The default Kiali installation (as mentioned in the Installation guide) gives Kiali access to all namespaces available in the cluster.
It is possible to restrict Kiali to a set of desired namespaces by providing a list of the ones you want, excluding the ones you don’t want, or filtering by a label selector. You can use a combination of these options.
You can configure which namespaces are accessible and observable through Kiali. You can use regex expressions which will be matched against the operator’s visible namespaces. If not set in the Kiali CR, the default makes accessible all cluster namespaces, with the exception of a predefined set of the cluster’s system workloads.
The list of accessible namespaces is specified in the Kiali CR via the
accessible_namespaces setting, under the main
deployment section. As an
example, if Kiali is to be installed in the
istio-system namespace, and is
expected to monitor all namespaces prefixed with
mycorp_, the setting would
spec: deployment: accessible_namespaces: - istio-system - mycorp_.*
Note that the namespaces declared here (including any regex expressions) are evaluated and discovered at install time. Namespaces that do not exist at the time of install but are created later in the future will not be accessible by Kiali. For Kiali to be given access to namespaces created in the future, you must edit the Kiali CR and update the
accessible_namespaces setting to include the new namespaces. The one exception is if you set
accessible_namespaces to the special value
["**"] - in that case, all namespaces (including any namespaces created in the future) will be accessible to Kiali.
This configuration accepts the special pattern
which denotes that Kiali is given access to all namespaces in the cluster, including any namespaces created in the future.
accessible_namespaces: ["**"], you must specify the
--set clusterRoleCreator=trueflag when invoking
When installing multiple Kiali instances into a single cluster,
accessible_namespaces must be mutually exclusive. In other words, a namespace
set must be matched by only one Kiali CR. Regular expressions must not have
Maistra supports multi-tenancy and the
accessible_namespaces extends that
feature to Kiali. However, explicit naming of accessible namespaces can benefit
non-Maistra installations as well - with it Kiali does not need cluster roles
and the Kiali Operator does not need permissions to create cluster roles.
The Kiali CR tells the Kiali Operator which accessible namespaces should be excluded from the list of namespaces provided by the API and UI. This can be useful if wildcards are used when specifying Accessible Namespaces. This setting has no effect on namespace accessibility. It is only a filter, not security-related.
For example, if the
accessible_namespaces configuration includes
mycorp_.* but it is not desirable to see test namespaces, the following configuration can be used:
api: namespaces: exclude: - mycorp_test.*
To fetch a subset of the available namespaces, Kiali supports an optional Kubernetes label selector. This selector is especially useful when
spec.deployment.accessible_namespaces is set to
["**"] but you want to reduce the namespaces presented in the UI’s namespace list.
The label selector is defined in the Kiali CR setting
The example below selects all namespaces that have a label
api: namespaces: label_selector: kiali-enabled=true
For further information on how this
api.namespaces.label_selector interacts with
spec.deployment.accessible_namespaces read the Kiali CR Reference documentation.
To label a namespace you can use the following command. For more information see the Kubernete’s official documentation.
kubectl label namespace my-namespace kiali-enabled=true
Note that when deploying multiple control planes in the same cluster, you will want to set the label selector’s value unique to each control plane. This allows each Kiali instance to select only the namespaces relevant to each control plane. Because in this “soft-multitenancy” mode
spec.deployment.accessible_namespaces is typically set to an explicit set of namespaces (i.e. not
["**"]), you do not have to do anything with this
label_selector. This is because the default value of
kiali.io/member-of: <spec.istio_namespace> when
spec.deployment.accessible_namespaces is not set to the “all namespaces” value
["**"]. This allows you to have multiple control planes in the same cluster, with each control plane having its own Kiali instance. If you set your own Kiali instance name in the Kiali CR (i.e. you set
spec.deployment.instance_name to something other than
kiali), then the default label will be