Expose AntFlow over HTTPS¶

Installation with Helm uses local port-forwarding. For shared access, expose AntFlow through either Ingress or Gateway API HTTPRoutes. The examples below use one hostname, routing / to the UI and /api/ to the server. Choose one exposure method rather than enabling both.

The YAML blocks are deployment templates. Replace antflow.example.com with your chosen hostname and use your controller, Gateway, and TLS Secret names. Unlike shell commands, these blocks do not expand environment variables.

Prerequisites¶

Before applying either example:

• Create a DNS record pointing your AntFlow hostname to the controller's address.
• Provision a TLS certificate covering that hostname. The chart does not issue certificates; use your certificate-management tooling.
• Register https://antflow.example.com/ as an allowed redirect URI in the identity provider, replacing the example domain with yours. For Keycloak, also allow https://antflow.example.com as a web origin. See Authentication.

Ingress¶

Install an Ingress controller and identify its IngressClass. Create the TLS Secret in the antflow namespace, then add these values to your deployment's values file:

global:
  domain: antflow.example.com

server:
  ingress:
    enabled: true
    className: "<ingress-class>"
    tls: true
    tlsSecretName: antflow-tls

ui:
  ingress:
    enabled: true
    className: "<ingress-class>"
    tls: true
    tlsSecretName: antflow-tls

The chart's default paths are /api/ for the server and / for the UI. Keep those paths intact; do not add a rewrite that strips the server's API prefix.

Gateway API HTTPRoutes¶

Install the Gateway API CRDs and a compatible controller. Use an existing Gateway with an HTTPS listener named https, a valid TLS certificate, and permission to accept routes from the antflow namespace.

For a Gateway named shared-gateway in the gateway-system namespace:

global:
  domain: antflow.example.com

server:
  httproute:
    enabled: true
    parentRefs:
      - name: shared-gateway
        namespace: gateway-system
        sectionName: https

ui:
  httproute:
    enabled: true
    parentRefs:
      - name: shared-gateway
        namespace: gateway-system
        sectionName: https

The chart creates the routes, not the Gateway. Configure TLS on the Gateway's HTTPS listener; normally its certificate Secret belongs in the Gateway's namespace. Check the controller's documentation for certificate-reference rules. The Gateway listener's allowedRoutes must permit the AntFlow namespace.

Optional ListenerSet¶

If the controller supports ListenerSet and its CRD is installed, the chart can create a dedicated HTTPS listener attached to an existing Gateway. Use this instead of the explicit route parentRefs above:

global:
  domain: antflow.example.com

listenerset:
  enabled: true
  parentRef:
    name: shared-gateway
    namespace: gateway-system
  tls:
    secretName: antflow-tls

server:
  httproute:
    enabled: true
ui:
  httproute:
    enabled: true

Create antflow-tls in the antflow namespace. The chart creates a ListenerSet with an HTTPS listener named https and attaches both HTTPRoutes to it. The parent Gateway must permit the ListenerSet attachment; follow the controller's configuration requirements. No Gateway or certificate is created by the chart.

Apply and verify¶

After adding the chosen exposure settings to your existing values file:

helm upgrade antflow \
  oci://registry.gitlab.com/csgroup-oss/antflow/antflow/charts/antflow \
  --namespace antflow \
  --values antflow-values.yaml

For Ingress, check the controller-assigned address:

kubectl get ingress --namespace antflow

For Gateway API, check that both routes have Accepted=True and ResolvedRefs=True for their intended parent:

kubectl describe httproute --namespace antflow antflow-server antflow-ui

Open your configured HTTPS UI URL and sign in. With the shared-host paths above, the API base URL is the same origin followed by /api. Follow Access the API to configure that URL and check connectivity and authentication. Verify the certificate is trusted and the browser reports no CORS errors. If the UI and API use different origins, follow Configure cross-origin access.

Browser API endpoint¶

The Helm chart derives SERVER_CONFIG.apiUrl in the browser's config.js from the server exposure settings. When the server is exposed through ingress or HTTPRoute, it uses the server's public base URL. Otherwise it uses http://localhost:8000 for local port-forward access.

The chart does not expose a ui.apiUrl override. The UI also defines SERVER_CONFIG.apiPrefix, but the Helm chart does not expose a corresponding value. An additional configs.apiPrefix value will not appear in the generated configuration.

Browser configuration is public: do not put credentials or secrets in it. Endpoint changes do not require rebuilding the UI image.

For all exposure settings and alternative topologies, see the Helm chart reference.