Kiali releases 1.25 to 1.28 — Trace heat maps, enhanced health insights, multi-arch images and more…
By: Edgar Hernandez
Tags: Kubernetes, Openshift, Service Mesh, Kiali, Istio

With the new look:

Design is unified to the other list pages. As part of it, column sorting capabilities were added.

Icons are removed. This was the last Kiali screen to move from icons to letter badges to denote a Workload, Application or Service.

List is flat rather than in a tree. The tree had proven to be confusing and so we are preferring a flat list.

For reference, this is how this page looked in the past:

RBAC can be disabled in OpenID authentication

Kiali’s OpenID authentication strategy required to have a Kubernetes cluster with a tight integration with the OpenID provider, but this setup isn’t available in some cloud providers. Kiali required this constraint to make use of the cluster’s RBAC capabilities. However, we got the feedback that some people are OK with the shared privileges in Kiali when using OpenID authentication. Because of this feedback, we added support in Kiali to be able to turn off RBAC in the OpenID authentication. When RBAC is turned off it’s possible to use OpenID authentication even if your Kubernetes cluster is not integrated with your identity provider.

The Kiali docs are already updated and covering this scenario. Please, read them to learn how to setup Kiali with OpenID authentication and shared privileges (RBAC off).

Support for HTTP proxies for OpenID authentication strategy

This is yet another improvement for the OpenID authentication strategy, because of (again) more user feedback.

It turns out that some people setup their Kubernetes clusters without direct Internet access. An HTTP/HTTPS proxy is used as a gateway to the Internet. Clearly, workloads must be configured to use the proxy to reach the outside Internet. Then, depending on your needs, you may be using an external OpenID provider (like Google, Auth0, AzureAD, etc).

As Kiali was missing the needed configurations to make use of an HTTP/HTTPS proxy when needed, it wasn’t possible to use external OpenID providers without direct Internet access. But this is no longer the case. Starting Kiali v1.28, the required settings have been added. Read the short section in the website describing how to configure your proxy.

New validation for Istio’s DestinationRule CRD

Usually, in previous posts there are a few new Istio CRD validations to mention. This time, there is only one new validation:

KIA0209 — DestinationRule Subset has not labels

As always, check the docs at the website for the full description of the validation.

For new Kiali users, now is a good time to point out that validations are shown in the Istio Config list:

You can also find the validations being raised in the YAML editor when you are inspecting a specific CRD instance. The editor will highlight the offending line:

There is also an indicator in the Overview page:

Finally, at the bottom of the Workload and Service details pages, there is an Istio Config tab that will show a warning in case of any validation issue:

Dropped support for Mixer telemetry

Mixer telemetry, a.k.a. telemetry v1, was removed in Istio 1.8. Kiali followed up and support for Mixer telemetry was removed in version 1.26.

Mixer-less telemetry, a.k.a telemetry v2, became the default configuration in Istio 1.5. By then, Kiali v1.17 included support for both the new and the deprecated telemetries and this support stayed in place until Kiali v1.26.

Because of all the removals, Istio 1.8 is the recommended minimum for Kiali v1.26, which may work for earlier Istio versions (without any warranty) but certainly won’t work with Istio versions prior to 1.5 because of the absence of telemetry v2.

This is properly documented in detail in our website in the version compatibility table.

Extended information about a pod status

When you are at the details page of a workload, at the bottom you have the list of pods supporting the workload. In that list, there is a Phase column that has been there for a while. That column is now showing extended information about the pod status and/or phase: