Kiali

Kiali is the Big Bang service-mesh observability console. This package wraps the Kiali Operator Helm chart v2.32.0 and creates the managed Kiali custom resource. For Kiali product concepts, configuration, RBAC, and operational guidance, use the upstream Kiali documentation.

Big Bang integration

The umbrella enables Kiali with packages.kiali for packageConfiguration.version: v1; the compatible legacy key is kiali. It creates the Kiali namespace, source and Helm release, maps platform settings into this chart, and reconciles Kiali after enabled Istio releases and Monitoring. The umbrella’s selected package source is 2.32.0-bb.0.

The package deploys the Kiali operator and a Kiali custom resource. Its defaults use Iron Bank Kiali and operator images, a hardened security context, and Kiali resources requesting 100m CPU and 128Mi memory with a 1Gi memory limit. The operator and Kiali CR values are passed through the upstream parent; see the locked upstream chart values and Kiali custom-resource reference for the complete upstream configuration surface.

Observability services

When the corresponding umbrella packages are enabled, the umbrella configures Kiali to use Prometheus, Grafana, and Tempo at their in-cluster service addresses. It also configures Grafana as the external UI for Grafana and Tempo links. Prometheus is Kiali’s metrics backend; Grafana and Tempo integrations are conditional on those packages being enabled.

The umbrella creates Kiali’s grafana-auth Secret when Grafana is enabled and supplies the Grafana password reference to Kiali. Configure Grafana credentials through the Grafana package and umbrella values; do not place credentials in a Kiali values file. If a different observability backend is required, override the Kiali CR through packages.kiali.values.upstream (or legacy kiali.values.upstream) using the upstream references above.

Access and authentication

kiali.<domain> is the default public route. The umbrella selects the Istio gateway through packages.kiali.ingress.gateway and supplies the domain and route settings to this chart. The package uses bb-common to render the route, Istio resources, and network policies.

Set packages.kiali.sso.enabled to use the umbrella’s OpenID configuration, and provide the package client ID and secret through the normal umbrella secret workflow. With SSO enabled, the umbrella supplies the issuer, client ID, OpenID scopes, and, when configured, the OIDC certificate authority required by Kiali. It also creates the Kiali client-secret and CA resources. For upstream OpenID options, see Kiali OpenID authentication.

For an existing platform IdP, these umbrella values show the package-level SSO inputs separately from the global issuer:

packageConfiguration:
  version: v1
sso:
  url: https://sso.example.com/realms/platform
packages:
  kiali:
    enabled: true
    sso:
      enabled: true
      client_id: kiali

Supply packages.kiali.sso.client_secret through protected umbrella values; this non-secret fragment is not sufficient by itself. It selects the umbrella’s OpenID mapping, not a raw values.upstream auth override. Replace the issuer and client ID and register the exact callback for the configured external Kiali URL according to upstream OpenID guidance. A private IdP CA must also be supplied through the umbrella CA contract. The global issuer affects other SSO-enabled packages, so keep it aligned with the platform rather than changing it only for Kiali. Review authorization: the current umbrella OpenID mapping sets disable_rbac: true; successful login does not establish per-user Kubernetes RBAC isolation. Test both allowed and denied access for the chosen access model.

Without SSO, the umbrella configures Kiali’s token authentication strategy. See Token login for the supported command to create a service-account token. Kubernetes RBAC determines what a token-authenticated user can view; consult the upstream RBAC documentation when designing access.

Mesh, policy, and platform behavior

The umbrella supplies Istio namespace and workload annotations when Istio is enabled. The chart’s default PeerAuthentication is strict mTLS, and bb-common renders optional sidecar, route, authorization-policy, and network-policy resources from its chart values. Ambient-mode selection, cross-package reachability, and umbrella policy exceptions are umbrella orchestration concerns; validate them with the standard and ambient package scenarios before changing related values.

The operator needs Kubernetes RBAC to manage the Kiali custom resource and the Kiali deployment. On OpenShift, this package additionally renders the anyuid SCC ClusterRoleBinding when the platform input is enabled. Do not alter service-account, RBAC, or policy settings solely to match documentation; test such changes against the package and umbrella integration.

Testing and maintenance

The repository includes standard, ambient, and SSO selection files under tests/; deployed package CI is the authoritative evidence for interactions with Istio, Monitoring, Grafana, Tempo, and SSO. Run helm lint chart for a local chart check. The maintainer workflow is intentionally documented separately in docs/DEVELOPMENT_MAINTENANCE.md.