Operational endpoints
This reference identifies the ports rendered by the Koldan chart and the access direction operators must allow. Values in the installed release and external dependency configuration take precedence over the defaults shown here.
Client and operator access
| Endpoint | Chart default | Traffic direction | Exposure and TLS |
|---|---|---|---|
| Koldan HTTP API | TCP 8193 on web.service.port |
Clients and browsers to Koldan | Expose only through the approved HTTPS Ingress, OpenShift Route, or load balancer. The public port is normally 443, even when the Service port remains 8193. |
| Koldan gRPC API | TCP 8195 on grpc.service.port |
gRPC clients to Koldan | Expose through an HTTP/2-capable OpenShift Route or load balancer. Preserve gRPC/HTTP2 and configure TLS according to TLS and custom CAs. |
| Documentation site | TCP 80 on docs.service.port; pod port 8000 |
Operators to the optional documentation deployment | Expose only if docs.replicaCount is greater than zero and an approved Ingress is configured. This endpoint is not required to operate the Koldan APIs. |
The chart's HTTP Ingress settings can derive the advertised HTTP address, port, and TLS flag. If another gateway or load balancer owns the public endpoint, set the matching koldan.api-http.advertisement.* and koldan.api-grpc.advertisement.* application properties so clients receive reachable addresses.
Health and metrics
Health and metrics are served on each workload's management port. These ports are pod endpoints in the current chart; they are not exposed by the public HTTP or gRPC Services.
| Workload | Management port | Paths | Access |
|---|---|---|---|
| HTTP API | TCP 5193 |
/actuator/health/liveness, /actuator/health/readiness, /actuator/prometheus |
Kubelet and cluster monitoring only. |
| gRPC API | TCP 5195 |
/actuator/health/liveness, /actuator/health/readiness, /actuator/prometheus |
Kubelet and cluster monitoring only. |
| Compute worker pool | TCP 5196 by default |
/actuator/health/liveness, /actuator/health/readiness, /actuator/prometheus |
Kubelet and cluster monitoring only. Configurable at workerPools.compute.managementPort. |
| Inference worker pool | TCP 5197 by default |
/actuator/health/liveness, /actuator/health/readiness, /actuator/prometheus |
Kubelet and cluster monitoring only. Configurable at workerPools.inference.managementPort. |
| Orchestration worker pool | TCP 5198 by default |
/actuator/health/liveness, /actuator/health/readiness, /actuator/prometheus |
Kubelet and cluster monitoring only. Configurable at workerPools.orchestration.managementPort. |
| Engine instance | TCP 5200 |
/actuator/health/liveness, /actuator/health/readiness, /actuator/prometheus |
Kubelet and cluster monitoring only. |
Do not create a public Ingress, Route, or load-balancer listener for a management port. Restrict monitoring access with namespace and network policy controls. See Health and monitoring.
Cluster-private Koldan endpoints
| Endpoint | Chart default | Traffic direction | Exposure |
|---|---|---|---|
| Engine gRPC | TCP 8200 per engine instance |
Koldan API and worker workloads to engine Services | Cluster-private. The per-instance Service port can be set in engineSlibe.instances[].service.port or engineK2.instances[].service.port. |
Dependency egress
Koldan workloads initiate connections to these dependencies. Keep bundled services cluster-private; place external services on approved private networks or allowlisted provider endpoints.
| Dependency | Common/default port | Traffic direction | Operator checks |
|---|---|---|---|
| PostgreSQL | TCP 5432 |
Koldan, Keycloak, and Temporal to PostgreSQL as configured | Resolve the configured host, validate TLS and credentials, and budget connections before scaling. See PostgreSQL. |
| Temporal frontend | TCP 7233 |
Koldan workers and APIs to Temporal | Validate the configured endpoint, namespace, authentication, and TLS. See Temporal. |
| S3-compatible object storage | TCP 9000 for bundled MinIO; normally TCP 443 for managed S3 |
Koldan workloads to object storage | Validate endpoint, region, addressing mode, credentials, CA trust, and bucket access. See S3 object storage. |
| OIDC provider | Normally TCP 443; depends on provider Service when bundled |
Browsers and Koldan workloads to the identity provider | Browser-visible issuer URLs must resolve from user networks; discovery, token, user-info, and key endpoints must also be reachable from Koldan. See Identity providers. |
| Elasticsearch | TCP 9200 when legacyDependencies.elasticsearchEnabled is true |
Enabled Koldan workloads to Elasticsearch | Keep private and validate the configured protocol, host, port, and readiness behavior. |
| ZooKeeper | TCP 2181 when legacyDependencies.zookeeperEnabled is true |
Koldan workloads to ZooKeeper | Keep private and validate the configured connection string. |
| LLM or inference provider | Provider-specific; commonly TCP 443 |
Enabled Koldan workloads to provider endpoints | Allow DNS and egress only to approved endpoints; validate credentials, TLS, timeout, and provider capacity. See LLM providers. |
| Webhook destination | Normally TCP 443 |
Koldan workers to operator-approved destinations | Allow only approved destinations. Keep certificate verification and private-address blocking enabled unless the deployment has a reviewed requirement. |
Firewall validation
Build firewall rules from the installed values, not this defaults table. For every connection, verify:
- DNS resolves to the intended address from the source network or pod.
- TCP reaches the configured port.
- The certificate chain is trusted and the certificate matches the configured hostname.
- Authentication succeeds with the runtime identity or Secret.
- The application-level health or API check succeeds.
For a full ingress/egress checklist, see Network, DNS, and ports. For symptom-based diagnosis, see Troubleshooting.