Configuration on Kiali

Console Customization

Mon, 01 Jan 0001 00:00:00 +0000

Custom metric aggregations

The inbound and outbound metric pages, in the Metrics settings drop-down, provides an opinionated set of groupings that work both for filtering out metric data that does not match the selection and for aggregating data into series. Each option is backed by a label on the collected Istio telemetry.

It is possible to add custom aggregations, like in the following example:

spec:
 kiali_feature_flags:
 ui_defaults:
 metrics_inbound:
 aggregations:
 - display_name: Istio Network
 label: topology_istio_io_network
 - display_name: Istio Revision
 label: istio_io_rev
 metrics_outbound:
 aggregations:
 - display_name: Istio Revision
 label: istio_io_rev

Notice that custom aggregations for inbound and outbound metrics are defined separately.

Custom Dashboards

Mon, 01 Jan 0001 00:00:00 +0000

Custom Dashboards require some configuration to work properly.

Declaring a custom dashboard

When installing Kiali, you define your own custom dashboards in the Kiali CR spec.custom_dashboards field. Here’s an example of what it looks like:

custom_dashboards:
- name: vertx-custom
 title: Vert.x Metrics
 runtime: Vert.x
 discoverOn: "vertx_http_server_connections"
 items:
 - chart:
 name: "Server response time"
 unit: "seconds"
 spans: 6
 metrics:
 - metricName: "vertx_http_server_responseTime_seconds"
 displayName: "Server response time"
 dataType: "histogram"
 aggregations:
 - label: "path"
 displayName: "Path"
 - label: "method"
 displayName: "Method"
 - chart:
 name: "Server active connections"
 unit: ""
 spans: 6
 metricName: "vertx_http_server_connections"
 dataType: "raw"
 - include: "micrometer-1.1-jvm"
 externalLinks:
 - name: "My custom Grafana dashboard"
 type: "grafana"
 variables:
 app: var-app
 namespace: var-namespace
 version: var-version

The name field corresponds to what you can set in the pod annotation kiali.io/dashboards.

Debugging Kiali

Mon, 01 Jan 0001 00:00:00 +0000

Logs

The most basic way of debugging the internals of Kiali is to examine its log messages. A typical way of examining the log messages is via:

kubectl logs -n istio-system deployment/kiali

Each log message is logged at a specific level. The different log levels are trace, debug, info, warn, error, and fatal. By default, log messages at info level and higher will be logged. If you want to see more verbose logs, set the log level to debug or trace (trace is the most verbose setting and will make the log output very “noisy”). You set the log level in the Kiali CR:

Istio Environment

Mon, 01 Jan 0001 00:00:00 +0000

Labels and resource names

Istio recommends adding app and version labels to pods to attach this information to telemetry. Kiali relies on correctness of these labels for several features.

In Istio, it is possible to use a different set of labels, like app.kubernetes.io/name and app.kubernetes.io/version, however you must configure Kiali to the labels you are using. By default, Kiali uses Istio’s recommended labels:

spec:
 istio_labels:
 app_label_name: "app"
 version_label_name: "version"

Although Istio lets you use different labels on different pods, Kiali can only use a single set.

For example, Istio lets you use the app label in one pod and the app.kubernetes.io/name in another pod and it will generate telemetry correctly. However, you will have no way to configure Kiali for this case.

Kiali CR Reference

Mon, 01 Jan 0001 00:00:00 +0000

Example CR

(all values shown here are the defaults unless otherwise noted)

apiVersion: kiali.io/v1alpha1
kind: Kiali
metadata:
 name: kiali
 annotations:
 ansible.sdk.operatorframework.io/verbosity: "1"
spec:
 additional_display_details:
 - title: "API Documentation"
 annotation: "kiali.io/api-spec"
 icon_annotation: "kiali.io/api-type"

 installation_tag: ""

 version: "default"

 ai:
 chat:
 allowed_users: []
 default_provider: ""
 enabled: false
 max_tool_iterations: 5
 providers: []
 store_config:
 enabled: true
 inactivity_timeout: "30m"
 max_cache_memory_mb: 1024
 reduce_threshold: 15
 reduce_with_ai: false
 tools: {}
 consumption:
 allowed_users_dashboard: []
 budgets: []
 prices_config_map: ""
 enabled: false
 metrics: false

 auth:
 strategy: ""
 openid:
 # default: additional_request_params is empty
 additional_request_params:
 openIdReqParam: "openIdReqParamValue"
 # default: allowed_domains is an empty list
 allowed_domains: ["allowed.domain"]
 api_proxy: ""
 api_proxy_ca_data: ""
 api_token: "id_token"
 authentication_timeout: 300
 authorization_endpoint: ""
 client_id: ""
 disable_rbac: false
 http_proxy: ""
 https_proxy: ""
 insecure_skip_verify_tls: false
 issuer_uri: ""
 post_logout_redirect_uri: ""
 scopes: ["openid", "profile", "email"]
 username_claim: "sub"
 discovery_override:
 authorization_endpoint: ""
 end_session_endpoint: ""
 jwks_uri: ""
 token_endpoint: ""
 userinfo_endpoint: ""
 openshift:
 impersonation:
 allowed_groups: []
 allowed_users: []
 enabled: false
 #redirect_uris:
 #token_inactivity_timeout:
 #token_max_age: 

 clustering:
 autodetect_secrets:
 enabled: true
 label: "kiali.io/multiCluster=true"
 clusters: []
 ignore_home_cluster: false
 kiali_urls: []

