> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up networking and cluster policies for SeekrFlow

> Set up the ingress, TLS certificate, DNS record, network policies, and admission policies SeekrFlow needs.

An ingress resource maps external HTTPS traffic to SeekrFlow's services through path-based rules. An ingress controller runs inside your cluster, watches for ingress resources, and creates and configures the load balancer for them.

## Choose an approach

* **Chart-managed ingress** – SeekrFlow creates the ingress resource for you, and your ingress controller creates the load balancer from it. This is the quickest way to get running.
* **Externally managed ingress** – You create the ingress resource yourself, with the routes listed in [Create your own ingress resource](#create-your-own-ingress-resource). Recommended for production, because you keep control of Transport Layer Security (TLS), annotations, and lifecycle.

## Install an ingress controller

Both approaches need an ingress controller. The chart doesn't install one.

<Tabs>
  <Tab title="Amazon Web Services (AWS)">
    Install the AWS Load Balancer Controller. See [Install AWS Load Balancer Controller with Helm](https://docs.aws.amazon.com/eks/latest/userguide/lbc-helm.html). Use the settings in this table.

    | Setting | What SeekrFlow needs |
    | - | - |
    | AWS Identity and Access Management (IAM) role | A role with the controller's IAM policy from AWS's guide. In AWS GovCloud (US), use the GovCloud version of the policy. Connect the role through Amazon Elastic Kubernetes Service (Amazon EKS) Pod Identity, with namespace `kube-system` and service account `aws-load-balancer-controller`. AWS's guide uses `eksctl` and IAM roles for service accounts instead. Either works. |
    | Helm values | `clusterName`, `region`, and `vpcId`. Without `region` and `vpcId`, the controller can't discover them from the node and fails to start. |
    | Subnet tags | `kubernetes.io/role/elb` on the subnets for an internet-facing load balancer, or `kubernetes.io/role/internal-elb` for an internal one. The controller creates the Application Load Balancer in the tagged subnets. |

    To check that the controller is running, run:

    ```bash theme={null}
    kubectl get deployment -n kube-system aws-load-balancer-controller
    ```

    `READY` shows `2/2` when it's running.
  </Tab>

  <Tab title="On-premises">
    Install an NGINX or Traefik ingress controller.
  </Tab>
</Tabs>

## Get a TLS certificate

TLS terminates at the ingress. Get a TLS certificate for the hostname your users will reach SeekrFlow at.

<Tabs>
  <Tab title="Amazon Web Services (AWS)">
    Request or import a certificate in AWS Certificate Manager (ACM). The Application Load Balancer uses it. ACM issues a requested certificate only after you validate that you own the domain, usually with a DNS record. If the domain is in Amazon Route 53, the ACM console can create the validation record for you. See [Request a public certificate](https://docs.aws.amazon.com/acm/latest/userguide/acm-public-certificates.html).
  </Tab>

  <Tab title="On-premises">
    Get a certificate for the NGINX or Traefik ingress controller.
  </Tab>
</Tabs>

## Create your own ingress resource

Skip this section if you use chart-managed ingress.

Create your own ingress resource with these routes, in this order. Use `pathType: Prefix` for every path. Include a route only for services you enable. For example, include `/v1/explainability` only if you enable Explainability.

On AWS, add the [load balancer annotations](#load-balancer-annotations) to your ingress resource.

| Order | Path | Service | Port |
| - | - | - | - |
| 1 | `/v1/inference` | `seekrflow-serving` | 8001 |
| 2 | `/v1/flow` | `seekrflow-training` | 8080 |
| 3 | `/v2/flow` | `seekrflow-training` | 8080 |
| 4 | `/v1/functions` | `seekrflow-router` | 8000 |
| 5 | `/v1/threads` | `seekrflow-router` | 8000 |
| 6 | `/v1/explainability` | `seekrflow-explainability` | 8080 |
| 7 | `/v1` | `seekrflow-auth` | 8003 |
| 8 | `/` | `seekrflow-frontend` | 3000 |

<Warning>
  On AWS, the Application Load Balancer evaluates rules from top to bottom. A `/v1` rule placed before `/v1/explainability` captures its traffic.
</Warning>

## Create the DNS record

Create a DNS record that points your hostname at the address of your load balancer or ingress controller. The hostname must resolve from your users' machines, from inside the cluster, and from wherever you run `sfe`.

