livekit-quartz.service421.com acl acl_livekit_turn req_ssl_sni -i livekit-nturn-quartz.service421.com use_backend bk_livekit_wss if acl_livekit_wss use_backend bk_livekit_tls if acl_livekit_turn # ======================= # BACKENDS # ======================= # ---- General Istio Gateway (apps) ---- backend bk_istio_ingress_gw mode tcp server aw01-quartz aw01-quartz:32555 check server aw02-quartz aw02-quartz:32555 check server aw03-quartz aw03-quartz:32555 check # ---- LiveKit WSS (443 → 30880) ---- backend bk_livekit_wss mode tcp balance leastconn option tcp-check server lk01 lk01-quartz:30880 check server lk02 lk02-quartz:30880 check server lk03 lk03-quartz:30880 check # ---- LiveKit TURN-TLS (5349 → 32550) ---- backend bk_livekit_tls mode tcp balance leastconn option tcp-check server lk01 lk01-quartz:32550 check server lk02 lk02-quartz:32550 check server lk03 lk03-quartz:32550 check # ---- Traefik PoC ---- backend bk_traefik_poc mode tcp server k3sm-quartz k3sm-quartz:30499 check # ===================================================================== # FRONTENDS (TCP) # ===================================================================== # TURN TLS frontend turn_tls_tcp_frontend bind *:5349 mode tcp option tcplog default_backend livekit_turn_tls_tcp # TURN Plain (TCP) frontend turn_tcp_frontend bind *:3478 mode tcp option tcplog default_backend livekit_turn_tcp # ===================================================================== # BACKENDS (TCP) # ===================================================================== backend livekit_turn_tls_tcp mode tcp balance source server lk01-k8s lk01-quartz:3478 check server lk02-k8s lk02-quartz:3478 check server lk03-k8s lk03-quartz:3478 check backend livekit_turn_tcp mode tcp balance source server lk01-k8s lk01-quartz:3478 check server lk02-k8s lk02-quartz:3478 check server lk03-k8s lk03-quartz:3478 check # ===================================================================== # UDP LOAD BALANCING (HAPEE UDP-LB) # ===================================================================== # TURN UDP udp-lb udp_livekit_turn dgram-bind *:3478 balance source server lk01-k8s lk01-quartz:3478 check server lk02-k8s lk02-quartz:3478 check server lk03-k8s lk03-quartz:3478 check # RTC Primary Media Port udp-lb rtc_udp_7882 dgram-bind *:7882 balance source server lk01-k8s lk01-quartz:3478 check server lk02-k8s lk02-quartz:3478 check server lk03-k8s lk03-quartz:3478 check # WebRTC RTP Media Range (40000-50000) # 1:1 port mapping is critical here #udp-lb udp_livekit_rtp # dgram-bind *:40000-50000 # balance source # server lk01 lk01-quartz check

Hi, this channel is for questions related to LiveKit inference, you might get more luck in the #C07FVFL1H3P channel