Prerequisites
Istio
Before you install Kiali you must have already installed Istio along with its telemetry storage addon (i.e. Prometheus). You might also consider installing Istio’s optional tracing addon (i.e. Jaeger) and optional Grafana addon but those are not required by Kiali. Refer to the Istio documentation for details.
Enable the Debug Interface
Like istioctl, Kiali makes use of Istio’s port 8080 “Debug Interface”. Despite the naming, this is required for accessing the status of the proxies
and the Istio registry.
The ENABLE_DEBUG_ON_HTTP setting controls the relevant access. Istio suggests to disable this for security, but Kiali requires ENABLE_DEBUG_ON_HTTP=true,
which is the default.
For more information, see the Istio documentation.
Version Compatibility
Each Kiali release is tested against the most recent Istio release. In general, Kiali tries to maintain compatibility with older Istio releases and Kiali versions later than those posted in the below table may work, but such combinations are not tested and will not be supported. Known incompatibilities are noted in the compatibility table below.
| Istio | Kiali Min | Kiali Max | Notes |
|---|---|---|---|
| 1.23 | 1.87.0 | ||
| 1.22 | 1.82.0 | 1.86.1 | Kiali v1.86 is the recommended minimum for Istio Ambient users. v1.22 is required starting with Kiali v1.86.1. |
| 1.21 | 1.79.0 | 1.81.0 | Kiali 1.82 - 1.86.0 may work, but v1.22 is required starting with Kiali 1.86.1. |
| 1.20 | 1.76.0 | 1.78.0 | Istio 1.20 is out of support. |
| 1.19 | 1.72.0 | 1.75.0 | Istio 1.19 is out of support. |
| 1.18 | 1.67.0 | 1.73.0 | Istio 1.18 is out of support. |
| 1.17 | 1.63.2 | 1.66.1 | Istio 1.17 is out of support. Avoid 1.63.0,1.63.1 due to a regression. |
| 1.16 | 1.59.1 | 1.63.2 | Istio 1.16 is out of support. Avoid 1.62.0,1.63.0,1.63.1 due to a regression. |
| 1.15 | 1.55.1 | 1.59.0 | Istio 1.15 is out of support. |
| 1.14 | 1.50.0 | 1.54 | Istio 1.14 is out of support. |
| 1.13 | 1.45.1 | 1.49 | Istio 1.13 is out of support. |
| 1.12 | 1.42.0 | 1.44 | Istio 1.12 is out of support. |
| 1.11 | 1.38.1 | 1.41 | Istio 1.11 is out of support. |
| 1.10 | 1.34.1 | 1.37 | Istio 1.10 is out of support. |
| 1.9 | 1.29.1 | 1.33 | Istio 1.9 is out of support. |
| 1.8 | 1.26.0 | 1.28 | Istio 1.8 removes all support for mixer/telemetry V1, as does Kiali 1.26.0. Use earlier versions of Kiali for mixer support. |
| 1.7 | 1.22.1 | 1.25 | Istio 1.7 istioctl no longer installs Kiali. Use the Istio samples/addons for quick demo installs. Istio 1.7 is out of support. |
| 1.6 | 1.18.1 | 1.21 | Istio 1.6 introduces CRD and Config changes, Kiali 1.17 is recommended for Istio < 1.6. |
Maistra Version Compatibility
| Maistra | SMCP CR | Kiali | Notes |
|---|---|---|---|
| 2.6 | 2.6 | 1.73 | Using Maistra 2.6 to install service mesh control plane 2.6 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.6 | 2.5 | 1.73 | Using Maistra 2.6 to install service mesh control plane 2.5 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.6 | 2.4 | 1.65 | Using Maistra 2.6 to install service mesh control plane 2.4 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.5 | 2.5 | 1.73 | Using Maistra 2.5 to install service mesh control plane 2.5 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.5 | 2.4 | 1.65 | Using Maistra 2.5 to install service mesh control plane 2.4 requires Kiali Operator v1.73. Other versions are not compatible. |
| 2.4 | 2.4 | 1.65 | Using Maistra 2.4 to install service mesh control plane 2.4 requires Kiali Operator v1.65. Other versions are not compatible. |
| n/a | 2.3 | n/a | Service mesh control plane 2.3 is out of support. |
| n/a | 2.2 | n/a | Service mesh control plane 2.2 is out of support. |
| n/a | 2.1 | n/a | Service mesh control plane 2.1 is out of support. |
| n/a | 2.0 | n/a | Service mesh control plane 2.0 is out of support. |
| n/a | 1.1 | n/a | Service mesh control plane 1.1 is out of support. |
| n/a | 1.0 | n/a | Service mesh control plane 1.0 is out of support. |
OpenShift Console Plugin (OSSMC) Version Compatibility
Kiali server with the same version of OSSMC plugin must be installed previously in your OpenShift cluster.
| OpenShift | OSSMC Min | OSSMC Max | Notes |
|---|---|---|---|
| 4.15+ | 1.84 | ||
| 4.12+ | 1.73 | 1.83 | All OSSMC versions from v1.73 to v1.83 are only compatible with Kiali server v1.73 |
OpenShift Service Mesh Version Compatibility
OpenShift
If you are running Red Hat OpenShift Service Mesh (OSSM), use only the bundled version of Kiali.OSSM |
Kiali |
Notes |
|---|---|---|
| 2.6 | 1.73 | Same version as 2.5 |
| 2.5 | 1.73 | |
| 2.4 | 1.65 | |
| 2.3 | 1.57 | OSSM 2.3 is out of support |
| 2.2 | 1.48 | OSSM 2.2 is out of support |
Browser Compatibility
Kiali requires a modern web browser and supports the last two versions of Chrome, Firefox, Safari or Edge.
Hardware Requirements
Any machine capable of running a Kubernetes based cluster should also be able to run Kiali.
However, Kiali tends to grow in resource usage as your cluster grows. Usually the more namespaces and workloads you have in your cluster, the more memory you will need to allocate to Kiali.
Platform-specific requirements
OpenShift
If you are installing on OpenShift, you must grant the cluster-admin role to the user that is installing Kiali. If OpenShift is installed locally on the machine you are using, the following command should log you in as user system:admin which has this cluster-admin role:
$ oc login -u system:admin
kubectl is used to interact with the cluster environment. On OpenShift you can simply replace kubectl with oc, unless otherwise noted.
Google Cloud Private Cluster
Private clusters on Google Cloud have network restrictions. Kiali needs your cluster’s firewall to allow access from the Kubernetes API to the Istio Control Plane namespace, for both the 8080 and 15000 ports.
To review the master access firewall rule:
gcloud compute firewall-rules list --filter="name~gke-${CLUSTER_NAME}-[0-9a-z]*-master"
To replace the existing rule and allow master access:
gcloud compute firewall-rules update <firewall-rule-name> --allow <previous-ports>,tcp:8080,tcp:15000