---
title: "Features"
aliases:
- /features/
- /documentation/v1.28/overview/
date: 2018-06-20T19:04:38+02:00
draft: false
type: "features"
weight: 1
---

:sectlinks:
:linkattrs:
:toc: macro
:toc-title: Kiali Features
:toclevels: 4
:keywords: Kiali Features
:icons: font
:imagesdir: /images/documentation/features/

Kiali helps you define, validate, and observe the connections and microservices of your Istio service mesh.

Kiali works with Istio in Kubernetes distributions. It visualizes the service mesh topology and provides visibility into features like request routing, circuit breakers, request rates, latency and more. Kiali offers insights about the mesh components at different levels, from abstract Applications to Services and Workloads.

Kiali also helps to manage the Service Mesh providing Wizards to apply common traffic patterns and automatically generate Istio configuration.

toc::[]

== Observability Features

The following observability features help you ensure your mesh is healthy or to quickly identify problem areas in operation. It combines topology, telemetry, traces, logs, events and definitions in a holistic view of your system.

=== Overview

Kiali provides a summary page of the Service Mesh namespaces and the status of their Applications, Workloads and Services.

++++
<a class="image-popup-fit-height" href="/images/documentation/features/overview-v1.22.0.png" title="Visualize your service mesh topology">
    <img src="/images/documentation/features/overview-thumb-v1.22.0.png" style="display:block;margin: 0 auto;" />
</a>
++++

=== Graph
The graph provides a powerful way to visualize the topology of your service mesh. It shows you which services communicate with each other and the traffic rates and latencies between them, which helps you visually identify problem areas and quickly pinpoint issues. Kiali provides graphs that show a high-level view of service interactions, a low level view of workloads, or a logical view of applications.

The graph also shows which services are configured with virtual services and circuit breakers. It identifies security issues by identifying traffic not configured as expected. You can observe the traffic flow between components by watching the animation or viewing the metrics.

You can configure the graph to show the namespaces and data that are important to you, and display it in the way that best meets your needs.
++++
<a class="image-popup-fit-height" href="/images/documentation/features/graph-overview-v1.22.0.png" title="Visualize your service mesh topology">
    <img src="/images/documentation/features/graph-overview-thumb-v1.22.0.png" style="display:block;margin: 0 auto;" />
</a>
++++

{empty} +

==== Graph: Health
Colors in the graph represent the health of your service mesh. A node colored red or orange might need attention. The color of an edge between components represents the health of the requests between those components. The node shape indicates the type of component such as services, workloads, or apps.

The health of nodes and edges is refreshed automatically based on the user's preference. The graph can also be paused to examine a particular state, or replayed to re-examine a particular time period.
++++
<a class="image-popup-fit-height" href="/images/documentation/features/graph-health-v1.22.0.png" title="Visualize the health of your mesh">
    <img src="/images/documentation/features/graph-health-thumb-v1.22.0.png" style="display:block;margin: 0 auto;" />
</a>
++++

{empty} +

==== Graph: Node Detail
You can drill down into one selected component, whether it's a service, a workload, or an application. Kiali offers detail graphs for any node you choose.

Double click on a graph node and you can see a detailed view centered on that component. It shows you only the incoming requests being served and the outgoing requests being made - all from the point-of-view of that component's telemetry.

You can jump back to the main graph and continue where you left off.
++++
<a class="image-popup-fit-height" href="/images/documentation/features/graph-detailed-v1.22.0.png" title="Focus your graph on a selected component">
    <img src="/images/documentation/features/graph-detailed-thumb-v1.22.0.png" style="display:block;margin: 0 auto;" />
</a>
++++

{empty} +

==== Graph: Side-Panel
Want to get a quick summary of anything in the graph? Select any node with a single-click and the side panel provides a brief summary for that component. This includes:

* **Charts** showing traffic and response times
* **Health** details
* **Links** to fully-detailed pages
* **Response Code** breakdowns.

Or, click the graph background and the side panel to view an overall summary for the entire graph.
++++
<a class="image-popup-fit-height" href="/images/documentation/features/graph-side-panel-v1.22.0.png" title="Quick summary of a selected component">
    <img src="/images/documentation/features/graph-side-panel-thumb-v1.22.0.png" style="display:block;margin: 0 auto;" />
</a>
++++

{empty} +

==== Graph: Traffic Animation
Kiali offers several display options for the graph, including traffic animation.

