Infrastructure ingress

The infrastructure ingress chart owns one thing on the shared AMS hostname: the browser path / (the landing page). Module charts own their own path-scoped Ingress objects.

Chart repository: ams-helm-infrastructure-ingress

Why it matters

Without this chart, users hitting https://ams.example.com/ have no agreed landing Service. With it, you explicitly choose which module answers /.

Choose root.module

Situation	Set root.module to
All four modules installed	command-center (primary)
Only Command Center	command-center
Only EOBS	eobs
Only FortifyOps	fortifyops
Only ARE	are

Example release snippet:

global:
  environment: release
  amsDomain: ams.example.com
  tlsSecretName: wildcard-tls
  ingress:
    cloud: azure
    host: ams.example.com
    tls:
      enabled: true
      secretName: wildcard-tls

root:
  enabled: true
  module: command-center

Replace hostnames and secret names with yours.

Landing catalog (summary)

root.module	Backend Service (typical)	Notes
command-center	ams-frontend	Native /
eobs	EOBS UI Service	Rewrite toward /eobs
fortifyops	FortifyOps UI Service	Rewrite toward /fortify-ops
are	ARE UI Service	Rewrite toward ARE UI path

Exact Service names and ports are defined in the chart’s modules catalog (values.yaml). Keep release overlays aligned with that catalog.

Deploy order

1. Deploy the primary module so its Service exists.
2. Ensure the TLS Secret exists in the ingress namespace.
3. Install or upgrade infrastructure ingress:

helm upgrade --install ams-ingress ./ams-helm-infrastructure-ingress \
  --namespace ams \
  --create-namespace \
  -f providers/azure/release/values.yaml

1. Browse to https://<amsDomain>/ and confirm the expected UI.

Switching the landing module later

Change root.module, re-apply the chart, and wait for Ingress to reconcile. You do not need to reinstall other modules solely to change who owns /.

Common pitfalls

• Applying ingress before the target Service exists → gateway 502/404 until the Service appears.
• Mismatched TLS secret name between gateway and chart values.
• DNS still pointing at an old IP.
• Installing a second “root” Ingress from another chart that also claims /.