Skip to main content

Documentation Index

Fetch the complete documentation index at: https://arize-ax.mintlify.dev/docs/llms.txt

Use this file to discover all available pages before exploring further.

​
Overview

If you are not using a cloud-managed load balancer (see GCP load balancer or Azure load balancer), you can expose Arize AX with NGINX Ingress (NGINX Inc), NGINX Gateway Fabric, ingress-nginx (community), Istio, Kong, Traefik, or another controller that supports TLS, long-lived connections, and gRPC where needed. All examples assume:
  • The Arize AX operator has created the internalendpoints-app Service in the arize namespace (TLS on port 443).
  • You replace placeholder domains and TLS material before kubectl apply.
  • You align appBaseUrl / expBaseUrl (and ingressMode) in values.yaml with your hostname plan—see Configuring ingress endpoints, especially the Ingress Controllers table for ingressMode and optional pod TLS fields.
Example sources live in the extracted distribution under: 
examples/endpoints/
├── nginx/
│   ├── single-endpoint/
│   │   ├── nginx-ingress.yaml                     # NGINX Inc — Ingress API (terminate at ingress)
│   │   ├── nginx-transportserver-passthrough.yaml # NGINX Inc — TLS passthrough (TransportServer)
│   │   ├── nginx-gateway-fabric.yaml              # NGINX Inc — Gateway API
│   │   └── nginx-legacy.yaml                      # Community ingress-nginx (deprecated path)
│   └── multi-endpoint/
│       ├── nginx-ingress.yaml
│       ├── nginx-gateway-fabric.yaml
│       └── nginx-legacy.yaml
├── istio/
│   ├── app-services.yaml               # Gateway + VirtualService + EnvoyFilter
│   └── envoy-filter-http2.yaml         # Same EnvoyFilter recipe, standalone
├── kong/
│   └── app-services.yaml               # Kong Ingress
└── traefik/
    └── app-services.yaml               # Traefik Ingress + IngressRoute
Copy the file you need into a working file, edit placeholders, then apply from the extract root, for example: 
kubectl apply -n arize -f my-nginx-ingress.yaml
Adjust ingressClassName (or Gateway gatewayClassName) to match the class installed in your cluster.
Paths: nginx/single-endpoint/nginx-ingress.yaml and nginx/multi-endpoint/nginx-ingress.yaml
Docs: NGINX Ingress Controller (OSS or NGINX Plus)These manifests use the networking.k8s.io/v1 Ingress API with ingressClassName: nginx. Traffic is forwarded to internalendpoints-app:443. TLS is terminated at the ingress using a kubernetes.io/tls secret in arize (for example arize-app-services-tls in the single-endpoint file).Single host (nginx/single-endpoint/nginx-ingress.yaml):
  • One hostname ({{CUSTOMER_DOMAIN}}) for UI, GraphQL, REST, OTLP, and Arrow Flight through the unified internal endpoint service.
  • ConfigMap nginx-ingress in your NGINX install namespace (default comment uses nginx-ingress) sets http2: "true" so gRPC and HTTP/2 behave correctly—rename the ConfigMap or namespace if your Helm release differs (for example NGINX Plus chart defaults).
  • Key Ingress annotations: nginx.org/ssl-services and nginx.org/grpc-services set to internalendpoints-app, plus long proxy-read-timeout / proxy-send-timeout (7200s) for large exports and streams.
Multiple hosts (nginx/multi-endpoint/nginx-ingress.yaml):
  • Separate Ingress objects per role: arize-app (UI / GraphQL), arize-api (REST), arize-otlp (OTLP), arize-flight (Arrow Flight), each with its own TLS secret and host ({{CUSTOMER_APP_DOMAIN}}, {{CUSTOMER_API_DOMAIN}}, etc.).
  • OTLP and Flight ingresses include nginx.org/grpc-services: "internalendpoints-app"; app/API ingresses rely on nginx.org/ssl-services for HTTPS to the backend.
values.yaml alignment (from file headers):
  • Single-endpoint: appBaseUrl: "https://{{CUSTOMER_DOMAIN}}", expBaseUrl: "{{CUSTOMER_DOMAIN}}".
  • Multi-endpoint: appBaseUrl: "https://{{CUSTOMER_APP_DOMAIN}}", expBaseUrl: "{{CUSTOMER_FLIGHT_DOMAIN}}" (Flight host for export-related settings).
After apply, point DNS at the NGINX Service / LoadBalancer IP and verify with kubectl -n arize describe ingress <name>.

​
After you apply

  1. kubectl -n arize describe ingress <name> (or kubectl describe gateway / routes for Gateway API) until addresses are assigned.
  2. Create DNS A/AAAA (or CNAME) records to that address.
  3. Update values.yaml with appBaseUrl and expBaseUrl, then upgrade the release or operator values as you do for other changes.
  4. Confirm ingressMode and any internalEndpointsAppTlsCert / internalEndpointsAppTlsKey requirements from the Ingress Controllers table.

​
Cross-reference