 # default: custom_dashboards is an empty list
 custom_dashboards:
 - name: "envoy"

 deployment:
 additional_pod_containers_yaml: []
 additional_pod_init_containers_yaml: []
 # default: additional_service_yaml is empty
 additional_service_yaml:
 externalName: "kiali.example.com"
 affinity:
 # default: node is empty
 node:
 requiredDuringSchedulingIgnoredDuringExecution:
 nodeSelectorTerms:
 - matchExpressions:
 - key: kubernetes.io/e2e-az-name
 operator: In
 values:
 - e2e-az1
 - e2e-az2
 # default: pod is empty
 pod:
 requiredDuringSchedulingIgnoredDuringExecution:
 - labelSelector:
 matchExpressions:
 - key: security
 operator: In
 values:
 - S1
 topologyKey: topology.kubernetes.io/zone
 # default: pod_anti is empty
 pod_anti:
 preferredDuringSchedulingIgnoredDuringExecution:
 - weight: 100
 podAffinityTerm:
 labelSelector:
 matchExpressions:
 - key: security
 operator: In
 values:
 - S2
 topologyKey: topology.kubernetes.io/zone
 cluster_wide_access: true
 # default: configmap_annotations is empty
 configmap_annotations:
 strategy.spinnaker.io/versioned: "false"
 # default: custom_envs is an empty list
 custom_envs:
 - name: "HTTP_PROXY"
 value: "http://my.proxy.com:1234"
 - name: "NO_PROXY"
 value: "hostname.example.com"
 # default: custom_secrets is an empty list
 custom_secrets:
 - name: "a-custom-secret"
 mount: "/a-custom-secret-path"
 optional: true
 - name: "a-csi-secret"
 mount: "/a-csi-secret-path"
 csi:
 driver: secrets-store.csi.k8s.io
 readOnly: true
 volumeAttributes:
 secretProviderClass: kiali-secretprovider
 # default: discovery_selectors is empty
 discovery_selectors:
 default:
 - matchLabels:
 region: north
 - matchExpressions:
 - key: organization
 operator: "In"
 values: ["engineering", "accounting"]
 - matchLabels:
 region: south
 matchExpressions:
 - key: app
 operator: "DoesNotExist"
 - key: domain
 operator: "NotIn"
 values: ["production"]
 overrides:
 myRemoteCluster:
 - matchLabels:
 region: world
 - matchExpressions:
 - key: organization
 operator: "NotIn"
 values: ["marketing"]
 - matchLabels:
 region: antarctica
 matchExpressions:
 - key: app
 operator: "DoesNotExist"
 - key: domain
 operator: "In"
 values: ["staging"]
 dns:
 # default: config is empty
 config:
 options:
 - name: ndots
 value: "1"
 # default: policy is empty
 policy: "ClusterFirst"
 extra_labels: {}
 # default: host_aliases is an empty list
 host_aliases:
 - ip: "192.168.1.100"
 hostnames:
 - "foo.local"
 - "bar.local"
 hpa:
 api_version: ""
 # default: spec is empty
 spec:
 maxReplicas: 2
 minReplicas: 1
 metrics:
 - type: Resource
 resource:
 name: cpu
 target:
 type: Utilization
 averageUtilization: 50
 image_digest: ""
 image_name: ""
 image_pull_policy: "IfNotPresent"
 # default: image_pull_secrets is an empty list
 image_pull_secrets: ["image.pull.secret"]
 image_version: ""
 ingress:
 # default: additional_labels is empty
 additional_labels:
 ingressAdditionalLabel: "ingressAdditionalLabelValue"
 class_name: "nginx"
 # default: enabled is undefined
 enabled: false
 # default: override_yaml is undefined
 override_yaml:
 metadata:
 annotations:
 nginx.ingress.kubernetes.io/secure-backends: "true"
 nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
 spec:
 rules:
 - http:
 paths:
 - path: "/kiali"
 pathType: Prefix
 backend:
 service:
 name: "kiali"
 port:
 number: 20001
 instance_name: "kiali"
 logger:
 log_level: "info"
 log_format: "text"
 sampler_rate: "1"
 time_field_format: "2006-01-02T15:04:05Z07:00"
 namespace: "istio-system"
 network_policy:
 enabled: true
 # default: node_selector is empty
 node_selector:
 nodeSelector: "nodeSelectorValue"
 # default: pod_annotations is empty
 pod_annotations:
 proxy.istio.io/config: '{ "holdApplicationUntilProxyStarts": true }'
 pod_disruption_budget:
 api_version: ""
 # default: spec is empty
 spec:
 minAvailable: 1
 # default: pod_labels is empty
 pod_labels:
 sidecar.istio.io/inject: "true"
 priority_class_name: ""
 probes:
 liveness:
 initial_delay_seconds: 5
 period_seconds: 30
 readiness:
 initial_delay_seconds: 5
 period_seconds: 30
 startup:
 failure_threshold: 6
 initial_delay_seconds: 30
 period_seconds: 10
 remote_cluster_resources_only: false
 replicas: 1
 # default: resources is undefined
 resources:
 requests:
 cpu: "10m"
 memory: "64Mi"
 limits:
 memory: "1Gi"
 secret_name: "kiali"
 security_context: {}
 # default: service_annotations is empty
 service_annotations:
 svcAnnotation: "svcAnnotationValue"
 # default: service_labels is empty
 service_labels:
 svcLabel: "svcLabelValue"
 # default: service_type is undefined
 service_type: "NodePort"
 strategy: {}
 # default: tolerations is an empty list
 tolerations:
 - key: "example-key"
 operator: "Exists"
 effect: "NoSchedule"
 topology_spread_constraints: []
 version_label: ""
 view_only_mode: false

 # default: extensions is an empty list
 extensions:
 - enabled: true
 name: "skupper"

 external_services:
 custom_dashboards:
 discovery_auto_threshold: 10
 discovery_enabled: "auto"
 enabled: true
 is_core: false
 namespace_label: "namespace"
 prometheus:
 auth:
 insecure_skip_verify: false
 oauth2:
 audience: ""
 auth_style: "header"
 client_id: ""
 client_secret: ""
 scopes: []
 token_url: ""
 password: ""
 token: ""
 type: "none" # Valid values: none, basic, bearer, oauth2
 use_kiali_token: false
 username: ""
 cache_duration: 7
 cache_enabled: true
 cache_expiration: 300
 # default: custom_headers is empty
 custom_headers:
 customHeader1: "customHeader1Value"
 health_check_url: ""
 is_core: true
 # default: query_scope is empty
 query_scope:
 mesh_id: "mesh-1"
 cluster: "cluster-east"
 thanos_proxy:
 enabled: false
 retention_period: "7d"
 scrape_interval: "30s"
 url: ""
 grafana:
 auth:
 insecure_skip_verify: false
 oauth2:
 audience: ""
 auth_style: "header"
 client_id: ""
 client_secret: ""
 scopes: []
 token_url: ""
 password: ""
 token: ""
 type: "none" # Valid values: none, basic, bearer, oauth2
 use_kiali_token: false
 username: ""
 dashboards:
 - name: "Istio Service Dashboard"
 variables:
 datasource: "var-datasource"
 namespace: "var-namespace"
 service: "var-service"
 version: "var-version"
 - name: "Istio Workload Dashboard"
 variables:
 datasource: "var-datasource"
 namespace: "var-namespace"
 workload: "var-workload"
 version: "var-version"
 - name: "Istio Mesh Dashboard"
 - name: "Istio Control Plane Dashboard"
 - name: "Istio Performance Dashboard"
 - name: "Istio Wasm Extension Dashboard"
 datasource_uid: ""
 enabled: true
 external_url: ""
 health_check_url: ""
 internal_url: "http://grafana.istio-system:3000"
 is_core: false
 istio:
 component_status:
 components: []
 enabled: true
 gateway_api_classes: []
 gateway_api_classes_label_selector: ""
 istio_api_enabled: true
 istio_identity_domain: ""
 istiod_polling_interval_seconds: 20
 validation_change_detection_enabled: true
 validation_reconcile_interval: "1m"
 perses:
 auth:
 insecure_skip_verify: false
 oauth2:
 audience: ""
 auth_style: "header"
 client_id: ""
 client_secret: ""
 scopes: []
 token_url: ""
 password: ""
 type: "none" # Valid values: none, basic, bearer, oauth2
 use_kiali_token: false
 username: ""
 dashboards:
 - name: "Istio Service Dashboard"
 variables:
 datasource: "var-datasource"
 namespace: "var-namespace"
 service: "var-service"
 version: "var-version"
 - name: "Istio Workload Dashboard"
 variables:
 datasource: "var-datasource"
 namespace: "var-namespace"
 workload: "var-workload"
 version: "var-version"
 - name: "Istio Mesh Dashboard"
 - name: "Istio Control Plane Dashboard"
 - name: "Istio Performance Dashboard"
 - name: "Istio Wasm Extension Dashboard"
 enabled: false
 external_url: ""
 health_check_url: ""
 internal_url: ""
 is_core: false
 project: "istio"
 url_format: ""
 prometheus:
 auth:
 insecure_skip_verify: false
 oauth2:
 audience: ""
 auth_style: "header"
 client_id: ""
 client_secret: ""
 scopes: []
 token_url: ""
 password: ""
 token: ""
 type: "none" # Valid values: none, basic, bearer, oauth2
 use_kiali_token: false
 username: ""
 cache_duration: 7
 cache_enabled: true
 cache_expiration: 300
 # default: custom_headers is empty
 custom_headers:
 customHeader1: "customHeader1Value"
 enabled: true
 health_check_url: ""
 is_core: true
 # default: query_scope is empty
 query_scope:
 mesh_id: "mesh-1"
 cluster: "cluster-east"
 thanos_proxy:
 enabled: false
 retention_period: "7d"
 scrape_interval: "30s"
 url: ""
 tracing:
 auth:
 insecure_skip_verify: false
 oauth2:
 audience: ""
 auth_style: "header"
 client_id: ""
 client_secret: ""
 scopes: []
 token_url: ""
 password: ""
 token: ""
 type: "none" # Valid values: none, basic, bearer, oauth2
 use_kiali_token: false
 username: ""
 # default: custom_headers is empty
 custom_headers:
 customHeader1: "customHeader1Value"
 disable_version_check: false
 enabled: false
 external_url: ""
 grpc_port: 9095
 health_check_url: ""
 internal_url: ""
 is_core: false
 namespace_selector: true
 provider: "jaeger"
 # default: query_scope is empty
 query_scope:
 mesh_id: "mesh-1"
 cluster: "cluster-east"
 query_timeout: 5
 tempo_config:
 cache_capacity: 200
 cache_enabled: true
 datasource_uid: ""
 name: ""
 namespace: ""
 org_id: ""
 tenant: ""
 url_format: "grafana"
 use_grpc: true
 use_waypoint_name: false
 whitelist_istio_system: ["jaeger-query", "istio-ingressgateway"]

