Wizards

Kiali is more than observability, it also helps you to configure, update and validate your Istio service mesh.

Istio Wizards

Kiali provides actions to create, update and delete Istio configuration, driven by wizards.

Actions can be applied to a Service

Actions can also be applied to a Workload

Also, actions are available for an entire Namespace

Service Actions

Traffic Management: Request Routing

The Request Routing Wizard allows creating multiple routing rules.

• Every rule is composed of a Request Matching and a Routes To section.
• The Request Matching section can add multiple filters using HEADERS, URI, SCHEME, METHOD or AUTHORITY Http parameters.
• The Request Matching section can be empty, in this case any http request received is matched against this rule.
• The Routes To section can specify the percentage of traffic that is routed to a specific workload.

Istio applies routing rules in order, meaning that the first rule matching an HTTP request performs the routing. The Matching Routing Wizard allows changing the rule order.

Traffic Management: Fault Injection

The Fault Injection Wizard allows injecting faults to test the resiliency of a Service.

• HTTP Delay specification is used to inject latency into the request forwarding path.
• HTTP Abort specification is used to prematurely abort a request with a pre-specified error code.

Traffic Management: Traffic Shifting

The Traffic Shifting Wizard allows selecting the percentage of traffic that is routed to a specific workload.

Traffic Management: Request Timeouts

The Request Timeouts Wizard sets up request timeouts in Envoy, using Istio.

• HTTP Timeout defines the timeout for a request.
• HTTP Retry describes the retry policy to use when an HTTP request fails.

Traffic Management: Gateways

Traffic Management Wizards have an Advanced Options section that can be used to extend the scenario.

One available Advanced Option is to expose a Service to external traffic through an existing Gateway or to create a new Gateway for this Service.

Traffic Management: Circuit Breaker

Traffic Management Wizards allows defining Circuit Breakers on Services as part of the available Advanced Options.

• Connection Pool defines the connection limits for an upstream host.
• Outlier Detection implements the Circuit Breaker based on the consecutive errors reported.

Security: Traffic Policy

Traffic Management Advanced Options allows defining Security and Load Balancing settings.

• TLS related settings for connections to the upstream service.
• Automatically generate a PeerAuthentication resource for this Service.
• Load balancing policies to apply for a specific destination.

Workload Actions

Automatic Sidecar Injection

A Workload can be individually annotated to control the Sidecar Injection.

A default scenario is to indicate this at Namespace level but there can be cases where a Workload shouldn’t be part of the Mesh or vice versa.

Kiali allows users to annotate the Deployment template and propagate this configuration into the Pods.

Namespace Actions

The Kiali Overview page offers several Namespace actions, in any of its views: Expanded, Compacted or Table.

Show

Show actions navigate from a Namespace to its specific Graph, Applications, Workloads, Services or Istio Config pages.

Automatic Sidecar Injection

When Automatic Sidecar Injection is enabled in the cluster, a Namespace can be labeled to enable/disable the injection webhook, controlling whether new deployments will automatically have a sidecar.

Canary Istio upgrade

When Istio Canary revision is installed, a Namespace can be labeled to that canary revision, so the sidecar of canary revision will be injected into workloads of the namespace.

Security: Traffic Policies

Kiali can generate Traffic Policies based on the traffic for a namespace.

For example, at some point a namespace presents a traffic graph like this:

And a user may want to add Traffic Policies to secure that communication. In other words, to prevent traffic other than that currently reflected in the Graph’s Services and Workloads.

Using the Create Traffic Policies action on a namespace, Kiali will generate AuthorizationPolicy resources per every Workload in the Namespace.