kiali-server

Kiali Server

Chainguard's redistribution of the Kiali server Helm chart, pre-configured with hardened Chainguard Images. Kiali is an observability and management console for the Istio service mesh.

Prerequisites

Kiali requires an Istio installation in the cluster. By default the chart is installed into the istio-system namespace alongside the Istio control plane.

Authentication is required. First, authenticate with Chainguard:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Ensure the namespace exists (this is a no-op if Istio already created it):

kubectl create namespace istio-system --dry-run=client -o yaml | kubectl apply -f -

Create an image pull secret:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace istio-system

Installation

helm install kiali-server oci://cgr.dev/ORGANIZATION/charts/kiali-server \
  --namespace istio-system \
  --set deployment.image_pull_secrets[0]=cgr-pull-secret

A FIPS variant that deploys the kiali-fips image is published to the same chart repository with a -fips version suffix:

helm install kiali-server oci://cgr.dev/ORGANIZATION/charts/kiali-server \
  --version 2.33.0-fips \
  --namespace istio-system \
  --set deployment.image_pull_secrets[0]=cgr-pull-secret

Once the pod is ready, access the Kiali console with:

kubectl port-forward -n istio-system svc/kiali 20001:20001

Then open http://localhost:20001 in your browser.

About This Chart

This is a redistribution of the upstream Kiali server Helm chart. All upstream configuration options apply.

For full documentation, see: https://kiali.io/docs/installation/installation-guide/