Troubleshooting

To fix a problem, find its symptom on this page, check the cause, and apply the fix. If nothing matches, collect diagnostics and contact OpenLM support.

Pods

These symptoms show in the pod status, its events, or its log:

Symptom	Cause	Fix
Pending with didn't match Pod's node affinity	Node placement is on, but no node carries the openlm.com/role label	Label nodes, or set global.affinity.enabled: false and global.taints.enabled: false. Node placement
Pending with Too many pods	The node's pod limit is reached	EKS: more nodes or prefix delegation. K3s: max-pods=250. EKS, K3s
Pending with Insufficient cpu / memory	Not enough capacity	Add nodes. Requirements
PVC Pending, pod Pending	Wrong storage class, or provisioner annotation from another cluster	Check STORAGE_CLASS, generate the values file again (step 4), delete the PVC, run the installation again
ImagePullBackOff	No route to public.ecr.aws, or the mirror lacks the image	Registry mirror
CreateContainerConfigError	A Secret is missing	Run create-openlm-secrets.sh again (step 3)
CrashLoopBackOff, log says too many open files / inotify	Node file-watch limit too low	Node settings
CrashLoopBackOff, log says Login failed for user or FormatException	SQL credentials wrong	Check SQL_USER / SQL_PASSWORD, run the secrets script again, restart
CrashLoopBackOff, log mentions Redis or abortConnect	Redis unreachable, wrong password, or TLS mismatch	Check REDIS_*, especially REDIS_TLS
CrashLoopBackOff, log mentions Kafka bootstrap or broker	Kafka unreachable, or it advertises an address pods can't reach	Step 2.3
OOMKilled	Memory limit too low for your data volume	Raise <component>.resources.limits.memory
OpenShift: FailedCreate ... security context constraint	A component sets a user ID outside the project's range	OpenShift values

Sign-in and screens

These symptoms show in the browser or in the service logs:

Symptom	Cause	Fix
Home page loads, every screen fails to load data	Services can't reach or don't trust https://DOMAIN/identity	Networking, TLS
Service logs show IdentityUnavailable (503)	Same	Same, then kubectl -n openlm rollout restart deployment
Browser loops between a screen and the sign-in page	Issuer settings don't match the browser's address, or http:// used somewhere	Sign-in and identity
/api/licensemanager/bff/user returns 404 instead of 401	Services started while identity was down and run without security	Restart the services once identity is healthy
Internal HTTPS errors, browsers fine	Private CA, and the certificate file lacks the root	Add the root to the end of the file, recreate openlm-lb-cert
OpenShift: sign-in answers 409	The identity Route still rewrites its path	OpenShift Routes, step 2
OpenShift: a page shows the home page instead	That page has no Route	OpenShift Routes, step 1

Installation and upgrades

These symptoms show while you install, upgrade, or license OpenLM Platform:

Symptom	Cause	Fix
helm stops with timed out waiting for the condition	The topic setup job ran longer than --timeout	Run the same command again. It continues. Use --timeout 60m.
Changed a setting, nothing happened	Helm doesn't restart pods when only configuration content changes	kubectl -n openlm rollout restart deployment
rendered manifests contain a resource that already exists	An object was created by hand (for example an OpenShift Route) with the same name the chart now uses	Delete the hand-made object, run the installation again
Products show "not licensed" right after uploading the license	Products were activated before the license was uploaded	Wait about 12 hours, or contact OpenLM support
A service is Running but not ready, with many failed background jobs	Its job health check fails after more than 10 failed jobs	Contact OpenLM support with the diagnostics

Collect diagnostics

To collect diagnostics for OpenLM support, run this script. It writes a .tgz bundle:

NS=openlm; OUT=openlm-diag-$(date +%Y%m%d-%H%M); mkdir -p $OUT
helm -n $NS list -a                                  > $OUT/helm-list.txt
helm -n $NS history openlm-platform                  > $OUT/helm-history.txt
kubectl -n $NS get pods -o wide                      > $OUT/pods.txt
kubectl -n $NS get events --sort-by=.lastTimestamp   > $OUT/events.txt
for p in $(kubectl -n $NS get pods --no-headers | grep -vE "Running|Completed" | awk '{print $1}'); do
  kubectl -n $NS describe pod $p        > $OUT/describe-$p.txt
  kubectl -n $NS logs $p --all-containers --tail=300 > $OUT/log-$p.txt 2>&1
  kubectl -n $NS logs $p --all-containers --previous --tail=300 > $OUT/log-$p-previous.txt 2>&1
done
tar czf $OUT.tgz $OUT && echo "send $OUT.tgz to OpenLM support"

The bundle contains pod names, events, and logs, but no Secret contents. Look through it before you send it, in case your logs contain anything you'd rather not share.