Verify the Installation⚓︎

After helm install reports success, confirm that the release is healthy, that the Agent has registered with xControl, and that the IPX-facing endpoints are listening where the partners expect them. The commands use the xrouter namespace and release name.

Workloads⚓︎

Every pod labelled as part of xRouter must be Running:

kubectl -n xrouter get pods -l app.kubernetes.io/part-of=xRouter
kubectl -n xrouter get pods -l app.kubernetes.io/part-of=xRouter \
    --field-selector=status.phase!=Running,status.phase!=Succeeded

The second command should print nothing. Pods are labelled with their function in app.kubernetes.io/component; the set for a default install is:

MariaDB Galera and Redis run as StatefulSets alongside them.

kubectl -n xrouter get pods -l app.kubernetes.io/component=hss
kubectl -n xrouter logs -l app.kubernetes.io/component=hss --tail=100

Endpoints⚓︎

List the Services and confirm the IPX-facing ports are published the way the partners were told:

kubectl -n xrouter get services

With NodePorts, the node address plus the port is what the partners connect to. With MetalLB, the EXTERNAL-IP of the LoadBalancer Services is the advertised address; check that the routes reach the peer:

kubectl -n metallb-system get bgppeers,ipaddresspools,bgpadvertisements
kubectl -n metallb-system logs -l component=frr-k8s --tail=50

For Multus attachments, the dataplane and HSS pods hold the fixed addresses:

kubectl -n xrouter exec statefulset/xrouter-upf-dataplane -- ip -br addr

Registration in xControl⚓︎

Open Sites in xControl. The Site whose identifier you gave the chart shows Connected, with the Agent version and its address on the detail page. If it stays Disconnected, read the Agent log and check the identifiers, the token and that the pod resolves and reaches the xControl hostname on port 443:

kubectl -n xrouter logs xrouter-agent-0 -c agent --tail=100

Diameter and MAP peers⚓︎

Once a partner's Diameter Routing Agent or STP is configured, the HSS log records the capability exchange and the M3UA association coming up; a peer that never appears there has a transport, address or firewall problem on the interconnect. The Operations CLI on the Agent pod gives a live view of the HSS and the sessions it serves:

kubectl -n xrouter exec -it xrouter-agent-0 -c cli -- cli

At the prompt, cd lte and ls list the HSS commands; read hss <IMSI> shows a subscriber as the HSS holds it. The CLI Guide covers the grammar.

End to end⚓︎

With a subscriber provisioned in xControl on a System of this Site and its public xCore installed, an attach from the public network must authenticate through this HSS and its traffic must arrive at the enterprise. The installation and upgrade verification set covers that path under "Enterprise access through the public radio network".