Is there a way to access kiali api by token in openshift

[garyyang85]

I am using openshift 4.6 and installed the service mesh components via operator. Now I have a requirement to use openshift token or some other methods to access kiali api outside. For other components install by service mesh operator, like grafana, prometheus, jaeger, I can use token to access api because there is oauth-proxy in front of them. But seems kiali is installed without oauth-proxy, only a configuration strategy: openshift to achieve this. Is there a way to access kiali api by token in openshift? Thanks

[lucasponce]

. Now I have a requirement to use openshift token or some other methods to access kiali api outside.

Can you ellaborate this ?

Kiali API is not designed to be query outside of the Kiali UI context.

For OpenShift deployments, Kiali takes the user token to apply RBAC rights in all queries between user -> Kubernetes API.
In non OpenShift deployments, Kiali ServiceAccount is used for apply the RBAC from Kiali -> Kubernetes API.

Which use cases are you trying to develop here ?

[garyyang85]

@lucasponce It is our private solution to provide the graph like kiali. We do not use kiali directly because we want to show the graph to user only by "product"(maybe a chart) level but not "namespace" level.
So per your description, if there is not api provided to query outside, maybe we have to get all the graph data from kubernetes/openshfit directly without kiali.

[garyyang85]

Found there is a "kiali-token" in cookie, I can use this token as a bearer token in postman to get some data. Is there a way to get the "kiali-token" outside?

[lucasponce]

@lucasponce It is our private solution to provide the graph like kiali. We do not use kiali directly because we want to show the graph to user only by "product"(maybe a chart) level but not "namespace" level.
So per your description, if there is not api provided to query outside, maybe we have to get all the graph data from kubernetes/openshfit directly without kiali.

Kiali is an open source project, if you use for your product and you have ideas to improve, we are typically open to study them and we invite users to collaborate.

Kiali has a "kiosk" mode used for similar scenarios as you describe, that was introduced from a similar request as yours but time ago.

But, Kiali API was discussed in the past that is changing a lot and there is not public contract, in other words, it's responsability of the user to keep it updated, but API can change in any kiali version as it's intended to be used only to the Kiali UI code.

In the backend/frontend repo you could get details about the use of the "kiali-token" in the code, the public documentation for this section is in [1]

[1] https://kiali.io/documentation/latest/configuration/rbac/

[jmazzitelli]

I converted to a discussion as this isn't a bug report, but more of a question on how to do something.

Check out the docs that Lucas points out. There is also the "token" auth strategy, but I don't think it is what you are asking about - but might be useful to know: https://kiali.io/documentation/latest/configuration/authentication/token/

[garyyang85]

@lucasponce @jmazzitelli Thank you very much for your answers. I tried the token strategy, token can be used for login from UI but not bearer token to get api data. Seems only "kiali-token" in cookie can used for this.
As I mentioned in above comments, the requirement is to show the graph in a more detail level(in my scenario, it is a group of k8s deployment but not namespace). Hope your guys can evaluate this requirement. :)

[lucasponce]

@garyyang85 we are working on scenarios as you describe, like show in Graph and details certain elements with some specific labels only. It's not the first time we brainstom about it and it seems that your requeriment may fit with this idea.

So, I invite you to participate on it :) from several angles, defining the scope of this requeriment and also happy if your team would like to participate deep also with proposal, it's an active area and it's nice to see other users thinking on the same.

Let us know, I'm sure there is an issue open about this that probably we may want to give it more priority as well.