# Ctrl vs client endpoints **URL:** \ **Category:** Ziti Overlay\ **Created:** [January 4, 2025, 3:35am UTC](https://openziti.discourse.group/t/ctrl-vs-client-endpoints/3718 "2025-01-04T03:35:32Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![yemaney](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/yemaney/32/2201_2.png) [@yemaney](https://openziti.discourse.group/u/yemaney)\ **Post date:** [January 4, 2025, 3:35am UTC](https://openziti.discourse.group/t/ctrl-vs-client-endpoints/3718/1 "2025-01-04T03:35:32Z")
## Context source: [Edge APIs | NetFoundry Documentation](https://openziti.io/docs/reference/developer/api/#edge-management-api) ### Edge Management API - edge management API provides the ability to create new identities, identities, policies, and other entities used to manage a network ### Edge Client API - edge client API is used by clients that wish to dial (connect) or bind (host) services source 2: [Install the Controller in Kubernetes | NetFoundry Documentation](https://openziti.io/docs/guides/deployments/kubernetes/kubernetes-controller#using-clusterip-services-with-an-ingress-controller) ### Controller values.yaml ```auto clientApi: advertisedHost: ziti-controller-managed.example.com ctrlPlane: advertisedHost: ziti-controller-managed-ctrl.example.com ``` ### Router Config ```yaml ctrl: # router control plane API (:6262) endpoint: tls:zitictrl.mydomain.com:443 link: listeners: - binding: transport bind: tls:0.0.0.0:10080 advertise: tls:link.mydomain.com:443 listeners: - binding: edge address: tls:0.0.0.0:3022 options: advertise: edge.mydomain.com:443 ``` ### K8s Ingress ```sh $ kubectl -n ziti get ingress NAME CLASS HOSTS ADDRESS PORTS AGE ziti-controller-client nginx ziticlient.mydomain.com 20.255.214.10 80 53d ziti-controller-ctrl nginx zitictrl.mydomain.com 20.255.214.10 80 53d ziti-router-edge nginx edge.mydomain.com 20.255.214.10 80 53d ziti-router-transport nginx link.mydomain.com 20.255.214.10 80 53d ``` ## Questions - would it be fair to say ziti cli uses edgemanagement endpoint to create resources. and edge routers/tunnels use the edge client endpoint to dial/bind services? - routerconfig references ctrl, client, and transport/link urls. how does router know about edge client api needed for binding services? - does it ever make sense for ctrl and client apis to share the same hostname? or would that not work ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [January 6, 2025, 1:09pm UTC](https://openziti.discourse.group/t/ctrl-vs-client-endpoints/3718/2 "2025-01-06T13:09:09Z")
Hi @yemaney, > [@yemaney](#): > > would it be fair to say ziti cli uses edgemanagement endpoint to create resources It'd be much more than 'fair', that is exactly how it does it 😉 > [@yemaney](#): > > edge routers/tunnels use the edge client endpoint to dial/bind services? Only kinda. You mention edge routers. Edge routers will operate over the control plane and will not use the client nor the management API directly afaik. I'm pretty sure this is true but if not, I'll correct myself. OTHER tunnelers are all SDK-based clients of their own. They are purpose-built software that use our SDKs to 'do something' (be a tunneler). These will **ALL** use the client endpoint - yes. > [@yemaney](#): > > how does router know about edge client api needed for binding services? It doesn't (answered above). It uses the control plane (the `ctrl` endpoint specified in the config) to communicate with the controller > [@yemaney](#): > > does it ever make sense for ctrl and client apis to share the same hostname Sharing a hostname is quite common. I don't know what you mean by "client apis" though, so I'm not entirely sure I know what you mean. using the same host has the "benefit" of allowing you to reuse the same certificate if you _want_ and is generally useful for single-machine deployments. In general though, I tend to use different hostnames. This would allow you to always use the same port (port 443 for example). ---
**Author:** ![yemaney](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/yemaney/32/2201_2.png) [@yemaney](https://openziti.discourse.group/u/yemaney)\ **Post date:** [January 6, 2025, 4:38pm UTC](https://openziti.discourse.group/t/ctrl-vs-client-endpoints/3718/3 "2025-01-06T16:38:13Z")
> Edge routers will operate over the control plane Okay this is why the router config will reference the controlplan endpoint via `ctrl.endpoint` > I don't know what you mean by "client apis" though Sorry for the lack of clarity. The controller is deployed with `clientApi.advertisedHost` and a `ctrlPlane.advertisedHost` .in its config and I was wondering if they could be the same url. But I think you answered the question, its possible but different ports would have to be used which would make sense.. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [January 6, 2025, 4:41pm UTC](https://openziti.discourse.group/t/ctrl-vs-client-endpoints/3718/4 "2025-01-06T16:41:44Z")
> [@yemaney](#): > > and I was wondering if they could be the same url Oh - I see now. Yes, generally they **ARE** the same url and I'd recommend you keeping them the same in this case. You have the option to not have them be the same if you don't want them to be but it's much more complicated/complex to deploy that way and I definitely would not change the domain name until you are very well-versed with OpenZiti (or maybe just never 🙂 ).