---
title: Ingress and routing
description: "How web traffic reaches OpenLM Platform: the single Ingress, OpenShift Routes, the API gateway, and which ingress controllers work."
product: OpenLM Platform
---

All traffic to OpenLM Platform arrives at **one host name**, and the path decides where it goes. Use this page to see how the chart sets that up and to choose the option that fits your cluster.

## The paths

The following table shows where each path goes:

| Path | Goes to | What it is |
|---|---|---|
| `/` | Home page UI | The entry point users open |
| `/identity` | Identity service | Sign-in, tokens, OpenID Connect discovery |
| `/api/...` | API gateway → services | All data requests from the UIs and from agents |
| `/<page>` (for example `/licenses`, `/usage`, `/alerts`) | One web UI each | The screens, about 40 of them |

## Three ways the chart can create the routing

The chart can create the routing in one of three ways:

| Option | Setting | Creates | Use it on |
|---|---|---|---|
| **Single Ingress** (recommended) | `global.masterIngress.enabled: true` | **One** `Ingress` object with every path, plus `/api` to the gateway | EKS, AKS, K3s, any cluster with an ingress controller |
| **OpenShift Routes** | `global.useOpenShift: true` | One `Route` per web UI, edge TLS, HTTP → HTTPS redirect, security headers | OpenShift |
| Per-component Ingresses | both off | One `Ingress` per component, with nginx rewrite rules | Not recommended. Kept for older installations. |

### Single Ingress

The chart writes one Ingress named `openlm-master-ingress`:

- `host:` is `global.masterIngress.hostname`, your `DOMAIN`.
- `ingressClassName:` is `global.masterIngress.ingressClassName`, which picks the controller that serves it.
- TLS uses the secret `global.masterIngress.secretName`, `openlm-lb-cert` by default.
- `/api` goes to the API gateway service, `gateway-svc-openlm-gateway-tyk-gateway`. That name comes from the gateway release name `openlm-gateway`, which is why step 5 requires that name.

Each web UI is reached at its own path prefix (`/licenses/`, `/usage/`, ...). In this mode the chart also gives each UI a small web-server configuration that serves it correctly under its prefix. You don't need any rewrite rules in the controller, and the values file removes the old ones (`global.ingressAnnotations`).

### OpenShift Routes

With `global.useOpenShift: true`, the chart creates Routes instead of Ingresses:

- TLS is terminated at the OpenShift router (**edge**). Plain HTTP is redirected to HTTPS.
- The router adds HSTS and security headers (`X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Content-Security-Policy: frame-ancestors 'self'`). You can tune HSTS with `global.routeSecurity` (`hstsMaxAge`, `hstsIncludeSubDomains`) or turn it off with `global.routeSecurity.enabled: false`.
- The path prefix is removed before the request reaches the UI (`rewrite-target: /`).

In this release, you create a few Routes by hand. For the commands, see [Red Hat OpenShift](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/openshift#routes).

## Choose an ingress controller

Check your ingress controller in the following table:

| Controller | Works | Notes |
|---|---|---|
| **Traefik** (K3s default) | Yes | Set `INGRESS_CLASS=traefik`. |
| **ingress-nginx** | Yes | Set `INGRESS_CLASS=nginx`. |
| **AWS Load Balancer Controller (ALB)** | Not as the OpenLM Platform ingress | The ALB doesn't serve the TLS secret from the cluster. It needs a certificate in AWS Certificate Manager and its own annotations. Put Traefik or ingress-nginx behind a Network Load Balancer instead. See [EKS](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/eks#ingress). |
| **Azure Application Gateway (AGIC)** | Not as the OpenLM Platform ingress | Same reason as the ALB. Use ingress-nginx or Traefik behind the Azure load balancer. See [AKS](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/aks#ingress). |
| **OpenShift router** | Yes, with Routes | Use `global.useOpenShift: true`. |

Whatever the controller, it must do the following:

- Serve the TLS certificate from the Kubernetes secret `openlm-lb-cert`, so the certificate users see is the one you control.
- Pass the `Host` header through unchanged.
- Accept request bodies as large as your users' uploads, such as license files and logs. On ingress-nginx the default limit is 1 MB, so raise `proxy-body-size` on the controller.

## Redirect HTTP to HTTPS

Users should only ever use `https://`. Redirect plain HTTP at the controller:

- **Traefik**: The `web` entry point redirects to `websecure`. On K3s, set this with a `HelmChartConfig`. See [K3s](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/k3s#https-redirect).
- **ingress-nginx**: Redirects automatically when the Ingress has TLS.
- **OpenShift Routes**: The chart sets `insecureEdgeTerminationPolicy: Redirect`.