 health_config:
 compute:
 duration: "5m"
 refresh_interval: "3m"
 timeout: "10m"
 # default: rate is an empty list
 rate:
 - namespace: ".*"
 kind: ".*"
 name: ".*"
 tolerance:
 - protocol: "http"
 direction: ".*"
 code: "[1234]00"
 degraded: 5
 failure: 10

 identity:
 # default: cert_file is undefined
 cert_file: ""
 # default: private_key_file is undefined
 private_key_file: ""

 istio_labels:
 app_label_name: ""
 version_label_name: ""

 kiali_feature_flags:
 authz:
 require_namespace_get: false
 clustering:
 enable_exec_provider: false
 # default: custom_workload_types is an empty list
 custom_workload_types:
 - group: "argoproj.io"
 version: "v1alpha1"
 kind: "Rollout"
 disabled_features: []
 istio_annotation_action: true
 istio_injection_action: true
 istio_upgrade_action: false
 ui_defaults:
 graph:
 find_options:
 - description: "Find: slow edges (> 1s)"
 expression: "rt > 1000"
 - description: "Find: unhealthy nodes"
 expression: "! healthy"
 - description: "Find: unknown nodes"
 expression: "name = unknown"
 hide_options:
 - description: "Hide: healthy nodes"
 expression: "healthy"
 - description: "Hide: unknown nodes"
 expression: "name = unknown"
 settings:
 animation: "point"
 traffic:
 ambient: "total"
 grpc: "requests"
 http: "requests"
 tcp: "sent"
 i18n:
 language: "en"
 list:
 include_health: true
 include_istio_resources: true
 include_validations: true
 show_include_toggles: false
 mesh:
 find_options:
 - description: "Find: unhealthy nodes"
 expression: "! healthy"
 hide_options:
 - description: "Hide: healthy nodes"
 expression: "healthy"
 # default: metrics_inbound is undefined
 metrics_inbound:
 aggregations:
 - display_name: "Istio Network"
 label: "topology_istio_io_network"
 single_selection: false
 - display_name: "Istio Revision"
 label: "istio_io_rev"
 single_selection: false
 # default: metrics_outbound is undefined
 metrics_outbound:
 aggregations:
 - display_name: "Istio Network"
 label: "topology_istio_io_network"
 single_selection: false
 - display_name: "Istio Revision"
 label: "istio_io_rev"
 single_selection: false
 metrics_per_refresh: "1m"
 # default: namespaces is an empty list
 namespaces: ["istio-system"]
 refresh_interval: "1m"
 tracing:
 limit: 100
 validations:
 ignore: ["KIA1301"]
 skip_wildcard_gateway_hosts: false

 kubernetes_config:
 burst: 200
 cache_duration: 300
 cache_token_namespace_duration: 10
 excluded_workloads:
 - "CronJob"
 - "DeploymentConfig"
 - "Job"
 - "ReplicationController"
 qps: 175

 login_token:
 expiration_seconds: 86400
 signing_key: ""

 server:
 address: ""
 audit_log: true
 cors_allow_all: false
 gzip_enabled: true
 # default: node_port is undefined
 node_port: 32475
 observability:
 metrics:
 enabled: true
 health_status:
 enabled: false
 max_consecutive_na: 3
 port: 9090
 tracing:
 collector_type: "otel"
 collector_url: "jaeger-collector.istio-system:4318"
 enabled: false
 otel:
 ca_name: ""
 protocol: "http"
 skip_verify: false
 tls_enabled: false
 sampling_rate: 0.5
 port: 20001
 profiler:
 enabled: false
 require_auth: false
 web_fqdn: ""
 web_history_mode: "browser"
 web_port: ""
 web_root: ""
 web_schema: ""
 write_timeout: "60s"

Validating your Kiali CR

The Kiali CR has a CRD Schema so it will be validated when you create or update it in your cluster.

Properties

.spec

(object)

This is the CRD for the resources called Kiali CRs. The Kiali Operator will watch for resources of this type and when it detects a Kiali CR has been added, deleted, or modified, it will install, uninstall, and update the associated Kiali Server installation. The settings here will configure the Kiali Server as well as the Kiali Operator. All of these settings will be stored in the Kiali ConfigMap. Do not modify the ConfigMap; it will be managed by the Kiali Operator. Only modify the Kiali CR when you want to change a configuration setting.

.spec.additional_display_details

(array)

A list of additional details that Kiali will look for in annotations. When found on any workload or service, Kiali will display the additional details in the respective workload or service details page. This is typically used to inject some CI metadata or documentation links into Kiali views. For example, by default, Kiali will recognize these annotations on a service or workload (e.g. a Deployment, StatefulSet, etc.):

spec:
 annotations:
 kiali.io/api-spec: http://list/to/my/api/doc
 kiali.io/api-type: rest

Note that if you change this setting for your own custom annotations, keep in mind that it would override the current default. So you would have to add the default setting as shown in the example CR if you want to preserve the default links.

(array)

A list of users that are allowed to use the ChatAI feature. If this list is empty, all users have access. If populated, only the specified users can see and interact with the Chatbot.

.spec.ai.chat.allowed_users[*]

(string)

.spec.ai.chat.default_provider

(string)

The default provider to use for the ChatAI feature. This is the provider that will be used if no provider is specified in the request.

.spec.ai.chat.enabled

(boolean)

Enable or disable the ChatAI feature.

.spec.ai.chat.max_tool_iterations

(integer)

Maximum number of tool-call iterations (LLM call + tool execution round) allowed per request before the loop is force-aborted. Must be between 1 and 20.

.spec.ai.chat.providers

(array)

A list of providers that can be used for the ChatAI feature. This is the list of providers that will be available to the user to choose from.

(array)

A list of models that can be used for the ChatAI feature. This is the list of models that will be available to the user to choose from.

(object)

Configuration for the ChatAI store.

.spec.ai.chat.store_config.enabled

(boolean)

Enable or disable the ChatAI store.

.spec.ai.chat.store_config.inactivity_timeout

(string)

Idle time allowed before the conversation is deleted due to inactivity.

.spec.ai.chat.store_config.max_cache_memory_mb

(integer)

The maximum cache memory for the ChatAI store.

.spec.ai.chat.store_config.reduce_threshold

(integer)

The threshold for the ChatAI store reduction with AI. This is the number of messages in a conversation before the conversation is reduced.