For HTTP traffic, circles represent successful requests while red diamonds represent errors. The more dense the circles and diamonds the higher the request rate. The faster the animation the faster the response times.

TCP traffic is represented by offset circles where the speed of the circles indicates the traffic speed.
++++
<a class="video-popup" href="/images/documentation/features/kiali_traffic_animation-v1.22.0.mp4" title="Visualize your traffic flow">
    <video autoplay muted loop width="1333px" src="/images/documentation/features/kiali_traffic_animation_thumb-v1.22.0.mp4" style="display:block;margin:0 auto;" />
</a>
++++

{empty} +

==== Graph: Graph Types
Kiali offers four different graph renderings of the mesh telemetry. Each graph type provides a different view of the traffic.

* The **workload** graph provides the a detailed view of communication between workloads.

* The **app** graph aggregates the workloads with the same app labeling, which provides a more logical view.

* The **versioned app** graph aggregates by app, but breaks out the different versions providing traffic breakdowns that are version-specific.

* The **service** graph provides a high-level view, which aggregates all traffic for defined services.
++++
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/graph-type-app-v1.22.0.png" title="Visualize Apps">
          <img src="/images/documentation/features/graph-type-app-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
      <a class="image-popup-fit-height" href="/images/documentation/features/graph-type-service-v1.22.0.png" title="Visualize Services">
          <img src="/images/documentation/features/graph-type-service-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/graph-type-version-app-v1.22.0.png" title="Visualize Versioned Apps">
          <img src="/images/documentation/features/graph-type-version-app-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
      <a class="image-popup-fit-height" href="/images/documentation/features/graph-type-workload-v1.22.0.png" title="Visualize Workloads">
          <img src="/images/documentation/features/graph-type-workload-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
++++

{empty} +

==== Graph: Replay

Graph replay is a new feature that lets you examine the past state of your service mesh.

++++
<div id="replay-video" style="display:flex;align-items: center; justify-items: center;">
  <iframe
    width="1333"
    height="704"
    style="display:block;margin:0 auto;"
    src="https://www.youtube.com/embed/CC_dl4zSZiU"
    frameborder="0"
    allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture"
    allowfullscreen>
  </iframe>
</div>
++++

{empty} +

==== Graph: Operation Nodes
Istio v1.6 introduced https://istio.io/latest/docs/tasks/observability/metrics/classify-metrics/[Request Classification, window=_blank].  This powerful feature allows users to classify requests into aggregates, called "Operations" by convention, to better understand how a service is being used.  If configured in Istio the Kiali graph can show these as Operation nodes.  The user needs only to enable the "Operation Nodes" display option. Operations can span services, for example, "VIP" may be configured for both CarRental and HotelRental services.  To see total "VIP" traffic then display operation nodes without service nodes.  To see "VIP" traffic specific to each service then also enable the "Service Nodes" display option.

When selected, an Operation node also provides a side-panel view.  And when double-clicked a node detail graph is also provided.

Because operation nodes represent aggregate traffic they are not compatible with Service graphs, which themselves are already logical aggregates. For similar reasons response time information is not available on edges leading into or out of operation nodes.  But by selecting the edge the response time information is available in the side panel (if configured).

Operation nodes are represented as pentagons in the Kiali graph:
++++
<a class="image-popup-fit-height" href="/images/documentation/features/graph-operations-v1.22.0.png" title="Operation Nodes">
    <img src="/images/documentation/features/graph-operations-v1.22.0.png" style="width: 1333px; display:block;margin: 0 auto;" />
</a>
++++

{empty} +

=== Detail Views
Kiali provides filtered list views of all your service mesh definitions. Each view provides health, details, YAML definitions and links to help you visualize your mesh. There are list and detail views for:

* Services
* Applications
* Workloads
* Istio Configuration
++++
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/app-list-v1.22.0.png" title="List Apps">
          <img src="/images/documentation/features/app-list-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
      <a class="image-popup-fit-height" href="/images/documentation/features/workload-list-v1.22.0.png" title="List Workloads">
          <img src="/images/documentation/features/workload-list-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/service-list-v1.22.0.png" title="List Services">
          <img src="/images/documentation/features/service-list-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
      <a class="image-popup-fit-height" href="/images/documentation/features/istio-list-v1.22.0.png" title="List Istio Config">
          <img src="/images/documentation/features/istio-list-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
++++

{empty} +

==== Detail: Overview

The overview tab provides detail information, sparkline graph and health overview for a specific Application, Workload or Service.

