Ingress and routing

All traffic to OpenLM Platform arrives at one host name, and the path decides where it goes. Use this page to see how the chart sets that up and to choose the option that fits your cluster.

The paths

The following table shows where each path goes:

Path	Goes to	What it is
/	Home page UI	The entry point users open
/identity	Identity service	Sign-in, tokens, OpenID Connect discovery
/api/...	API gateway → services	All data requests from the UIs and from agents
/<page> (for example /licenses, /usage, /alerts)	One web UI each	The screens, about 40 of them

Three ways the chart can create the routing

The chart can create the routing in one of three ways:

Option	Setting	Creates	Use it on
Single Ingress (recommended)	global.masterIngress.enabled: true	One Ingress object with every path, plus /api to the gateway	EKS, AKS, K3s, any cluster with an ingress controller
OpenShift Routes	global.useOpenShift: true	One Route per web UI, edge TLS, HTTP → HTTPS redirect, security headers	OpenShift
Per-component Ingresses	both off	One Ingress per component, with nginx rewrite rules	Not recommended. Kept for older installations.

Single Ingress

The chart writes one Ingress named openlm-master-ingress:

• host: is global.masterIngress.hostname, your DOMAIN.
• ingressClassName: is global.masterIngress.ingressClassName, which picks the controller that serves it.
• TLS uses the secret global.masterIngress.secretName, openlm-lb-cert by default.
• /api goes to the API gateway service, gateway-svc-openlm-gateway-tyk-gateway. That name comes from the gateway release name openlm-gateway, which is why step 5 requires that name.

Each web UI is reached at its own path prefix (/licenses/, /usage/, ...). In this mode the chart also gives each UI a small web-server configuration that serves it correctly under its prefix. You don't need any rewrite rules in the controller, and the values file removes the old ones (global.ingressAnnotations).

OpenShift Routes

With global.useOpenShift: true, the chart creates Routes instead of Ingresses:

• TLS is terminated at the OpenShift router (edge). Plain HTTP is redirected to HTTPS.
• The router adds HSTS and security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy: frame-ancestors 'self'). You can tune HSTS with global.routeSecurity (hstsMaxAge, hstsIncludeSubDomains) or turn it off with global.routeSecurity.enabled: false.
• The path prefix is removed before the request reaches the UI (rewrite-target: /).

In this release, you create a few Routes by hand. For the commands, see Red Hat OpenShift.

Choose an ingress controller

Check your ingress controller in the following table:

Controller	Works	Notes
Traefik (K3s default)	Yes	Set INGRESS_CLASS=traefik.
ingress-nginx	Yes	Set INGRESS_CLASS=nginx.
AWS Load Balancer Controller (ALB)	Not as the OpenLM Platform ingress	The ALB doesn't serve the TLS secret from the cluster. It needs a certificate in AWS Certificate Manager and its own annotations. Put Traefik or ingress-nginx behind a Network Load Balancer instead. See EKS.
Azure Application Gateway (AGIC)	Not as the OpenLM Platform ingress	Same reason as the ALB. Use ingress-nginx or Traefik behind the Azure load balancer. See AKS.
OpenShift router	Yes, with Routes	Use global.useOpenShift: true.

Whatever the controller, it must do the following:

• Serve the TLS certificate from the Kubernetes secret openlm-lb-cert, so the certificate users see is the one you control.
• Pass the Host header through unchanged.
• Accept request bodies as large as your users' uploads, such as license files and logs. On ingress-nginx the default limit is 1 MB, so raise proxy-body-size on the controller.

Redirect HTTP to HTTPS

Users should only ever use https://. Redirect plain HTTP at the controller:

• Traefik: The web entry point redirects to websecure. On K3s, set this with a HelmChartConfig. See K3s.
• ingress-nginx: Redirects automatically when the Ingress has TLS.
• OpenShift Routes: The chart sets insecureEdgeTerminationPolicy: Redirect.