.spec.ai.chat.store_config.reduce_with_ai

(boolean)

Enable or disable the ChatAI store reduction with AI.

.spec.ai.chat.tools

(object)

Optional global filter for the ChatAI toolset. enabled_tools acts as an allowlist. disabled_tools acts as a denylist and is applied afterwards.

.spec.ai.chat.tools.disabled_tools

(array)

A denylist of tool names to hide from all ChatAI providers. Applied after enabled_tools.

.spec.ai.chat.tools.disabled_tools[*]

(string)

.spec.ai.chat.tools.enabled_tools

(array)

An allowlist of tool names to expose to ChatAI providers. If set, only the listed tool names remain available.

.spec.ai.chat.tools.enabled_tools[*]

(string)

.spec.ai.consumption

(object)

(number)

Maximum estimated cost allowed in the budget interval, in the pricing currency (typically USD).

.spec.ai.consumption.budgets[*].max_tokens

(number)

Maximum number of tokens allowed in the budget interval, expressed in millions of tokens.

.spec.ai.consumption.budgets[*].usernames

(array)

Users this budget applies to. Use * as a catch-all. Required and must not be empty.

.spec.ai.consumption.budgets[].usernames[]

(string)

.spec.ai.consumption.prices_config_map

(string)

Name of a ConfigMap in the Kiali deployment namespace that holds a custom token pricing catalog. The ConfigMap is user-managed (the operator never creates or writes it). The operator mounts it read-only at /kiali-ai-pricing with optional: true. If omitted or empty, or if the file cannot be read, Kiali uses its built-in catalog. For the ConfigMap format and how to install it, see the documentation at https://kiali.io/docs/ai/chatbot/kiali-chatbot-prices/

.spec.ai.enabled

(boolean)

Enable or disable the AI feature.

.spec.ai.metrics

(boolean)

Enable or disable ChatAI usage metrics. Required for consumption tracking and the AI dashboard.

.spec.api

(object)

DEPRECATED AFTER v1.73: These settings control how the Kiali API should be accessed.

.spec.api.namespaces

(object)

(string)

DEPRECATED AFTER v1.73: A Kubernetes label selector expression that will be used to include namespaces.

.spec.auth

(object)

.spec.auth.openid

(object)

(string)

DEPRECATED since v2.21: Use auth.openid.discovery_override.authorization_endpoint instead. The URL of the provider’s authorization endpoint.

.spec.auth.openid.client_id

(string)

(string)

.spec.auth.openid.scopes

(array)

.spec.auth.openid.scopes[*]

(string)

.spec.auth.openid.username_claim

(string)

.spec.auth.openshift

(object)

To learn more about these settings and how to configure the OpenShift authentication strategy, read the documentation at https://kiali.io/docs/configuration/authentication/openshift/

.spec.auth.openshift.auth_timeout

(integer)

DEPRECATED AFTER v1.73: The amount of time in seconds Kiali will wait for a response from the OpenShift API when requesting authentication information.

.spec.auth.openshift.client_id_prefix

(string)

DEPRECATED AFTER v1.73: A prefix that will be applied to the OpenShift OAuth client identifier.

.spec.auth.openshift.impersonation

(object)

Settings for Kubernetes API impersonation. When enabled, users authenticate once to the home cluster and Kiali uses its service account to impersonate the user on all clusters (including home).

.spec.auth.openshift.impersonation.allowed_groups

(array)

When set, only these groups will be included in impersonation headers (in addition to system:authenticated and system:authenticated:oauth which are always included). If empty, all of the user’s groups are impersonated. This also restricts the Kiali SA’s ClusterRole via resourceNames. Must not contain system: prefixed groups. For full RBAC defense-in-depth, configure both allowed_users and allowed_groups.

.spec.auth.openshift.impersonation.allowed_groups[*]

The default provider to use for the ChatAI feature. This is the provider that will be used if no provider is specified in the request.

.spec.chat_ai.enabled

(boolean)

Enable or disable the ChatAI feature.

.spec.chat_ai.max_tool_iterations

(integer)

Maximum number of tool-call iterations (LLM call + tool execution round) allowed per request before the loop is force-aborted. Must be between 1 and 20.

.spec.chat_ai.providers

(array)

A list of providers that can be used for the ChatAI feature. This is the list of providers that will be available to the user to choose from.

.spec.chat_ai.providers[*]

(object)

(string)

.spec.chat_ai.providers[*].models

(array)

A list of models that can be used for the ChatAI feature. This is the list of models that will be available to the user to choose from.

.spec.chat_ai.providers[].models[]

(object)

.spec.chat_ai.providers[].models[].description

(string)

The description of the model.

.spec.chat_ai.providers[].models[].enabled

(boolean)

Enable or disable the model.

.spec.chat_ai.providers[].models[].endpoint

(string)

The endpoint of the model.

(object)

Configuration for the ChatAI store.

.spec.chat_ai.store_config.enabled

(boolean)

Enable or disable the ChatAI store.

.spec.chat_ai.store_config.inactivity_timeout

(string)

Idle time allowed before the conversation is deleted due to inactivity.

.spec.chat_ai.store_config.max_cache_memory_mb

(integer)

The maximum cache memory for the ChatAI store.

.spec.chat_ai.store_config.reduce_threshold

(integer)

The threshold for the ChatAI store reduction with AI. This is the number of messages in a conversation before the conversation is reduced.

.spec.chat_ai.store_config.reduce_with_ai

(boolean)

Enable or disable the ChatAI store reduction with AI.

.spec.chat_ai.tools

(object)

Optional global filter for the ChatAI toolset. enabled_tools acts as an allowlist. disabled_tools acts as a denylist and is applied afterwards.

.spec.chat_ai.tools.disabled_tools

(array)

A denylist of tool names to hide from all ChatAI providers. Applied after enabled_tools.

.spec.chat_ai.tools.disabled_tools[*]

(string)

.spec.chat_ai.tools.enabled_tools

(array)

An allowlist of tool names to expose to ChatAI providers. If set, only the listed tool names remain available.

.spec.chat_ai.tools.enabled_tools[*]

(string)

.spec.clustering

(object)

Multi-cluster related features.

.spec.clustering.autodetect_secrets

(object)

Settings to allow cluster secrets to be auto-detected. Secrets must exist in the Kiali deployment namespace.

.spec.clustering.autodetect_secrets.enabled

(boolean)

If true then remote cluster secrets will be autodetected during the installation of the Kiali Server Deployment. Any remote cluster secrets found in the Kiali deployment namespace will be mounted to the Kiali Server’s file system. If false, you can still manually specify the remote cluster secret information in the ‘clusters’ setting if you wish to utilize multicluster features.

.spec.clustering.autodetect_secrets.label

(string)

The name and value of a label that exists on all remote cluster secrets.

.spec.clustering.clusters

(array)

A list of clusters that the Kiali Server can access. You need to specify the remote clusters here if ‘autodetect_secrets.enabled’ is false.

.spec.clustering.clusters[*]

(object)

.spec.clustering.clusters[*].name

(string)

The name of the cluster.

.spec.clustering.clusters[*].secret_name

(string)

The name of the secret that contains the credentials necessary to connect to the remote cluster. This secret must exist in the Kiali deployment namespace. If a secret name is not provided then it’s assumed that the cluster is inaccessible.

.spec.clustering.enable_exec_provider

(boolean)

Flag to enable exec provider for clustering authentication.

.spec.clustering.ignore_home_cluster

(boolean)

Set to true for an external Kiali deployment, or if Kiali should not try to discover Istio on the home cluster. When set to true, it is required to set kubernetes_config.cluster_name.