For each type of element, Kiali adds additional features.

In the Workload Overview, Kiali performs several validations on workload configuration:

* Are Istio sidecars deployed?

* Are proper *app* and *version* labels assigned?

Workload detail show you the services for which the workload in handling request the pods backing them.

The Service Overview shows the user the workloads running the service. It also shows the Istio traffic routing configuration, VirtualServices and DestinationRules, associated with the service.

Kiali provides access to YAML definitions and allows modification and deletion access for authorized users. It provides wizards to assist in common configurations and performs additional validation on VirtualServices to detect misconfigured routes.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/overview-app-v1.22.0.png" title="App Overview">
    <img src="/images/documentation/features/overview-app-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
  </a>
  <a class="image-popup-fit-height" href="/images/documentation/features/overview-workload-v1.22.0.png" title="Workload Overview">
    <img src="/images/documentation/features/overview-workload-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
  </a>
</span>
</div>
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/overview-service-v1.22.0.png" title="Service Overview">
    <img src="/images/documentation/features/overview-service-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

{empty} +

==== Detail: Traffic

The traffic tab collects all connections from and to a specific Application, Workload and/or Service.

It groups them in Inbound and Outbound tables providing traffic details and links to specific detailed metrics.

++++
 <a class="image-popup-fit-height" href="/images/documentation/features/traffic-v1.22.0.png" title="Traffic tab">
  <img src="/images/documentation/features/traffic-thumb-v1.22.0.png" style="display:block;margin: 0 auto;" />
 </a>
++++

{empty} +

==== Detail: Logs

The Workload detail offer a special Logs tab. Kiali allows side-by-side viewing of both the application and the proxy logs of a selected pod.

The logs tab adds additional filtering capabilities to show or hide specific lines.

++++
 <a class="image-popup-fit-height" href="/images/documentation/features/logs-v1.22.0.png" title="Logs tab">
  <img src="/images/documentation/features/logs-thumb-v1.22.0.png" style="display:block;margin: 0 auto;" />
 </a>
++++

{empty} +

==== Detail: Metrics
Each detail view provides predefined metric dashboards. The metric dashboards provided are tailored to the relevant application, workload or service level.

Application and workload detail views show request and response metrics such as volume, duration, size, or tcp traffic. The traffic can also be viewed for either inbound or outbound traffic.

The service detail view shows request and response metrics for inbound traffic.
++++
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/metrics-inbound-v1.22.0.png" title="Inbound Metrics">
          <img src="/images/documentation/features/metrics-inbound-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
      <a class="image-popup-fit-height" href="/images/documentation/features/metrics-outbound-v1.22.0.png" title="Outbound Metrics">
          <img src="/images/documentation/features/metrics-outbound-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
++++

{empty} +

==== Detail: Custom Dashboards
Kiali comes with default dashboards for several runtimes, including Go, Node.js, Spring Boot, Thorntail, and Vert.x.

These dashboards are simple Kubernetes resources, so you can use your favorite tool to create, modify or delete them.
As they are defined as plain YAML or JSON files, so it's easy to keep them in source control like Git, track their changes, and share them.

Check out the link:/documentation/v1.28/runtimes-monitoring/[documentation page, window=_blank] to learn more about it.
++++
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/metrics-dashboards-jvm-v1.22.0.png" title="Custom JVM Metrics">
          <img src="/images/documentation/features/metrics-dashboards-jvm-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
      <a class="image-popup-fit-height" href="/images/documentation/features/metrics-dashboards-vertx-v1.22.0.png" title="Custom Vertx Metrics">
          <img src="/images/documentation/features/metrics-dashboards-vertx-thumb-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
++++

{empty} +

==== Detail: Traces

Kiali has now a Span duration legend item on Service Metrics tab, when enabled, correlates Span and Metrics on the same chart.