<Tabs>
  <Tab title="Amazon Web Services (AWS)">
    When you create the record depends on your approach:

    * **Chart-managed ingress** – The load balancer doesn't exist until you install SeekrFlow. Come back to this section after the install.
    * **Externally managed ingress** – Create the record once your ingress resource has a load balancer address.

    <Steps>
      <Step title="Get the load balancer address">
        For chart-managed ingress, run:

        ```bash theme={null}
        kubectl get ingress -n seekrflow
        ```

        For your own ingress, run the same command in your ingress resource's namespace. The address is in the `ADDRESS` column.
      </Step>

      <Step title="Create the record">
        Point your hostname, the `global.ingress.host` value in your values file, at that address. On Amazon Route 53, use an alias record. On other DNS providers, use a CNAME record.
      </Step>
    </Steps>
  </Tab>

  <Tab title="On-premises">
    <Steps>
      <Step title="Get the ingress controller's address">
        Find the external IP address or hostname of your NGINX or Traefik controller's service.
      </Step>

      <Step title="Create the record">
        Point your hostname, the `global.ingress.host` value in your values file, at that address. Use an A record for an IP address, or a CNAME record for a hostname.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Plan network policies

SeekrFlow does not ship network policies, and it runs without any. If you apply a default-deny policy, put these allowances in place before you install, or the install fails:

* The ingress controller to each SeekrFlow service port.
* SeekrFlow pods to each other within the `seekrflow` namespace.
* SeekrFlow pods to PostgreSQL, OpenSearch, and object storage.
* These components to the Kubernetes API server: the operator, Training, Serving, Router, Explainability, License, Ingestion, AI-Ready Data, the LoRA controller, the Argo Workflows controller and its workflow pods, the JobSet controller when enabled, and the `sfe` preflight and database setup jobs.
* External Secrets Operator to your secret store, from its own namespace.
* Pods in `seekrflow` to the Argo server in `argo-workflows`, on port 2746. Argo Workflows runs in `argo-workflows`, and its job pods run in `seekrflow`.
* The outbound connections your deployment uses. See [Security considerations](/self-managed/flow/security).

## Plan admission policies

If your cluster runs a policy engine, such as Kyverno or Open Policy Agent (OPA) Gatekeeper, make sure its policies admit SeekrFlow's pods before you install:

* If your policies restrict user IDs, permit `65532` for the operator and `1001` for the workloads it creates.
* The Argo server and the model catalog sync job don't use SeekrFlow's security context. Exempt them from policies that require it.

## Record the values

Note these values. You will enter them when you create the values file.

<Tabs>
  <Tab title="Amazon Web Services (AWS)">
    | Value | Used for | Example or format |
    | - | - | - |
    | Hostname | `global.ingress.host` | `seekrflow.example.com` |
    | Ingress class | `global.ingress.className` | `"alb"` |
    | Chart-managed or externally managed ingress | `global.ingress.enabled` | `true` for chart-managed ingress. |
    | Load balancer annotations | `global.ingress.annotations` | SeekrFlow requires `target-type: ip` and HTTPS on port 443, and recommends a 300-second idle timeout. See [Load balancer annotations](/self-managed/flow/provision/networking#load-balancer-annotations). |

    ### Load balancer annotations

    ```yaml theme={null}
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS": 443}]'
    alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=300
    ```

    SeekrFlow requires the first two, because its services aren't exposed on node ports and the load balancer must serve HTTPS. The idle timeout supports long-running requests. The controller creates an internal load balancer by default. If your users reach SeekrFlow from the internet, also add `alb.ingress.kubernetes.io/scheme: internet-facing`.
  </Tab>

  <Tab title="On-premises">
    | Value | Used for | Example or format |
    | - | - | - |
    | Hostname | `global.ingress.host` | `seekrflow.example.com` |
    | Ingress class | `global.ingress.className` | `"nginx"` or `"traefik"` |
    | Chart-managed or externally managed ingress | `global.ingress.enabled` | `true` for chart-managed ingress. |
  </Tab>
</Tabs>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.