.spec.clustering.kiali_urls

(array)

A map between cluster name, instance name and namespace to a Kiali URL. Will be used showing the Mesh page’s Kiali URLs. The Kiali service’s ‘kiali.io/external-url’ annotation will be overridden when this property is set.

.spec.clustering.kiali_urls[*]

(object)

.spec.clustering.kiali_urls[*].cluster_name

(string)

The name of the cluster.

.spec.clustering.kiali_urls[*].instance_name

(string)

The instance name of this Kiali installation. This should be the value used in deployment.instance_name for Kiali resource name.

.spec.clustering.kiali_urls[*].namespace

(string)

The namespace into which Kiali is installed.

.spec.clustering.kiali_urls[*].url

(string)

The URL of Kiali in the cluster.

.spec.custom_dashboards

(array)

A list of user-defined custom monitoring dashboards that you can use to generate metrics charts for your applications. The server has some built-in dashboards; if you define a custom dashboard here with the same name as a built-in dashboard, your custom dashboard takes precedence and will overwrite the built-in dashboard. You can disable one or more of the built-in dashboards by simply defining an empty dashboard.

An example of an additional user-defined dashboard,

spec:
 custom_dashboards:
 - name: myapp
 title: My App Metrics
 items:
 - chart:
 name: "Thread Count"
 spans: 4
 metricName: "thread-count"
 dataType: "raw"

An example of disabling a built-in dashboard (in this case, disabling the Envoy dashboard),

spec:
 custom_dashboards:
 - name: envoy

To learn more about custom monitoring dashboards, see the documentation at https://kiali.io/docs/configuration/custom-dashboard/

(object)

Additional custom yaml to add to the service definition. This is used mainly to customize the service type. For example, if the deployment.service_type is set to ‘LoadBalancer’ and you want to set the loadBalancerIP, you can do so here with: additional_service_yaml: { 'loadBalancerIP': '78.11.24.19' }. Another example would be if the deployment.service_type is set to ‘ExternalName’ you will need to configure the name via: additional_service_yaml: { 'externalName': 'my.kiali.example.com' }. A final example would be if external IPs need to be set: additional_service_yaml: { 'externalIPs': ['80.11.12.10'] }

.spec.deployment.affinity

(object)

Affinity definitions that are to be used to define the nodes where the Kiali pod should be constrained. See the Kubernetes documentation on Assigning Pods to Nodes for the proper syntax for these three different affinity types.

.spec.deployment.affinity.node

(object)

.spec.deployment.affinity.pod

(object)

.spec.deployment.affinity.pod_anti

(object)

.spec.deployment.cluster_wide_access

(boolean)

Determines if the Kiali server will be granted cluster-wide permissions to see all namespaces. When true, this provides more efficient caching within the Kiali server. It must be true if deployment.discovery_selectors.default is left unset. To limit the namespaces for which Kiali has permissions, set to false and define the desired selectors in deployment.discovery_selectors.default.

.spec.deployment.configmap_annotations

(object)

Custom annotations to be created on the Kiali ConfigMap.

.spec.deployment.custom_envs

(array)

Defines additional environment variables to be set in the Kiali server pod. This is typically used for (but not limited to) setting proxy environment variables such as HTTP_PROXY, HTTPS_PROXY, and/or NO_PROXY.

.spec.deployment.custom_envs[*]

(object)

.spec.deployment.custom_envs[*].name

(string) *Required*

The name of the custom environment variable.

.spec.deployment.custom_envs[*].value

(string) *Required*

The value of the custom environment variable.

.spec.deployment.custom_secrets

(array)

Defines additional secrets that are to be mounted in the Kiali pod.

These are useful to contain client certificates that are used by Kiali to authenticate to third party systems using mTLS (for example, see external_services.tracing.auth.cert_file and external_services.tracing.auth.key_file).

These secrets must be created by an external mechanism. Kiali will not generate these secrets; it is assumed these secrets are externally managed. You can define 0, 1, or more secrets. An example configuration is,

spec:
 deployment:
 custom_secrets:
 - name: mysecret
 mount: /mysecret-path
 - name: my-other-secret
 mount: /my-other-secret-location
 optional: true

spec:
 deployment:
 host_aliases:
 - ip: 192.168.1.100
 hostnames:
 - "foo.local"
 - "bar.local"

For details on the content of this setting, see https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/#adding-additional-entries-with-hostaliases

.spec.deployment.host_aliases[*]

(object)

.spec.deployment.host_aliases[*].hostnames

(array)

.spec.deployment.host_aliases[].hostnames[]

(string)

.spec.deployment.host_aliases[*].ip

(string)

.spec.deployment.hpa

(object)

Determines what (if any) HorizontalPodAutoscaler should be created to autoscale the Kiali pod. A typical way to configure HPA for Kiali is,

spec:
 deployment:
 hpa:
 api_version: "autoscaling/v2"
 spec:
 maxReplicas: 2
 minReplicas: 1
 metrics:
 - type: Resource
 resource:
 name: cpu
 target:
 type: Utilization
 averageUtilization: 50

.spec.deployment.image_pull_secrets[*]

(string)

.spec.deployment.image_version

(string)

Determines which version of Kiali to install. Choose ‘lastrelease’ to use the last Kiali release. Choose ‘latest’ to use the latest image (which may or may not be a released version of Kiali). Choose ‘operator_version’ to use the image whose version is the same as the operator version. Otherwise, you can set this to any valid Kiali version (such as ‘v1.0’) or any valid Kiali digest hash (if you set this to a digest hash, you must indicate the digest in deployment.image_digest).

Note that if this is set to ‘latest’ then the deployment.image_pull_policy will be set to ‘Always’.

Note that override_yaml.metadata.labels is not allowed - you cannot override the labels; to add labels to the default set of labels, use the deployment.ingress.additional_labels setting. Example,

spec:
 deployment:
 ingress:
 override_yaml:
 metadata:
 annotations:
 nginx.ingress.kubernetes.io/secure-backends: "true"
 nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
 spec:
 rules:
 - http:
 paths:
 - path: /kiali
 pathType: Prefix
 backend:
 service
 name: "kiali"
 port:
 number: 20001

.spec.deployment.ingress.override_yaml.metadata

(object)

.spec.deployment.ingress.override_yaml.metadata.annotations

(object)

(object)

Custom annotations to be created on the Kiali pod. By default, the following annotation is applied:

proxy.istio.io/config: '{ "holdApplicationUntilProxyStarts": true }'

If you define your own pod_annotations, they will overwrite this default. To retain the default behavior while adding your own annotations, make sure to include this value alongside your custom annotations.

.spec.deployment.pod_disruption_budget

(object)

Determines what (if any) PodDisruptionBudget should be created for the Kiali pod. A typical way to configure PDB for Kiali is,

spec:
 deployment:
 pod_disruption_budget:
 api_version: "policy/v1"
 spec:
 minAvailable: 1

.spec.deployment.pod_disruption_budget.api_version

(string)

A specific PDB API version that can be specified in case there is some PDB feature you want to use that is only supported in that specific version. If value is an empty string, the default version of ‘policy/v1’ will be used.

.spec.deployment.pod_disruption_budget.spec

(object)

The spec specified here will be placed in the created PDB resource’s ‘spec’ section. If spec is left empty, no PDB resource will be created. Note that you must not specify the ‘selector’ section in spec; the Kiali Operator will populate that for you.

.spec.deployment.pod_labels

(object)

Custom labels to be created on the Kiali pod. An example use for this setting is to inject an Istio sidecar such as,

sidecar.istio.io/inject: "true"

Note that if you set a label key that conflicts with a standard Kiali label, your value will take precedence (user labels win on collision).