++++
<a class="image-popup-fit-height" href="/images/documentation/features/traces-metrics-v1.22.0.png" title="Metrics and Trace Spans">
    <img src="/images/documentation/features/traces-metrics-thumb-v1.22.0.png" style="display: block; margin: 0 auto;" />
</a>
++++

User can navigate to the traces tab to browse filtered traces for a given service in the time interval or to show details for a single trace.

The tracing toolbar offers some control over the data to fetch, to facilitate the user experience. In the tracing view, as shown in the image below, it’s possible to select the traces interval, results limit, status code, errors, adjust time (expand results on time), last Xm traffic (Traces from last minutes) and refresh interval.

After selecting a trace, Kiali shows the information related to that trace like number of spans, spans grouped by operation name, duration, date.

++++
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/traces-view-v1.22.0.png" title="Traces Timeline for a Service">
          <img src="/images/documentation/features/traces-view-thumb-v1.22.0.png" style="width: 660px;display:inline;margin: 0 auto;" />
      </a>
      <a class="image-popup-fit-height" href="/images/documentation/features/traces-view-details-v1.22.0.png" title="Trace Details">
          <img src="/images/documentation/features/traces-view-details-thumb-v1.22.0.png" style="width: 660px;display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
++++

{empty} +

== Configuration and Validation Features

Kiali is more than observability, it also helps you to configure, update and validate your Istio service mesh.


=== Istio Configuration
The Istio configuration view provides advanced filtering and navigation for Istio configuration objects such as Virtual Services and Gateways.
Kiali provides inline config edition and powerful semantic validation for Istio resources.
++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/config-list-v1.22.0.png" title="Istio Config List">
   <img src="/images/documentation/features/config-list-v1.22.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

=== Validations
Kiali performs a set of validations to the most common Istio Objects such as Destination Rules, Service Entries, and Virtual Services. Those validations are done in addition to the existing ones performed by Istio's Galley component. Most validations are done inside a single namespace only, any exceptions, such as gateways, are properly documented.

Galley validations are mostly syntactic validations based on the object syntax analysis of Istio objects while Kiali validations are mostly semantic validations between different Istio objects. Kiali validations are based on the runtime status of your service mesh, Galley validations are static ones and doesn't take into account what is configured in the mesh.

Check the complete link:/documentation/v1.28/validations/[list of validations] for further information.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/config-validation-v1.22.0.png" title="Istio Config Validation">
   <img src="/images/documentation/features/config-validation-v1.22.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

=== Istio Wizards
Kiali provides actions to create, update and delete Istio configuration, driven by wizards.

Actions can be applied to a *Service*

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/service-actions-v1.24.0.png" title="Service Details Actions">
   <img src="/images/documentation/features/service-actions-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

{empty} +

Actions can also be applied to a *Workload*

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/workload-actions-v1.24.0.png" title="Workload Details Actions">
   <img src="/images/documentation/features/workload-actions-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

{empty} +

Also, actions are available for an entire *Namespace*

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/overview-actions-v1.24.0.png" title="Namespace Actions">
   <img src="/images/documentation/features/overview-actions-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

=== Service Actions

==== Traffic Management: Request Routing

The Request Routing Wizard allows creating multiple routing rules.

* Every rule is composed of a Request Matching and a Routes To section.
* The Request Matching section can add multiple filters using HEADERS, URI, SCHEME, METHOD or AUTHORITY Http parameters.
* The Request Matching section can be empty, in this case any http request received is matched against this rule.
* The Routes To section can specify the percentage of traffic that is routed to a specific workload.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/wizard-request-routing-v1.24.0.png" title="Request Routing">
   <img src="/images/documentation/features/wizard-request-routing-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

Istio applies routing rules in order, meaning that the first rule matching an HTTP request performs the routing. The Matching Routing Wizard allows changing the rule order.

==== Traffic Management: Fault Injection

The Fault Injection Wizard allows injecting faults to test the resiliency of a Service.

* HTTP Delay specification is used to inject latency into the request forwarding path.
* HTTP Abort specification is used to prematurely abort a request with a pre-specified error code.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/wizard-fault-injection-v1.24.0.png" title="Fault Injection">
   <img src="/images/documentation/features/wizard-fault-injection-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

==== Traffic Management: Traffic Shifting

The Traffic Shifting Wizard allows selecting the percentage of traffic that is routed to a specific workload.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/wizard-traffic-shifting-v1.24.0.png" title="Traffic Shifting">
   <img src="/images/documentation/features/wizard-traffic-shifting-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

==== Traffic Management: Request Timeouts

The Request Timeouts Wizard sets up request timeouts in Envoy, using Istio.

