Maximo

 View Only

 Additional route to Manage UI

Dirk Huppertz's profile image
Dirk Huppertz posted 09/09/26 02:07 AM

I have setup a MAS installation in AWS. The Nodes and the Network Loadbalancer are placed in a private subnet.
In front of the NLB I placed a Application Loadbalancer for TLS termination and Web Application Firewall.

The UI should be exposed to the internet. MEA not.
I setup a new ALB in public subnet, pointing to the existing NLB in the private subnet and I defined a new route to the UI pods in openshift for the public DNS name.

Now the UI is reachable, but the menu is missing. I think it is provided by the foundation pod, isn't it?

I could expose the foundation service too, but which DNS name should I use?

Or what else do I have to do to make this scenario work?

khalil guelmami's profile image
khalil guelmami posted 10/26/26 06:35 AM

Hi Dirk,

As far as I know, the menu doesn't come from the Manage pods. It comes from MAS core.

The navigation, the login and the API calls are served by the core routes, each on its own hostname under your MAS domain. When the browser loads Manage from your new public name, it still calls those core hostnames. They only resolve to the NLB in your private subnet, so from the internet they fail, and you get the Manage page without its frame.

So one extra route won't be enough. Here's what I'd try:

  1. Publish the MAS domain itself through the public ALB, same hostnames, with split DNS. In Route 53, the public hosted zone points to the ALB and the private one keeps pointing to the NLB. MAS keeps generating the URLs it already knows, so redirects and the menu work.
  2. Keep MEA closed with an ALB or WAF rule on the MEA host or path. That's cleaner than keeping it private by simply not publishing it.
  3. Not sure which hostnames you need? Run oc get routes -n mas-<instance>-core, then the same on mas-<instance>-manage.

One last thing. There's a recent thread here on MAS 9.2 and path-based routing instead of subdomains. If 9.2 is on your roadmap, it'd make the ALB part much simpler. Worth a look.

Khalil

Related Content