Skip to main content

​
Overview

Use this page when you expose Arize AX on IBM Kubernetes Service (IKS). The distribution bundles two IBM Cloud patterns under examples/endpoints/ibm/; pick one based on whether you need OTLP gRPC and Arrow Flight. IKS does not auto-expose the UI; both patterns route to service internalendpoints-app in namespace arize. Each pattern ships a single-endpoint variant (all services on one hostname) and a multi-endpoint variant (separate hostnames per role).

​
VPC NLB (Layer 4)

From the extracted distribution root:
A multi-host variant lives under examples/endpoints/ibm/nlb/multi-endpoint/ if your design uses separate hostnames. Confirm the annotations match your design (public vs private NLB, optional zone or subnet pinning):
Follow the TLS options in the file header (internalEndpointsAppTlsCert / internalEndpointsAppTlsKey in values.yaml, or a cert-manager secret named internalendpoints-app-tls). Apply, then find the assigned load balancer hostname:

​
IKS ALB (Layer 7)

From the extracted distribution root:
A multi-host variant lives under examples/endpoints/ibm/alb/multi-endpoint/ — use it for OTLP gRPC and Arrow Flight, which are exposed on their own hosts with backend-protocol: GRPCS. The examples use ingress class public-iks-k8s-nginx and terminate TLS at the ALB, re-encrypting to the pod. Replace the {{CUSTOMER_DOMAIN}} and {{TLS_SECRET_NAME}} placeholders — reuse the cluster’s managed IKS Ingress subdomain Secret (copied into the arize namespace) or provide your own TLS Secret covering the hostnames. Apply, then inspect the created Ingress:

​
DNS

Point DNS at the assigned load balancer (NLB hostname) or the IKS ALB, and verify resolution:
For non-cloud-specific controllers (NGINX, Istio, Kong), use Ingress — NGINX, Istio, Kong, and others.

​
Browser check

Open https://arize-app.<my-organization-domain>. TLS is served by the Arize pods (NLB) or by the ALB Secret (ALB); a private CA or freshly issued certificate can take time to trust in the browser. If you see a temporary TLS error, confirm your certificate material (internalEndpointsAppTlsCert / internalEndpointsAppTlsKey, the cert-manager secret, or the ALB TLS Secret), then retry. Continue with Validate deployment.

​
Configure app URLs in values.yaml

Set the URLs your deployment advertises (appBaseUrl, expBaseUrl):
Re-apply Helm values if you change them after the initial install.

​
Set ingressMode

Set ingressMode: "tls" in values.yaml for both patterns — the Arize pods serve TLS, which the NLB passes through and the ALB re-encrypts to. See the Ingress Controllers table in Configuring ingress endpoints for gRPC and OTLP considerations.