---
title: Troubleshooting
description: Symptoms, causes, and fixes for the most common problems when you install and run OpenLM Platform on Kubernetes.
product: OpenLM Platform
---

To fix a problem, find its symptom on this page, check the cause, and apply the fix. If nothing matches, [collect diagnostics](#collect-diagnostics) and contact OpenLM support.

## Pods

These symptoms show in the pod status, its events, or its log:

| Symptom | Cause | Fix |
|---|---|---|
| `Pending` with `didn't match Pod's node affinity` | Node placement is on, but no node carries the `openlm.com/role` label | Label nodes, or set `global.affinity.enabled: false` and `global.taints.enabled: false`. [Node placement](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/node-placement) |
| `Pending` with `Too many pods` | The node's pod limit is reached | EKS: more nodes or prefix delegation. K3s: `max-pods=250`. [EKS](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/eks), [K3s](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/k3s) |
| `Pending` with `Insufficient cpu` / `memory` | Not enough capacity | Add nodes. [Requirements](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/before-you-start/requirements) |
| PVC `Pending`, pod `Pending` | Wrong storage class, or provisioner annotation from another cluster | Check `STORAGE_CLASS`, generate the values file again ([step 4](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/install/step-4-values)), delete the PVC, run the installation again |
| `ImagePullBackOff` | No route to `public.ecr.aws`, or the mirror lacks the image | [Registry mirror](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/networking#registry-mirror) |
| `CreateContainerConfigError` | A Secret is missing | Run `create-openlm-secrets.sh` again ([step 3](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/install/step-3-secrets)) |
| `CrashLoopBackOff`, log says `too many open files` / `inotify` | Node file-watch limit too low | [Node settings](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/index#node-settings-that-apply-everywhere) |
| `CrashLoopBackOff`, log says `Login failed for user` or `FormatException` | SQL credentials wrong | Check `SQL_USER` / `SQL_PASSWORD`, run the secrets script again, restart |
| `CrashLoopBackOff`, log mentions Redis or `abortConnect` | Redis unreachable, wrong password, or TLS mismatch | Check `REDIS_*`, especially `REDIS_TLS` |
| `CrashLoopBackOff`, log mentions Kafka `bootstrap` or `broker` | Kafka unreachable, or it advertises an address pods can't reach | [Step 2.3](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/install/step-2-data-services#23-kafka) |
| `OOMKilled` | Memory limit too low for your data volume | Raise `<component>.resources.limits.memory` |
| OpenShift: `FailedCreate ... security context constraint` | A component sets a user ID outside the project's range | [OpenShift values](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/openshift#values) |

## Sign-in and screens

These symptoms show in the browser or in the service logs:

| Symptom | Cause | Fix |
|---|---|---|
| Home page loads, every screen fails to load data | Services can't reach or don't trust `https://DOMAIN/identity` | [Networking](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/networking#reaching-the-platform-address-from-inside-the-cluster), [TLS](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/tls-certificates) |
| Service logs show `IdentityUnavailable` (503) | Same | Same, then `kubectl -n openlm rollout restart deployment` |
| Browser loops between a screen and the sign-in page | Issuer settings don't match the browser's address, or `http://` used somewhere | [Sign-in and identity](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/concepts/identity-and-sign-in) |
| `/api/licensemanager/bff/user` returns `404` instead of `401` | Services started while identity was down and run without security | Restart the services once identity is healthy |
| Internal HTTPS errors, browsers fine | Private CA, and the certificate file lacks the root | Add the root to the end of the file, recreate `openlm-lb-cert` |
| OpenShift: sign-in answers `409` | The identity Route still rewrites its path | [OpenShift Routes](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/openshift#routes), step 2 |
| OpenShift: a page shows the home page instead | That page has no Route | [OpenShift Routes](https://www.openlm.com/documentation/cloud/deployment-operations/on-premise/deployment-guide/kubernetes/platforms/openshift#routes), step 1 |

## Installation and upgrades

These symptoms show while you install, upgrade, or license OpenLM Platform:

| Symptom | Cause | Fix |
|---|---|---|
| `helm` stops with `timed out waiting for the condition` | The topic setup job ran longer than `--timeout` | Run the same command again. It continues. Use `--timeout 60m`. |
| Changed a setting, nothing happened | Helm doesn't restart pods when only configuration content changes | `kubectl -n openlm rollout restart deployment` |
| `rendered manifests contain a resource that already exists` | An object was created by hand (for example an OpenShift Route) with the same name the chart now uses | Delete the hand-made object, run the installation again |
| Products show "not licensed" right after uploading the license | Products were activated before the license was uploaded | Wait about 12 hours, or contact OpenLM support |
| A service is `Running` but not ready, with many failed background jobs | Its job health check fails after more than 10 failed jobs | Contact OpenLM support with the [diagnostics](#collect-diagnostics) |

## Collect diagnostics

To collect diagnostics for OpenLM support, run this script. It writes a `.tgz` bundle:

```bash
NS=openlm; OUT=openlm-diag-$(date +%Y%m%d-%H%M); mkdir -p $OUT
helm -n $NS list -a                                  > $OUT/helm-list.txt
helm -n $NS history openlm-platform                  > $OUT/helm-history.txt
kubectl -n $NS get pods -o wide                      > $OUT/pods.txt
kubectl -n $NS get events --sort-by=.lastTimestamp   > $OUT/events.txt
for p in $(kubectl -n $NS get pods --no-headers | grep -vE "Running|Completed" | awk '{print $1}'); do
  kubectl -n $NS describe pod $p        > $OUT/describe-$p.txt
  kubectl -n $NS logs $p --all-containers --tail=300 > $OUT/log-$p.txt 2>&1
  kubectl -n $NS logs $p --all-containers --previous --tail=300 > $OUT/log-$p-previous.txt 2>&1
done
tar czf $OUT.tgz $OUT && echo "send $OUT.tgz to OpenLM support"
```

The bundle contains pod names, events, and logs, but no Secret contents. Look through it before you send it, in case your logs contain anything you'd rather not share.