Networking

The connections

OpenLM Platform depends on the following connections:

From	To	Port	Needed for
Users' browsers	Platform address	443	Everything users do
Agents (license server agents, workstation agents)	Platform address	443	Sending usage data
Pods	Platform address	443	Checking sign-in tokens (see the next section)
Pods	SQL Server	1433 (or yours)	Data
Pods	MongoDB	27017 (or yours)	Data
Pods	Kafka	9092 (or yours)	Events between services
Pods	Redis	6379 (or yours)	Cache, API gateway
Nodes	public.ecr.aws	443	Pulling images
Nodes	docker.tyk.io	443	Pulling the API gateway image
Pods	Each other, in the namespace	various	Service to service

Service-to-service traffic inside the namespace uses plain HTTP on the cluster network. It never leaves the cluster.

Reaching the platform address from inside the cluster

Pods must reach OpenLM Platform at its public address. This is the networking requirement people miss most often.

Several services check every sign-in token by asking the identity service at its public address, https://<DOMAIN>/identity. They don't use an internal shortcut, because the address inside a token must match the address users signed in at. So pods must be able to do all three of the following:

1. Resolve DOMAIN to an address.
2. Connect to it on port 443.
3. Trust its certificate. See TLS certificates.

If any of the three fails, users can open the home page but every screen that loads data fails, and the services log IdentityUnavailable.

When pods can't reach it

On certain networks, traffic from a pod to the cluster's own external load balancer doesn't come back. This is called a hairpin problem, and it's common with on-premises load balancers and with certain firewalls. In other cases, the DNS name exists only in an internal zone that the cluster's DNS doesn't use.

To fix it, make the name resolve, inside the cluster only, to the ingress controller's internal service. On clusters with CoreDNS (EKS, AKS, K3s), add a rewrite rule:

rewrite name exact openlm.example.com traefik.kube-system.svc.cluster.local

Replace the host name with your DOMAIN, and the target with your ingress controller's service (<service>.<namespace>.svc.cluster.local). Where to put the rule depends on your Kubernetes distribution. See EKS, AKS, or K3s. Users outside the cluster are unaffected.

After you change DNS, restart the OpenLM Platform services so they reconnect: kubectl -n openlm rollout restart deployment.

DNS rules

Follow these rules for the DNS name:

• Under 50 characters: The DNS name must be under 50 characters. The UIs' web server keeps names in a fixed-size table, and names that are too long fail to start it.
• IPv4: Pods use IPv4. If your nodes' DNS resolvers answer only over IPv6, pods can't resolve external names. Point the cluster DNS at IPv4 resolvers.
• One name for everything: Don't publish OpenLM Platform under two names. Sign-in tokens carry the name, and a second name breaks sign-in for users who use it.

Data services

Set up the connections to your data services this way:

• Use names (or IPs) that pods can reach. A database name that works from your laptop through a VPN might not resolve inside the cluster.
• Managed services in the cloud usually sit behind a firewall or security group. Allow the cluster's outbound address: the NAT gateway IP on EKS and AKS, the nodes' IPs elsewhere. On EKS and AKS you can allow the cluster's security group or subnet instead.
• Kafka must advertise an address that pods can reach. See Data services: Kafka.

Registry mirror

All OpenLM images come from public.ecr.aws/r3q3q2f4/olm-*, with tags of the form 1.YYMMDD.HHMM. If your nodes can't reach the internet, mirror that path into your registry (Artifactory, Nexus, Quay, Harbor, ECR, ACR):

• A pull-through or remote repository for public.ecr.aws is the easiest option. Images keep their names, and only the registry host changes.
• Point the cluster at the mirror with your container runtime's mirror setting, or your cluster's image mirror policy on OpenShift (ImageDigestMirrorSet / ImageTagMirrorSet).

Each release lists its images in its release notes.

Network policies

The chart creates no NetworkPolicies. If your cluster denies traffic by default, allow the following traffic:

• From the ingress controller to the pods in openlm, on all ports the services expose.
• Between pods in openlm.
• From pods in openlm to your data services, and to the OpenLM Platform address on port 443.