Prerequisites
Istio
Before you install Kiali you must have already installed Istio along with its telemetry storage addon (e.g. Prometheus). You might also consider installing Istio’s optional tracing addon (e.g. Tempo) and optional Grafana addon but those are not required by Kiali. Refer to the Istio documentation for details.
Optionally Enable the Debug Interface
Like istioctl, Kiali can make use of Istio’s port 8080 “Debug Interface” API. Despite the naming, this is required for accessing the status of the proxies
and the Istio registry.
The ENABLE_DEBUG_ON_HTTP setting controls the relevant API access. Istio suggests to disable this for security, but Kiali requires ENABLE_DEBUG_ON_HTTP=true,
which is the default.
If you prefer not to enable the Istio API then certain Kiali features will be unavailable. If disabled, set spec.external_services.istio.istio_api_enabled: false in the Kiali CR.
For more information, see the Istio documentation.
Version Compatibility
Starting with Kiali v2.4, each Kiali release is tested against the currently supported Istio releases. Unless otherwise noted, a Kiali release will be compatible with those releases. Older, untested Istio versions may also be compatible. Known incompatibilities will be noted in the table below. Prior to Kiali v2.4, compatibility is guaranteed only against the latest Istio release at the time. Although compatibility may be fine with other versions.
| Istio | Tested Kiali Versions | Notes |
|---|---|---|
| 1.24 | 2.0 and higher | |
| 1.23 | 1.87 to 2.0, 2.4 | Kiali v2 requires Kiali v1 non-default namespace management (i.e. accessible_namespaces) to migrate to Discovery Selectors. |
| 1.22 | 1.82 to 1.86, 2.4 | Kiali v1.86 is the recommended minimum for Istio Ambient users. Starting with Kiali v1.86,.1 Istio v1.22 is required. |
| 1.21 | 1.81 | Istio 1.21 is out of support. |
| 1.20 | 1.78 | Istio 1.20 is out of support. |
| 1.19 | 1.75 | Istio 1.19 is out of support. |
| 1.18 | 1.73 | Istio 1.18 is out of support. |
| 1.17 | 1.66 | Istio 1.17 is out of support. Avoid 1.63.0,1.63.1 due to a regression. |
| 1.16 | 1.63 | Istio 1.16 is out of support. Avoid 1.62.0,1.63.0,1.63.1 due to a regression. |
| 1.15 | 1.59 | Istio 1.15 is out of support. |
| 1.14 | 1.54 | Istio 1.14 is out of support. |
| 1.13 | 1.49 | Istio 1.13 is out of support. |
| 1.12 | 1.44 | Istio 1.12 is out of support. |
| 1.11 | 1.41 | Istio 1.11 is out of support. |
| 1.10 | 1.37 | Istio 1.10 is out of support. |
| 1.9 | 1.33 | Istio 1.9 is out of support. |
| 1.8 | 1.28 | Istio 1.8 is out of support. It removes all support for mixer/telemetry V1, as does Kiali 1.26.0. Use earlier versions of Kiali for mixer. |
| 1.7 | 1.25 | Istio 1.7 is out of support. Istioctl no longer installs Kiali. Use the Istio samples/addons for quick demo installs. |
| 1.6 | 1.21 | Istio 1.6 is out of support. Kiali 1.17 is recommended for Istio < 1.6. |
Maistra Version Compatibility
| Maistra | SMCP CR | Kiali | Notes |
|---|---|---|---|
| 2.6 | 2.6 | 1.73 | Using Maistra 2.6 to install service mesh control plane 2.6 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.6 | 2.5 | 1.73 | Using Maistra 2.6 to install service mesh control plane 2.5 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.6 | 2.4 | 1.65 | Using Maistra 2.6 to install service mesh control plane 2.4 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.5 | 2.5 | 1.73 | Using Maistra 2.5 to install service mesh control plane 2.5 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.5 | 2.4 | 1.65 | Using Maistra 2.5 to install service mesh control plane 2.4 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.4 | 2.4 | 1.65 | Using Maistra 2.4 to install service mesh control plane 2.4 requires Kiali Operator v1.65. Other versions are not compatible. |
| n/a | 2.3 | n/a | Service mesh control plane 2.3 is out of support. |
| n/a | 2.2 | n/a | Service mesh control plane 2.2 is out of support. |
| n/a | 2.1 | n/a | Service mesh control plane 2.1 is out of support. |
| n/a | 2.0 | n/a | Service mesh control plane 2.0 is out of support. |
| n/a | 1.1 | n/a | Service mesh control plane 1.1 is out of support. |
| n/a | 1.0 | n/a | Service mesh control plane 1.0 is out of support. |
OpenShift Console Plugin (OSSMC) Version Compatibility
Kiali server with the same version of OSSMC plugin must be installed previously in your OpenShift cluster.
| OpenShift | OSSMC Min | OSSMC Max | Notes |
|---|---|---|---|
| 4.15+ | 1.84 | ||
| 4.12+ | 1.73 | 1.83 | All OSSMC versions from v1.73 to v1.83 are only compatible with Kiali server v1.73 |
OpenShift Service Mesh Version Compatibility
OpenShift
If you are running Red Hat OpenShift Service Mesh (OSSM), use only the bundled version of Kiali.OSSM |
Kiali |
Notes |
|---|---|---|
| 2.6 | 1.73 | Same version as 2.5 |
| 2.5 | 1.73 | |
| 2.4 | 1.65 | |
| 2.3 | 1.57 | OSSM 2.3 is out of support |
| 2.2 | 1.48 | OSSM 2.2 is out of support |
Browser Compatibility
Kiali requires a modern web browser and supports the last two versions of Chrome, Firefox, Safari or Edge.
Hardware Requirements
Any machine capable of running a Kubernetes based cluster should also be able to run Kiali.
However, Kiali tends to grow in resource usage as your cluster grows. Usually the more namespaces and workloads you have in your cluster, the more memory you will need to allocate to Kiali.
Platform-specific requirements
OpenShift
If you are installing on OpenShift, you must grant the cluster-admin role to the user that is installing Kiali. If OpenShift is installed locally on the machine you are using, the following command should log you in as user system:admin which has this cluster-admin role:
$ oc login -u system:admin
kubectl is used to interact with the cluster environment. On OpenShift you can simply replace kubectl with oc, unless otherwise noted.
Google Cloud Private Cluster
Private clusters on Google Cloud have network restrictions. Kiali needs your cluster’s firewall to allow access from the Kubernetes API to the Istio Control Plane namespace, for both the 8080 and 15000 ports.
To review the master access firewall rule:
gcloud compute firewall-rules list --filter="name~gke-${CLUSTER_NAME}-[0-9a-z]*-master"
To replace the existing rule and allow master access:
gcloud compute firewall-rules update <firewall-rule-name> --allow <previous-ports>,tcp:8080,tcp:15000