.spec.deployment.priority_class_name

(string)

The priorityClassName used to assign the priority of the Kiali pod.

.spec.deployment.probes

.spec.deployment.probes.startup.initial_delay_seconds

(integer)

.spec.deployment.probes.startup.period_seconds

(integer)

.spec.deployment.remote_cluster_resources_only

(boolean)

When true, only those resources necessary for a remote Kiali Server to access this cluster are created (such as the service account and roles/bindings). There will be no Kiali Server deployment/pod created when this is true.

.spec.deployment.replicas

(integer)

The replica count for the Kiail deployment. If deployment.hpa is specified, this setting is ignored.

.spec.deployment.resources

(object)

Defines compute resources that are to be given to the Kiali pod’s container. The value is a dict as defined by Kubernetes. See the Kubernetes documentation (https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container). If you set this to an empty dict ({}) then no resources will be defined in the Deployment. If you do not set this at all, the default is,

spec:
 deployment:
 resources:
 requests:
 cpu: "10m"
 memory: "64Mi"
 limits:
 memory: "1Gi"

(string)

Minimum TLS version (e.g., TLSv1.3, TLSv1.2).

.spec.deployment.tls_config.source

(string)

TLS policy source: ‘auto’ to use OpenShift TLSSecurityProfile; ‘config’ to use explicit settings.

.spec.deployment.tolerations

(array)

A list of tolerations which declare which node taints Kiali can tolerate. See the Kubernetes documentation on Taints and Tolerations for more details.

.spec.deployment.tolerations[*]

(object)

.spec.deployment.topology_spread_constraints

(array)

A list of constraints which control how the Kiali pods are spread across your cluster to help achieve high availability as well as efficient resource utilization. See the Kubernetes documentation on Topology Spread Constraints for more details.

.spec.deployment.topology_spread_constraints[*]

(object)

.spec.deployment.verbose_mode

(boolean)

DEPRECATED AFTER v1.73: When true, Kiali will log additional debug information about its operations.

.spec.deployment.version_label

(string)

Kiali resources will be assigned a ‘version’ label when they are deployed. This setting determines what value those ‘version’ labels will have. When empty, its default will be determined as follows,

If deployment.image_version is ‘latest’, version_label will be fixed to ‘master’.
If deployment.image_version is ‘lastrelease’, version_label will be fixed to the last Kiali release version string.
If deployment.image_version is anything else, version_label will be that value, too.

.spec.deployment.view_only_mode

(boolean)

When true, Kiali will be in ‘view only’ mode, allowing the user to view and retrieve management and monitoring data for the service mesh, but not allow the user to modify the service mesh.

.spec.extensions

(array)

Defines third-party extensions whose metrics can be integrated into the Kiali traffic graph.

.spec.extensions[*]

(object)

.spec.extensions[*].enabled

(boolean)

Determines if the Kiali traffic graph should incorporate the extension’s metrics.

.spec.extensions[*].name

(string)

The name that is used to identify the metric time series for the extension.

.spec.external_services

(object)

(array)

A list of scopes to request with the token.

(object)

Settings used to authenticate with the Grafana instance.

(object)

.spec.external_services.grafana.dashboards[*].name

(string)

The name of the Grafana dashboard.

(string)

Password to be used when making requests to Perses, for basic authentication. May refer to a secret using the pattern secret:<secretName>:<secretKey>. When using a secret, the password is cached and automatically refreshed when the secret changes, enabling rotation without pod restart.

.spec.external_services.perses.auth.type

(string)

The type of authentication to use when contacting the server. Use bearer to send the token to the Perses server. Use basic to connect with username and password credentials. Use oauth2 to use OAuth2 client_credentials flow. Use none to not use any authentication.

.spec.external_services.perses.auth.use_kiali_token

(boolean)

When true and if auth.type is bearer, Kiali Service Account token will be used for the API calls to Perses.

.spec.external_services.perses.auth.username

(string)

Username to be used when making requests to Perses with basic authentication. May refer to a secret using the pattern secret:<secretName>:<secretKey>. When using a secret, the username is cached and automatically refreshed when the secret changes, enabling rotation without pod restart.

.spec.external_services.perses.dashboards

(array)

A list of Perses dashboards that Kiali can link to.

.spec.external_services.perses.dashboards[*]

(object)

.spec.external_services.perses.dashboards[*].name

(string)

The name of the Perses dashboard.

(string)

.spec.external_services.prometheus.auth.cert_file

(string)

The client certificate file to use when accessing Prometheus using https with mTLS. An empty string means no client certificate is used. May refer to a secret.

.spec.external_services.prometheus.auth.insecure_skip_verify

(boolean)

Set true to skip verifying certificate validity when Kiali contacts Prometheus over https.

.spec.external_services.prometheus.auth.key_file

(string)

.spec.external_services.prometheus.auth.oauth2

(object)

Settings for OAuth2 client_credentials authentication. When auth.type is oauth2, these settings are used to obtain an access token.

.spec.external_services.prometheus.auth.oauth2.audience

(string)

The audience parameter sent with the token request. Some providers require this to scope the token.

.spec.external_services.prometheus.auth.oauth2.auth_style

(string)

(string)

.spec.external_services.prometheus.auth.token

(string)

.spec.external_services.prometheus.auth.type

(string)

.spec.external_services.prometheus.auth.use_kiali_token

(boolean)

When true and if auth.type is bearer, Kiali Service Account token will be used for the API calls to Prometheus (in this case, auth.token config is ignored).

(string)

Thanos Scrape interval value expressed as a string.

.spec.external_services.prometheus.url

(string)

.spec.external_services.tracing

(object)

Configuration used to access the Tracing (Jaeger or Tempo) dashboards.

.spec.external_services.tracing.auth

(object)

Settings used to authenticate with the Tracing server instance.

(string)

The maximum time allowed for a single health refresh cycle. If exceeded, the refresh is cancelled and the next cycle starts on schedule.

.spec.health_config.rate

(array)

.spec.health_config.rate[*]

(object)

.spec.health_config.rate[*].kind

(string)

The type of resource that this configuration applies to. This is a regular expression.

.spec.health_config.rate[*].name

(string)

The name of a resource that this configuration applies to. This is a regular expression.

.spec.health_config.rate[*].namespace

(string)

The name of the namespace that this configuration applies to. This is a regular expression.

.spec.health_config.rate[*].tolerance

(array)

A list of tolerances for this configuration.

.spec.kiali_feature_flags.clustering.clusters[*].name

(string)

DEPRECATED AFTER v1.73: The name of the cluster.

.spec.kiali_feature_flags.clustering.clusters[*].secret_name

(string)

DEPRECATED AFTER v1.73: The name of the secret that contains the credentials necessary to connect to the remote cluster.

.spec.kiali_feature_flags.clustering.enable_exec_provider

(boolean)

DEPRECATED AFTER v1.73: Flag to enable exec provider for clustering authentication.

.spec.kiali_feature_flags.clustering.kiali_urls

(array)

DEPRECATED AFTER v1.73: A map between cluster name, instance name and namespace to a Kiali URL.

(object)

.spec.kiali_feature_flags.custom_workload_types[*].group

(string) *Required*

The API group of the custom workload type (e.g., ‘argoproj.io’).

.spec.kiali_feature_flags.custom_workload_types[*].kind

(string) *Required*

The kind of the custom workload type (e.g., ‘Rollout’).

.spec.kiali_feature_flags.custom_workload_types[*].version

(string) *Required*

The API version of the custom workload type (e.g., ‘v1alpha1’).

