> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ingress on IBM Cloud

> Expose Arize AX on IBM Kubernetes Service with a VPC NLB (Layer 4) or IKS ALB (Layer 7) using the bundled IBM endpoint examples under examples/endpoints/ibm.

## Overview

Use this page when you expose Arize AX on IBM Kubernetes Service (IKS). The distribution bundles two IBM Cloud patterns under `examples/endpoints/ibm/`; pick one based on whether you need OTLP gRPC and Arrow Flight. IKS does not auto-expose the UI; both patterns route to service `internalendpoints-app` in namespace `arize`.

| Pattern     | Path       | Layer / TLS                                                      | Use when                                                                                                                                        |
| ----------- | ---------- | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| **VPC NLB** | `ibm/nlb/` | Layer 4 (TCP passthrough); TLS on the Arize pods                 | You need OTLP gRPC and Arrow Flight, and want one hostname to carry everything.                                                                 |
| **IKS ALB** | `ibm/alb/` | Layer 7 (managed NGINX); TLS at the ALB, re-encrypted to the pod | You want managed edge TLS for HTTP. gRPC (OTLP, Flight) requires the multi-endpoint variant, which puts those roles on their own `GRPCS` hosts. |

Each pattern ships a **single-endpoint** variant (all services on one hostname) and a **multi-endpoint** variant (separate hostnames per role).

## VPC NLB (Layer 4)

From the extracted distribution root:

```bash theme={null}
cp ./examples/endpoints/ibm/nlb/single-endpoint/app-services.yaml my-app-services.yaml
```

A multi-host variant lives under `examples/endpoints/ibm/nlb/multi-endpoint/` if your design uses separate hostnames.

Confirm the annotations match your design (public vs private NLB, optional zone or subnet pinning):

```yaml theme={null}
annotations:
  service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: "nlb"
  service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type: "public"
```

Follow the TLS options in the file header (`internalEndpointsAppTlsCert` / `internalEndpointsAppTlsKey` in `values.yaml`, or a cert-manager secret named `internalendpoints-app-tls`).

Apply, then find the assigned load balancer hostname:

```bash theme={null}
kubectl -n arize apply -f my-app-services.yaml
kubectl -n arize get svc arize-app-services -o jsonpath='{.status.loadBalancer.ingress[0].hostname}{"\n"}'
```

## IKS ALB (Layer 7)

From the extracted distribution root:

```bash theme={null}
cp ./examples/endpoints/ibm/alb/single-endpoint/app-services.yaml my-app-services.yaml
```

A multi-host variant lives under `examples/endpoints/ibm/alb/multi-endpoint/` — use it for OTLP gRPC and Arrow Flight, which are exposed on their own hosts with `backend-protocol: GRPCS`.

The examples use ingress class `public-iks-k8s-nginx` and terminate TLS at the ALB, re-encrypting to the pod. Replace the `{{CUSTOMER_DOMAIN}}` and `{{TLS_SECRET_NAME}}` placeholders — reuse the cluster's managed IKS Ingress subdomain Secret (copied into the `arize` namespace) or provide your own TLS Secret covering the hostnames.

Apply, then inspect the created Ingress:

```bash theme={null}
kubectl -n arize apply -f my-app-services.yaml
kubectl -n arize get ingress
```

## DNS

Point DNS at the assigned load balancer (NLB hostname) or the IKS ALB, and verify resolution:

```bash theme={null}
nslookup arize-app.<my-organization-domain>
```

For non-cloud-specific controllers (NGINX, Istio, Kong), use [Ingress — NGINX, Istio, Kong, and others](/docs/ax/selfhosting/installation/ingress/other-controllers).

## Browser check

Open `https://arize-app.<my-organization-domain>`. TLS is served by the Arize pods (NLB) or by the ALB Secret (ALB); a private CA or freshly issued certificate can take time to trust in the browser. If you see a temporary TLS error, confirm your certificate material (`internalEndpointsAppTlsCert` / `internalEndpointsAppTlsKey`, the cert-manager secret, or the ALB TLS Secret), then retry. Continue with [Validate deployment](/docs/ax/selfhosting/installation/validate-deployment).

## Configure app URLs in values.yaml

Set the URLs your deployment advertises (`appBaseUrl`, `expBaseUrl`):

```yaml theme={null}
appBaseUrl: "https://arize-app.<my-organization-domain>"
expBaseUrl: "arize-app.<my-organization-domain>"
```

Re-apply Helm values if you change them after the initial install.

## Set ingressMode

Set `ingressMode: "tls"` in `values.yaml` for both patterns — the Arize pods serve TLS, which the NLB passes through and the ALB re-encrypts to. See the **Ingress Controllers** table in [Configuring ingress endpoints](/docs/ax/selfhosting/installation/ingress/configuring-endpoints) for gRPC and OTLP considerations.