IDSP Admin Console is unreachable in Azure AKS environment

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

You are installing or maintaining the Symantec Identity Security Platform (IDSP) on an Azure Kubernetes Service (AKS) cluster and find that the Admin Console is unreachable. Although you verify that the services are up and installed, the browser fails to connect to the Admin Console URL.

Environment

Symantec Identity Security Platform - IDSP

Cause

This issue is typically related to the Azure network infrastructure or firewall configurations that restrict external access to the ingress controller or internal services. Strict inter-pod communication rules or misconfigured Load Balancers in the AKS environment can prevent standard HTTPS traffic from reaching the IDSP components.

Resolution

While you work with your Azure infrastructure team to review the network configuration, you can use the kubectl port-forward command as a workaround to establish a direct connection to the admin console.

Follow these steps to set up the connection:

1. Identify the router service Run the following command to find the exact name of your router service in the ssp namespace:

     $ kubectl get svc -n ssp -l app.kubernetes.io/name=ssp-router

    Example Output:

     NAME             TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                     AGE
     ssp-ssp-router   ClusterIP   ####.####       <none>        443/TCP,8095/TCP,8090/TCP   13d

2. Initiate the port-forwarding connection Forward a local port to the service (this example uses the standard HTTPS port):

        $ kubectl port-forward -n ssp services/ssp-ssp-router 8095

    Example Output:

     Forwarding from 127.0.0.1:#### -> 8095
     Forwarding from [::1]:#### -> 8095

3. Configure local host resolution If you are using a Windows system, add the hostname to your local hosts file to ensure the FQDN resolves correctly to your local tunnel:

        127.16.0.1 ####.####.example.com

4. Set up an SSH Tunnel (if applicable) If you are working via a remote server using PuTTY, configure a local tunnel. Ensure you listen on port 443 of your local Windows system so you can access the tunnel using the standard HTTPS default port. Your connection flow looks like this:

        127.16.0.1:443 → SSH-TUNNEL → 127.0.0.1:#### → KUBECTL-PORT-FORWARD → ssp-router:8095

5. Access the Admin Console Open your browser and navigate to the console URL. You should now be able to connect successfully: https://####.####.example.com/default/ui/v1/adminconsole/