* HTTP Timeout defines the timeout for a request.
* HTTP Retry describes the retry policy to use when an HTTP request fails.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/wizard-request-timeouts-v1.24.0.png" title="Request Timeouts">
   <img src="/images/documentation/features/wizard-request-timeouts-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

==== Traffic Management: Gateways

Traffic Management Wizards have an Advanced Options section that can be used to extend the scenario.

One available Advanced Option is to expose a Service to external traffic through an existing Gateway or to create a new Gateway for this Service.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/wizard-advanced-options-gateways-v1.24.0.png" title="Request Timeouts">
   <img src="/images/documentation/features/wizard-advanced-options-gateways-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

==== Traffic Management: Circuit Breaker

Traffic Management Wizards allows defining Circuit Breakers on Services as part of the available Advanced Options.

* Connection Pool defines the connection limits for an upstream host.
* Outlier Detection implements the Circuit Breaker based on the consecutive errors reported.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/wizard-advanced-options-gateways-v1.24.0.png" title="Circuit Breakers">
   <img src="/images/documentation/features/wizard-advanced-options-gateways-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

==== Security: Traffic Policy

Traffic Management Advanced Options allows defining Security and Load Balancing settings.

* TLS related settings for connections to the upstream service.
* Automatically generate a PeerAuthentication resource for this Service.
* Load balancing policies to apply for a specific destination.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/wizard-advanced-options-traffic-policy-v1.24.0.png" title="Traffic Policy">
   <img src="/images/documentation/features/wizard-advanced-options-traffic-policy-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

=== Workload Actions

==== Automatic Sidecar Injection

A *Workload* can be individually annotated to control the Sidecar Injection.

A default scenario is to indicate this at *Namespace* level but there can be cases where a *Workload* shouldn't be part of the Mesh or vice versa.

Kiali allows users to annotate the Deployment template and propagate this configuration into the Pods.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/workload-actions-sidecar-injection-v1.24.0.png" title="Automatic Sidecar Injection">
   <img src="/images/documentation/features/workload-actions-sidecar-injection-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

=== Namespace Actions

The Kiali Overview page offers several *Namespace* actions, in any of its views: Expanded, Compacted or Table.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/overview-table-actions-v1.24.0.png" title="Namespace Actions">
   <img src="/images/documentation/features/overview-table-actions-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

==== Show

Show actions navigate from a *Namespace* to its specific Graph, Applications, Workloads, Services or Istio Config pages.

==== Automatic Sidecar Injection

When https://istio.io/latest/docs/setup/additional-setup/sidecar-injection[Automatic Sidecar Injection] is enabled in the cluster, a *Namespace* can be labeled to enable/disable the injection webhook, controlling whether new deployments will automatically have a sidecar.

==== Security: Traffic Policies

Kiali can generate Traffic Policies based on the traffic for a namespace.

For example, at some point a namespace presents a traffic graph like this:

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/overview-actions-trafficpolicies-graph-v1.24.0.png" title="Traffic Policies: Graph">
   <img src="/images/documentation/features/overview-actions-trafficpolicies-graph-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

And a user may want to add Traffic Policies to secure that communication. In other words, to prevent traffic other than that currently reflected in the Graph's Services and Workloads.

Using the *Create Traffic Policies* action on a namespace, Kiali will generate AuthorizationPolicy resources per every *Workload* in the *Namespace*.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/overview-actions-trafficpolicies-authorizationpolicies-v1.24.0.png" title="Traffic Policies: Graph">
   <img src="/images/documentation/features/overview-actions-trafficpolicies-authorizationpolicies-v1.24.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

=== Istio Forms

Istio Wizards provide a way to apply a Service Mesh pattern and let Kiali to generate the Istio Configuration.
Kiali also offers actions to create Istio Config for Gateways and Security scenarios.

