Skip to content

Configure Ingress and Enable HTTPS

Before you start

Goal

Configure the ingress address and enable HTTPS for Altair SLC Hub.

Prerequisites

If you skip certificate generation or do these steps out of order, bootstrap will fail.

Why HTTPS is required

Altair SLC Hub requires HTTPS for external communication. When users log in, Keycloak generates redirect URLs that must match the scheme the browser sees. If Altair SLC Hub is accessed over http:// but Keycloak generates https:// redirect URLs, the authentication flow will fail and users will not be able to log in.

Enabling HTTPS ensures:

  • Redirect URLs are consistent with what the browser sees
  • All communication between browsers and Altair SLC Hub is encrypted
  • TLS certificates authenticate the server to users' browsers

Understand ingress addresses

Before configuring the ingress settings, it's important to understand the network you are installing to and the ingress addresses used. This is explained in the planning section Ingress.

The Altair SLC Hub ingress and internal ingress addresses may need to be defined in the Altair SLC Hub configuration.

The ingress address is used, for example, when creating emails that might contain links to portal pages and when constructing redirect responses during the authentication process. This ingress address therefore needs to be the address by which the Altair SLC Hub can be accessed from browsers.

The internal ingress address name may be different from the address used in browsers. This is likely where the Altair SLC Hub is installed on a private network, such as in cloud providers. Here machines may communicate with each other using internal addresses, but browsers will use a different external address.

The installation processes initialized the hostname to the fully qualified hostname of the host, but as indicated, this may not always be accurate.

Check the current hostname

The installation process initialized the hostname to the fully qualified hostname of the host. To verify the current setting, run:

hubctl config print ingress.hostname

The default port for accessing the Altair SLC Hub portal and REST API is 9090. This can be changed if required. To change the port, edit the ingress_custom.yaml file and add the required port setting for the ingress.port configuration property. For example, the contents of that file could look like the following:

ingress:
    hostname: machine.domain.local
    port: 9090

Note

The Altair SLC Hub ingress server is run with NET_BIND_PORT capability, so it can bind to ports less than 1024

For more information on the Altair SLC Hub configuration process and how the configuration files are processed see Configuration.

Check the internal hostname

You can also check the internal ingress address:

hubctl config print internalingress.hostname
If this hostname is not correct for your environment, you will update it in the later section.

Create and configure the ingress file

The Altair SLC Hub ingress configuration is stored in a YAML file. You will create a custom copy of the default configuration file and edit it.

Copy the default ingress configuration

The default settings for the ingress host are in the [etc directory]/config.d/ingress.yaml file. If the hostname needs to be changed, create a new file in the same directory with a lexicographically greater name such as [etc directory]/config.d/ingress_custom.yaml and add the ingress.hostname value in that file.

The default ingress.yaml file contains the standard configuration. By creating a copy named ingress_custom.yaml, your custom settings will override the defaults. You'll edit this copy, leaving the original unchanged.

Create a copy of the default ingress.yaml configuration file and name it to ingress_custom.yaml. Set the correct permissions so you can edit it.

cp [etc directory]/config.d/ingress.yaml [etc directory]/config.d/ingress_custom.yaml
sudo chown slchub:slchub [etc directory]/config.d/ingress_custom.yaml
sudo chmod 0660 [etc directory]/config.d/ingress_custom.yaml

Create a copy of the default ingress.yaml configuration file and name it to ingress_custom.yaml.

Copy-Item "[etc directory]\config.d\ingress.yaml" "[etc directory]\config.d\ingress_custom.yaml"

About custom configuration files

Altair SLC Hub reads configuration files from [etc directory]/config.d/ in alphabetical order. By creating a file named ingress_custom.yaml (which comes after ingress.yaml alphabetically), your custom settings will override the default settings. This allows you to keep the default file unchanged for reference.

Edit the ingress configuration file

Open ingress_custom.yaml in your preferred editor, for example:

vi [etc directory]/config.d/ingress_custom.yaml

Open ingress_custom.yaml in your preferred editor, for example:

notepad "[etc directory]\config.d\ingress_custom.yaml"

Configure the ingress settings

Edit the ingress_custom.yaml file to configure how users access Altair SLC Hub and enable HTTPS for Keycloak authentication.

Change 1: Update the URL (remove port)

Find this line: 

url: ${ingress.scheme}://${ingress.hostname}:${ingress.port}

Change it to: 

url: ${ingress.scheme}://${ingress.hostname}

When using port 443 (the standard HTTPS port), the port should not appear in the URL. Browsers automatically use port 443 for HTTPS.

Change 2: Update the port to 443

Find this line: 

port: 9090

Change it to: 

port: 443

Change 3: Enable TLS

Find this line: 

tls:
  enabled: false

Change it to: 

tls:
  enabled: true

Keycloak requires HTTPS. Setting enabled: true activates HTTPS for the ingress gateway.

Change 4: Add the certificate file path

Find this line: 

certFile:

Change it to:

certFile: /opt/altair/slchub/var/ca/public/external/external.cert.pem

certFile: C:/ProgramData/altair/SLC Hub/ca/public/external/external.cert.pem

This is the path to the TLS certificate file generated in the previous step. Keycloak needs this file to enable HTTPS.

Change 5: Add the key file path

Find this line: 

keyFile:

Change it to:

keyFile: /opt/altair/slchub/var/ca/public/external/external.key.pem

keyFile: C:/ProgramData/altair/SLC Hub/ca/public/external/external.key.pem

This is the path to the TLS private key file generated in the previous step. The ingress gateway needs this file to decrypt HTTPS traffic.

Verify certificate paths

Before saving the configuration, verify that the certificate and key files exist at the paths you specified.

ls -l /opt/altair/slchub/var/ca/public/external/

You should see: 

external.cert.pem
external.key.pem

  1. Navigate to C:\ProgramData\altair\SLC Hub\ca\public\external\
  2. Verify you see:
external.cert.pem
external.key.pem

Certificate paths

If the certificates don't exist, you must run Generate external certificates first. Do not proceed with bootstrap until the certificates exist.

Save the file

Save the file and close the editor.

Verification

After saving the configuration, verify that all changes were applied correctly. Run the following command:

hubctl config print ingress

You should see output similar to:

bindAddress: '[::]'
forwardedProto: https
hostname: <machine.domain.local>
ipv4Compat: true
port: 443
scheme: https
tls:
certFile: /opt/altair/slchub/var/ca/public/external/external.cert.pem
enabled: true
keyFile: /opt/altair/slchub/var/ca/public/external/external.key.pem
options: {}
url: https://<machine.domain.local>

bindAddress: '[::]'
forwardedProto: https
hostname: <machine.domain.local>
ipv4Compat: true
port: 443
scheme: https
tls:
certFile: C:/ProgramData/altair/SLC Hub/ca/public/external/external.cert.pem
enabled: true
keyFile: C:/ProgramData/altair/SLC Hub/ca/public/external/external.key.pem
options: {}
url: https://<machine.domain.local>

Verify ingress

The ingress should match the external address of the host.