.spec.kiali_feature_flags.disabled_features

(array)

There may be some features that admins do not want to be accessible to users (even in ‘view only’ mode). In this case, this setting allows you to disable one or more of those features entirely.

(array)

A list of commonly used and useful find expressions that will be provided to the user out-of-box.

.spec.kiali_feature_flags.ui_defaults.graph.find_options[*]

(object)

.spec.kiali_feature_flags.ui_defaults.graph.find_options[*].auto_select

(boolean)

If true this option will be selected and take effect automatically. Note that only one option in the list can have this value be set to true.

.spec.kiali_feature_flags.ui_defaults.graph.find_options[*].description

(string)

Human-readable text to let the user know what the expression does.

.spec.kiali_feature_flags.ui_defaults.graph.find_options[*].expression

(string)

The find expression.

.spec.kiali_feature_flags.ui_defaults.graph.hide_options

(array)

A list of commonly used and useful hide expressions that will be provided to the user out-of-box.

(object)

.spec.kiali_feature_flags.ui_defaults.mesh.find_options[*].auto_select

(boolean)

If true this option will be selected and take effect automatically. Note that only one option in the list can have this value be set to true.

.spec.kiali_feature_flags.ui_defaults.mesh.find_options[*].description

(string)

Human-readable text to let the user know what the expression does.

.spec.kiali_feature_flags.ui_defaults.mesh.find_options[*].expression

(string)

The find expression.

.spec.kiali_feature_flags.ui_defaults.mesh.hide_options

(array)

A list of commonly used and useful hide expressions that will be provided to the user out-of-box.

.spec.kiali_feature_flags.ui_defaults.mesh.hide_options[*]

(object)

.spec.kiali_feature_flags.ui_defaults.mesh.hide_options[*].auto_select

(boolean)

If true this option will be selected and take effect automatically. Note that only one option in the list can have this value be set to true.

.spec.kiali_feature_flags.ui_defaults.mesh.hide_options[*].description

(string)

Human-readable text to let the user know what the expression does.

.spec.kiali_feature_flags.ui_defaults.mesh.hide_options[*].expression

(string)

The hide expression.

.spec.kiali_feature_flags.ui_defaults.metrics_inbound

(object)

Additional label aggregation for inbound metric pages in detail pages. You will see these configurations in the ‘Metric Settings’ drop-down. An example,

spec:
 kiali_feature_flags:
 ui_defaults:
 metrics_inbound:
 aggregations:
 - display_name: Istio Network
 label: topology_istio_io_network
 - display_name: Istio Revision
 label: istio_io_rev

.spec.kiali_feature_flags.ui_defaults.metrics_inbound.aggregations

(array)

.spec.kiali_feature_flags.ui_defaults.metrics_inbound.aggregations[*]

(object)

.spec.kiali_feature_flags.ui_defaults.metrics_inbound.aggregations[*].display_name

(string)

.spec.kiali_feature_flags.ui_defaults.metrics_inbound.aggregations[*].label

(string)

.spec.kiali_feature_flags.ui_defaults.metrics_inbound.aggregations[*].single_selection

(boolean)

Flag to indicate if only one option can be selected for this aggregation.

.spec.kiali_feature_flags.ui_defaults.metrics_outbound

(object)

Additional label aggregation for outbound metric pages in detail pages. You will see these configurations in the ‘Metric Settings’ drop-down. An example,

spec:
 kiali_feature_flags:
 ui_defaults:
 metrics_outbound:
 aggregations:
 - display_name: Istio Network
 label: topology_istio_io_network
 - display_name: Istio Revision
 label: istio_io_rev

.spec.kiali_feature_flags.ui_defaults.metrics_outbound.aggregations

(array)

.spec.kiali_feature_flags.ui_defaults.metrics_outbound.aggregations[*]

(object)

.spec.kiali_feature_flags.ui_defaults.metrics_outbound.aggregations[*].display_name

(string)

.spec.kiali_feature_flags.ui_defaults.metrics_outbound.aggregations[*].label

(string)

.spec.kiali_feature_flags.ui_defaults.metrics_outbound.aggregations[*].single_selection

(boolean)

Flag to indicate if only one option can be selected for this aggregation.

.spec.kiali_feature_flags.ui_defaults.metrics_per_refresh

(string)

Duration of metrics to fetch on each refresh. Value must be one of: 1m, 2m, 5m, 10m, 30m, 1h, 3h, 6h, 12h, 1d, 7d, or 30d

.spec.kiali_feature_flags.ui_defaults.namespaces

(array)

Default selections for the namespace selection dropdown. Non-existent or inaccessible namespaces will be ignored. Omit or set to an empty array for no default namespaces.

(integer)

This Kiali cache is a list of namespaces per user. This is typically a short-lived cache compared with the duration of the namespace cache defined by the cache_duration setting. This is specified in seconds.

.spec.kubernetes_config.cluster_name

(string)

The name of the cluster Kiali is deployed in. This is also known as the home cluster. This is only used in multi cluster environments. This must be set when clustering.ignore_home_cluster=true. If not set, Kiali will try to auto detect the cluster name from the Istiod deployment or use the default ‘Kubernetes’.

.spec.kubernetes_config.excluded_workloads

(array)

List of controllers that won’t be used for Workload calculation. Kiali queries Deployment, ReplicaSet, ReplicationController, DeploymentConfig, StatefulSet, Job and CronJob controllers. Deployment and ReplicaSet will be always queried, but ReplicationController, DeploymentConfig, StatefulSet, Job and CronJobs can be skipped from Kiali workloads queries if they are present in this list.

.spec.kubernetes_config.excluded_workloads[*]

(string)

.spec.kubernetes_config.qps

(integer)

The QPS value of the Kubernetes client.

Introduction

In authentication strategies other than anonymous Kiali supports limiting the namespaces that are accessible on a per-user basis. The anonymous authentication strategy does not support this, although you can still limit privileges when using an OpenShift cluster. See the access control section in Anonymous strategy.

To authorize namespaces, the standard Roles resources (or ClusterRoles) and RoleBindings resources (or ClusterRoleBindings) are used.

The Kubernetes RBAC documentation describe how to use Roles, ClusterRoles, RoleBindings and ClusterRoleBindings resources. If you are using OpenShift, read the OpenShift RBAC documentation.

Namespace Management

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

The default Kiali installation gives Kiali access to all namespaces available in the cluster and will allow all namespaces to be visible.

It is possible to restrict Kiali so that it can only access a specific set of namespaces by providing discovery selectors that match those namespaces. Note that Kiali will not use Istio’s discovery selectors; if Istio has been configured with its own discovery selectors, you will likely want to configure Kiali with the same list of discovery selectors.

No Istiod Access

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

Kiali makes use of the Istiod /debug endpoints for introspection into the control plane. If this API is unavailable Kiali continues to perform, but the feature set will be degraded. The Istio API can be unavailable for various reasons:

The Istio API has been explicitly disabled in the Istio configuration.
The deployment model prevents access to the Istio API (firewalls, other networking concerns or limitations).
The API is configured but for some, potentially unexpected, reason can not be reached by Kiali.

Configuration

When the Istio API is known to be inaccessible Kiali should be configured via the istio_api_enabled configuration item.
By default, istio_api_enabled is true.