These actions are located under the Istio Config page.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/create-istio-config-v1.22.0.png" title="Service Details Actions">
   <img src="/images/documentation/features/create-istio-config-v1.22.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

==== Istio Security Forms

Kiali allows creation of AuthorizationPolicy, PeerAuthentication and RequestAuthentication Istio resources from the Create New Istio Config forms:

++++
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/form-authorization-policy-v1.22.0.png" title="Custom JVM Metrics">
          <img src="/images/documentation/features/form-authorization-policy-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
      <a class="image-popup-fit-height" href="/images/documentation/features/form-peer-authentication-v1.22.0.png" title="Custom Vertx Metrics">
          <img src="/images/documentation/features/form-peer-authentication-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/form-request-authentication-v1.22.0.png" title="Custom JVM Metrics">
          <img src="/images/documentation/features/form-request-authentication-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
++++

==== Istio Traffic Forms

Kiali uses Istio Wizards to generate Istio Traffic config for a specific Service, but Kiali also allows creation of Gateway and Sidecar Istio resources for more generic scenarios:

++++
<div style="display: flex;">
    <span style="margin: 0 auto;">
      <a class="image-popup-fit-height" href="/images/documentation/features/form-sidecar-v1.22.0.png" title="Custom JVM Metrics">
          <img src="/images/documentation/features/form-sidecar-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
      <a class="image-popup-fit-height" href="/images/documentation/features/form-gateway-v1.22.0.png" title="Custom Vertx Metrics">
          <img src="/images/documentation/features/form-gateway-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
      </a>
    </span>
</div>
++++

== Health Configuration

Kiali calculates health by combining the individual health of several indicators, such as pods and request traffic.  The _global health_ of a resource reflects the most severe health of its indicators.

The table below lists the current health indicators and whether the indicator supports custom configuration for its health calculation.

++++
<div style="display: flex;">
    <table style="width: 100%; border: 1px solid black">
      <tr style="width: 100%; border: 1px solid black">
        <th>Indicator</th>
        <th>Supports Configuration</th>
      </tr>
      <tr style="width: 100%; border: 1px solid black">
        <td>Pod Status</td><td>No</td>
      </tr>
      <tr style="width: 100%; border: 1px solid black">
        <td>Traffic Health</td><td>Yes</td>
      </tr>
    </table>
</div>
++++

=== Traffic Health

Kiali establishes reasonable defaults for determining the health of request traffic. But when the defaults are not appropriate Kiali offers a way to customize the thresholding used to determine degraded or failing request traffic for resources (service, workload, app...). See the link:/documentation/latest/configuration/health/[Health Configuration documentation] for more detail.

++++
<div style="display: flex;">
 <span style="margin: 0 auto">
  <a class="image-popup-fit-height" href="/images/documentation/health-configuration/beta.png" title="beta Namespace">
   <img src="/images/documentation/health-configuration/beta.png" style="width: 300px;height:400px;display:inline;margin: 0 auto;" />
  </a>
  <a class="image-popup-fit-height" href="/images/documentation/health-configuration/details_health.png" title="Health Deatails">
   <img src="/images/documentation/health-configuration/details_health.png" style="width: 300px;height:400px; display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++


== Security

Kiali gives support to better understand how mTLS is used in Istio meshes. Find those helpers in the graph, the masthead menu, the overview page and specific validations.

=== Masthead indicator

At the right side of the Masthead, Kiali shows a lock when the mesh has strictly enabled `mTLS` for the whole service mesh. It means that all the communications in the mesh uses `mTLS`.

++++
<div style="display: flex;">
 <span style="margin: 0 auto">
  <a class="image-popup-fit-height" href="/images/documentation/features/masthead-mtls-v1.22.0.png" title="mTLS mesh-wide enabled strictly">
   <img src="/images/documentation/features/masthead-mtls-v1.22.0.png" style="width: 660px;display:inline;margin: 0 auto;" />
  </a>
  <a class="image-popup-fit-height" href="/images/documentation/features/masthead-mtls-hollow-v1.22.0.png" title="Custom Vertx Metrics">
   <img src="/images/documentation/features/masthead-mtls-hollow-v1.22.0.png" style="width: 660px; display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

Kiali shows a hollow lock when either the mesh is configured in `PERMISSIVE` mode or there is a misconfiguration in the mesh-wide `mTLS` configuration.

