Ingress on AWS (Elastic load balancer)

Expose the Arize AX UI with AWS NLB or ALB using the bundled examples under examples/endpoints/aws.

Overview

Use this page when exposing Arize AX from EKS through the AWS load-balancing pattern your platform team supports. The exact controller and annotations vary by environment, so treat this page as the AWS-specific planning companion to Configuring ingress and endpoints. If you provisioned AWS load-balancer-controller roles or networking with Terraform, keep those outputs aligned with the ingress manifests you apply.

AWS installs use one of two bundled patterns under examples/endpoints/aws/:

Pattern	Path	Notes
NLB	aws/nlb/	Layer 4 Network Load Balancer using Service LoadBalancer; TCP to pods; TLS often terminated on pods.
ALB	aws/alb/	Layer 7 Application Load Balancer using Ingress; TLS often terminated at ALB and re-encrypted to the pod.

Each pattern ships a single-endpoint variant (all services on one hostname) and a multi-endpoint variant (separate hostnames per role).

Endpoint planning

Before applying ingress manifests, decide:

• The hostname users will use for the Arize AX UI.
• Whether the cluster uses one endpoint or multiple endpoint hostnames.
• Where TLS terminates.
• Which ingress controller or AWS load balancer integration your platform supports.

Example manifests

Review the endpoint examples included in the extracted distribution under examples/endpoints/aws/. Use the example that matches your ingress controller, then replace placeholder hosts, TLS references, and service names as needed for your AWS environment.

For NGINX, Istio, Kong, and other non-cloud-specific controllers, use Ingress - NGINX, Istio, Kong, and others.

NLB (Layer 4)

From the extracted distribution root:

cp ./examples/endpoints/aws/nlb/single-endpoint/app-services.yaml my-app-services.yaml

A multi-host variant lives under examples/endpoints/aws/nlb/multi-endpoint/ if your design uses separate hostnames.

Confirm annotations match your design (internal vs public load balancer):

annotations:
  service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"  # Use "internet-facing" for public

Follow the TLS options in the file header:

• internalEndpointsAppTlsCert / internalEndpointsAppTlsKey in values.yaml, or cert-manager secret internalendpoints-app-tls (required for both single-endpoint and multi-endpoint)
• otlpTlsCert / otlpTlsKey in values.yaml (required for multi-endpoint)
• flightTlsCert / flightTlsKey in values.yaml (required for multi-endpoint)

ALB (Layer 7)

cp ./examples/endpoints/aws/alb/single-endpoint/app-services.yaml my-app-services.yaml

A multi-host variant lives under examples/endpoints/aws/alb/multi-endpoint/ if your design uses separate hostnames.

Confirm annotations match your design (internal vs public load balancer):

annotations:
  alb.ingress.kubernetes.io/scheme: "internal" # Use "internet-facing" for public endpoint
  alb.ingress.kubernetes.io/certificate-arn: "<certificate-arn>"

Replace placeholder hostnames and certificate ARNs before apply.

DNS, apply and verify

Apply (example for NLB copy named my-app-services.yaml):

kubectl -n arize apply -f my-app-services.yaml
kubectl -n arize describe svc

Apply (example for ALB copy named my-app-services.yaml):

kubectl -n arize apply -f my-app-services.yaml
kubectl -n arize describe ingress

Replace placeholder hostnames with your organization’s domain and ensure DNS points at the load balancer hostname (NLB or ALB) and verify resolution:

nslookup arize-app.<my-organization-domain>

Then open the UI hostname and continue with Validate deployment.

Browser check

Open https://arize-app.<my-organization-domain>. Pod-terminated or private CA certificates can take time to trust in the browser; if you see a temporary TLS error, confirm internalEndpointsAppTlsCert / internalEndpointsAppTlsKey or your cert-manager secret, then retry.

Configure app URLs in values.yaml

Set the URLs your deployment advertises (appBaseUrl, expBaseUrl):

appBaseUrl: "https://arize-app.<my-organization-domain>"
expBaseUrl: "arize-app.<my-organization-domain>"

Re-apply Helm values if you change them after the initial install.

Set ingressMode

Set ingressMode in values.yaml to match your pattern. The default tls mode is typical for both NLB and ALB. See the Ingress Controllers table in Configuring ingress endpoints for gRPC and OTLP considerations.