OSSMConsole CR Reference

Mon, 01 Jan 0001 00:00:00 +0000

Example CR

(all values shown here are the defaults unless otherwise noted)

apiVersion: kiali.io/v1alpha1
kind: OSSMConsole
metadata:
 name: ossmconsole
 annotations:
 ansible.sdk.operatorframework.io/verbosity: "1"
spec:
 version: "default"

 deployment:
 imageDigest: ""
 imageName: ""
 imagePullPolicy: "IfNotPresent"
 # default: image_pull_secrets is an empty list
 imagePullSecrets: ["image.pull.secret"]
 imageVersion: ""
 namespace: ""

 # default: internal is an empty object (techPreview is disabled)
 # internal:
 # techPreview: true

 kiali:
 autoDiscover: true
 serviceName: ""
 serviceNamespace: ""
 servicePort: 0

Validating your OSSMConsole CR

The OSSMConsole CR has a CRD Schema so it will be validated when you create or update it in your cluster.

Properties

.spec

(object)

This is the CRD for the resources called OSSMConsole CRs. The OpenShift Service Mesh Console Operator will watch for resources of this type and when it detects an OSSMConsole CR has been added, deleted, or modified, it will install, uninstall, and update the associated OSSM Console installation.

.spec.deployment

(object)

.spec.deployment.imageDigest

.status

(object)

The processing status of this CR as reported by the OpenShift Service Mesh Console Operator.

TLS Policy

Mon, 01 Jan 0001 00:00:00 +0000

Kiali uses one TLS policy for both its inbound server endpoint and every outbound client it creates—HTTP, gRPC, tracing exporters, and OpenID/OAuth HTTP flows. The policy controls TLS versions, cipher suites, and key exchange groups. It is configured in deployment.tls_config in the Kiali CR. You decide whether the policy comes from the cluster (OpenShift TLSSecurityProfile) or from explicit settings.

Configuration Options

Setting	Description
`source`	`auto` (OpenShift only: reads cluster TLSSecurityProfile) or `config` (use explicit settings)
`min_version`	Minimum TLS version: `TLSv1.2` or `TLSv1.3`
`max_version`	Maximum TLS version: `TLSv1.2` or `TLSv1.3`
`cipher_suites`	List of OpenSSL cipher names for TLS 1.2 (ignored for TLS 1.3)
`groups`	List of TLS group names (key exchange mechanisms) for both TLS 1.2 and 1.3

Platform Defaults

OpenShift: source defaults to auto (uses cluster’s TLSSecurityProfile)
Non-OpenShift: source defaults to config (requires explicit configuration)

On OpenShift, source: config is rejected by the Kiali Operator when the cluster TLS adherence is strict. See Cluster TLS Adherence.

Traffic Health

Mon, 01 Jan 0001 00:00:00 +0000

There are times when Kiali’s default thresholds for traffic health do not work well for a particular situation. For example, at times 404 response codes are expected. Kiali has the ability to set powerful, fine-grained overrides for health configuration.

Default Configuration

By default Kiali uses the traffic rate configuration shown below. Application errors have minimal tolerance while client errors have a higher tolerance reflecting that some level of client errors is often normal (e.g. 404 Not Found):

Virtual Machine workloads

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

Kiali graph visualizes both Virtual Machine workloads (WorkloadEntry) and pod-based workloads, running inside a Kubernetes cluster. You must ensure that the Istio Proxy is running, and correctly configured, on the Virtual Machine. Also, Prometheus must be able to scrape the metrics endpoint of the Istio Proxy running on the VM. Kiali will then be able to read the traffic telemetry for the Virtual Machine workloads, and incorporate the VM workloads into the graph.

Configuration on Kiali

Console Customization

Custom metric aggregations

Custom Dashboards

Declaring a custom dashboard

Debugging Kiali

Logs

Istio Environment

Labels and resource names

Kiali CR Reference

Example CR

Validating your Kiali CR

Properties

.spec

.spec.additional_display_details

.spec.additional_display_details[*]

.spec.additional_display_details[*].annotation

.spec.additional_display_details[*].icon_annotation

.spec.additional_display_details[*].title

.spec.ai

.spec.ai.chat

.spec.ai.chat.allowed_users

.spec.ai.chat.allowed_users[*]

.spec.ai.chat.default_provider

.spec.ai.chat.enabled

.spec.ai.chat.max_tool_iterations

.spec.ai.chat.providers

.spec.ai.chat.providers[*]

.spec.ai.chat.providers[*].config

.spec.ai.chat.providers[*].default_model

.spec.ai.chat.providers[*].description

.spec.ai.chat.providers[*].enabled

.spec.ai.chat.providers[*].endpoint

.spec.ai.chat.providers[*].insecure_skip_verify

.spec.ai.chat.providers[*].key

.spec.ai.chat.providers[*].models

.spec.ai.chat.providers[*].models[*]

.spec.ai.chat.providers[*].models[*].description

.spec.ai.chat.providers[*].models[*].enabled

.spec.ai.chat.providers[*].models[*].endpoint

.spec.ai.chat.providers[*].models[*].key

.spec.ai.chat.providers[*].models[*].model

.spec.ai.chat.providers[*].models[*].name

.spec.ai.chat.providers[*].name

.spec.ai.chat.providers[*].tools

.spec.ai.chat.providers[*].tools.disabled_tools

.spec.ai.chat.providers[*].tools.disabled_tools[*]

.spec.ai.chat.providers[*].tools.enabled_tools

.spec.ai.chat.providers[*].tools.enabled_tools[*]

.spec.ai.chat.providers[*].type

.spec.ai.chat.store_config

.spec.ai.chat.store_config.enabled

.spec.ai.chat.store_config.inactivity_timeout

.spec.ai.chat.store_config.max_cache_memory_mb

.spec.ai.chat.store_config.reduce_threshold

.spec.ai.chat.store_config.reduce_with_ai

.spec.ai.chat.tools

.spec.ai.chat.tools.disabled_tools

.spec.ai.chat.tools.disabled_tools[*]

.spec.ai.chat.tools.enabled_tools

.spec.ai.chat.tools.enabled_tools[*]

.spec.ai.consumption

.spec.ai.consumption.allowed_users_dashboard

.spec.ai.consumption.allowed_users_dashboard[*]

.spec.ai.consumption.budgets

.spec.ai.consumption.budgets[*]

.spec.ai.consumption.budgets[*].allowed_models

.spec.ai.consumption.budgets[*].allowed_models[*]

.spec.ai.consumption.budgets[*].allowed_providers

.spec.ai.consumption.budgets[*].allowed_providers[*]

.spec.ai.consumption.budgets[*].interval

.spec.ai.consumption.budgets[*].max_cost

.spec.ai.consumption.budgets[*].max_tokens

.spec.ai.consumption.budgets[*].usernames

.spec.ai.consumption.budgets[*].usernames[*]

.spec.ai.consumption.prices_config_map

.spec.ai.enabled

.spec.ai.metrics

.spec.api

.spec.api.namespaces

.spec.ai.chat.providers[].models[]

.spec.ai.chat.providers[].models[].description

.spec.ai.chat.providers[].models[].enabled

.spec.ai.chat.providers[].models[].endpoint

.spec.ai.chat.providers[].models[].key

.spec.ai.chat.providers[].models[].model

.spec.ai.chat.providers[].models[].name

.spec.ai.chat.providers[].tools.disabled_tools[]

.spec.ai.chat.providers[].tools.enabled_tools[]

.spec.ai.consumption.budgets[].allowed_models[]

.spec.ai.consumption.budgets[].allowed_providers[]

.spec.ai.consumption.budgets[].usernames[]

.spec.chat_ai.providers[].models[]

.spec.chat_ai.providers[].models[].description

.spec.chat_ai.providers[].models[].enabled

.spec.chat_ai.providers[].models[].endpoint

.spec.chat_ai.providers[].models[].key

.spec.chat_ai.providers[].models[].model

.spec.chat_ai.providers[].models[].name