=== Overview locks

The overview page shows all the available namespaces with aggregated data. Besides the health and validations, Kiali shows also the `mTLS` status at namespace-wide. Similar to the masthead, it shows a lock when strict `mTLS` is enabled or a hollow lock when permissive.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/overview-mtls-v1.22.0.png" title="Overview page: showing mTLS at namespace-wide">
   <img src="/images/documentation/features/overview-mtls-v1.22.0.png" style="width: 660px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

=== Graph

The `mTLS` method is used to establish communication between microservices. In the graph, Kiali has the option to show which edges are using `mTLS` and with what percentatge during the selected period. When an edge shows a lock icon it means at least one request with mTLS enabled is present. In case there are both mTLS and non-mTLS requests, the side-panel will show the percentage of requests using `mTLS`.

In case the mesh-wide `mTLS` is enabled, the graph will show broken locks for only those edges containing non-mTLS requests. Edges that use only `mTLS` won't show any lock.

Enable the option in the `Display` dropdown, select the `security` badge.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/graph-mtls-v1.22.0.png" title="Graph shows edges which uses mTLS">
   <img src="/images/documentation/features/graph-mtls-v1.22.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

=== Validations

Kiali has different validations to help troubleshoot configurations related to `mTLS` such as `DestinationRules` and `PeerAuthentications`.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/validations-mtls-v1.22.0.png" title="Validation supporting mTLS configuration">
   <img src="/images/documentation/features/validations-mtls-v1.22.0.png" style="width: 1333px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

== Istio Component Status

The Istio service mesh architecture is comprised of several components, from istiod to Jaeger. Each component must work as expected for the mesh to work well overall. Kiali regularly checks the status of each Istio component to ensure the mesh is healthy.

++++
<div style="display: flex;">
 <span style="margin: 0 auto;">
  <a class="image-popup-fit-height" href="/images/documentation/features/istio-components-1.24.png" title="Istio components status: components not healthy or found">
   <img src="/images/documentation/features/istio-components-1.24.png" style="width: 660px;display:inline;margin: 0 auto;" />
  </a>
 </span>
</div>
++++

A component *status* will be one of: `Not found`, `Unreachable`, `Not healthy` and `Healthy`. The `Not found` status means that Kiali is not able to find the deployment. The `Unreachable` status means that Kiali hasn't been succesfuly able to communicate with the component (Prometheus, Grafana and Jaeger). The `Not healthy` status means that the deployment doesn't have the desired amount of replicas running. The `Healthy` status is when the component is not in the previous ones, plus, healthy components won't be shown in the list.

Regarding the *severity* of each component, there are only to options: `core` or `add-on`. The `core` components are those shown as errors (in red) whereas the `add-ons` are displayed as warnings (in orange).

By default, Kiali checks the following components installed in the control plane namespace: istiod, ingress, egress; and prometheus, grafana and jaeger accessible thought their services.

== Multi-cluster support
Istio provides https://istio.io/docs/setup/install/multicluster/[installation instructions] for three different multi-cluster scenarios: replicated control planes, shared control plane with single-network, and shared control plane with multi-network.

Currently, Kiali only works with Istio's replicated control planes scenario. You will need to install Kiali aside each Istio's control plane; i.e. you will need one Kiali instance per Istio's control plane you want to monitor. Install instructions for Kiali are the same as for the single cluster scenario, so following the link:/documentation/v1.28/quick-start/[Quick start guide] is enough. Kiali will let you observe the mesh portion that is managed by the adjacent control plane.

The shared control plane scenarios are currently not supported by Kiali.

== Useful resources

.Kiali
* https://github.com/kiali/kiali/blob/master/README.adoc[Kiali Readme, window=_blank]
* https://github.com/kiali/kiali-ui/blob/master/README.adoc[Kiali-ui Readme, window=_blank]
* https://github.com/kiali/kiali-test-mesh[Kiali-test-mesh, window=_blank]

.Istio
* https://istio.io/[Istio, window=_blank]
 - https://istio.io/docs/concepts/what-is-istio/[What is Istio?, window=_blank]
 - https://istio.io/docs/concepts/traffic-management/[Traffic Management, window=_blank]
 - https://istio.io/docs/examples/[Examples, window=_blank]

.Jaeger
* https://www.jaegertracing.io/[Jaeger, window=_blank]


