Launch

The Gloo UI is served from the gloo-mesh-ui service on port 8090. When you have access to the management cluster, you can launch the Gloo UI from your local machine. You can connect by using the meshctl or kubectl CLIs.

  1. Open the Gloo UI. The Gloo UI is served from the gloo-mesh-ui service on port 8090. You can connect by using the meshctl or kubectl CLIs.

  • meshctl: For more information, see the CLI documentation.
      meshctl dashboard
      
  • kubectl:
    1. Port-forward the gloo-mesh-ui service on 8090.
        kubectl port-forward -n gloo-mesh svc/gloo-mesh-ui 8090:8090
        
    2. Open your browser and connect to http://localhost:8090.
  1. Optional: If authentication is enabled, sign in.
  2. Review the dashboard.

Home

View the health and performance of your Gloo Mesh Core components and Istio workloads, and view recommendations to harden your setup by using the Dashboard and Insights pages.

Dashboard

The Gloo UI dashboard provides an at-a-glance overview of the health of your Gloo Mesh Core components, your Istio installation, and different tiles to quickly determine the security posture, compliance, inventories, and health of your Gloo Mesh Core environment.

Figure: Gloo UI dashboard
Figure: Gloo UI dashboard

Insights

Gloo Mesh Core comes with an insights engine that automatically analyzes your Istio setups for health issues. These issues are displayed in the UI along with recommendations to harden your Istio setups. The insights give you a checklist to address issues that might otherwise be hard to detect across your environment. For an overview of available insights, see Insights.

Figure: Gloo insights
Figure: Gloo insights

Inventory

Clusters

On the Clusters page, review basic details of each cluster that you registered with the Gloo management plane. Note that this page is only applicable in a multicluster setup.

  1. To filter clusters by the cluster’s installation health, click the Healthy and Unhealthy buttons. You can also use the Sort by Name dropdown or the search bar to filter clusters by name.

    Figure: Clusters page
    Figure: Clusters page
  2. Click More Details to see a more detailed dashboard for the cluster. This dashboard can help you find errors in your Gloo and Istio setups. Note that if you run multiple versions of Istio within the same cluster, you can click each version in the Version tab to see its details.

    Figure: Cluster details page
Figure: Cluster details page

Traffic

The Inventory section provides an at-a-glance look at the health of registered clusters and discovered services that make up your Gloo environment.

Gateways

On the Gateways page, you can view the YAML configuration of gateway-related resources, such as GatewayClass, Gateway, and GatewayParameterswhen using the Kubernetes Gateway API, and any Istio Gateways that you set up.

To filter the list of resources, you can choose between the following options:

  • Use the Status field to filter between healthy and unhealthy gateway resources.
  • Use the Label key and value fields to filter resources by their labels.
  • Use the Filter to display the resource types that you are interested in.
  • Use the Search bar to find a resource by name, namespace, or other properties
Figure: Gateways page
Figure: Gateways page

Routes

On the Routes page, you can view the HTTPRoute and TCPRoute resources (Kubernetes Gateway API) that you created in your cluster. You can also view any VirtualServices and Sidecar resources that you created in your cluster.

To filter the list of resources, you can choose between the following options:

  • Use the Status field to filter between healthy and unhealthy gateway resources.
  • Use the Label key and value fields to filter resources by their labels.
  • Use the Filter to display the resource types that you are interested in.
  • Use the Search bar to find a resource by name, namespace, or other properties
Figure: Routes page
Figure: Routes page

From the Details page of a route:

  • To debug the route, click View YAML to view the route’s YAML configuration.
  • Find the hostnames that the route matches on in the Hostnames card.
  • Find the gateway that serves this route in the Gateways card.
  • View the matchers that the route defines, its backing destinations, and any filters that you applied to the route in the Rule card.
Figure: Route details page
Figure: Route details page

Policies

On the Policies page, you can view any policies that you applied in your environment, such as AuthorizationPolicy, EnvoyFilters, or DestinationRules. To view the policy configuration, you can click YAML.

To filter the list of resources, you can choose between the following options:

  • Use the Status field to filter between healthy and unhealthy gateway resources.
  • Use the Label key and value fields to filter resources by their labels.
  • Use the Filter to display the resource types that you are interested in.
  • Use the Search bar to find a resource by name, namespace, or other properties
Figure: Policies page
Figure: Policies page

Destinations

On the Destination page, review a list of discovered destinations, such as Kubernetes services, Istio ServiceEntries, or WorkloadEntries.

To filter the list of resources, you can choose between the following options:

  • Use the Status field to filter between healthy and unhealthy gateway resources.
  • Use the Label key and value fields to filter resources by their labels.
  • Use the Filter to display the resource types that you are interested in.
  • Use the Search bar to find a resource by name, namespace, or other properties
Figure: Destinations page
Figure: Destinations page

From the Details page of a destination:

  • To debug the service, click View YAML to view the destination’s YAML configuration.
  • See an analysis of the service’s error rate and latency in the Service Signals card.
  • View the Graph tab to visualize the network traffic that reaches your destination. For more information about how to use the graph, see Graph.
    • If you enable tracing in the Gloo telemetry pipeline, you can see request traces for a service in the built-in Jaeger UI that you can find in the Tracing tab. For more information about how to enable and use the tracing interface, see Tracing.

    Security

    Security insights

    The Dashboard and Security Insights pages of the Gloo UI can help you review the overall security posture of your Istio setup, including insights and recommendations regarding your certificates, encrypted traffic, FIPS compliance, and more.

    For more information, see Review your security posture.

    Certificates

    View a list of all Istio and relay certificates in your environment. This list provides the Filter by expiration… dropdown to filter certificates by validity status, and the Filter by type… dropdown to filter certificates by type, such as Istio root or intermediate.

    To view the details of a certificate, such as the issue details, total validity period, and fingerprints, click Details. On the certificate details page, you can review general information, such as the common name and organization the certificate is issued to, and check the validity period and fingerprints of the certificate.

    Figure: Certificates details card
    Figure: Certificates details card
    Figure: Certificates details card
    Figure: Certificates details card

    Resources

    Find an overview of resources that are deployed in your cluster and use the filter options in the Gloo UI to find the resource that you need.

    Solo

    View the Gloo Mesh Core custom resources that you created in your environment. Use the Filter by options to filter the list by resource type. To view the YAML configuration for a resource, click YAML.

    To filter the list of resources, you can choose between the following options:

    • Use the Status field to filter between healthy and unhealthy gateway resources.
    • Use the Label key and value fields to filter resources by their labels.
    • Use the Filter to display the resource types that you are interested in.
    • Use the Search bar to find a resource by name, namespace, or other properties
    Figure: Solo resources page
    Figure: Solo resources page
    Figure: Solo resources page
    Figure: Solo resources page

    Istio

    View the Istio resources in your Gloo Mesh Core environment, such as virtual services, gateways, or Istio operators. Use the Filter options to filter the list by namespace and Istio resource type. To view the YAML configuration for a resource, click YAML.

    To filter the list of resources, you can choose between the following options:

    • Use the Status field to filter between healthy and unhealthy gateway resources.
    • Use the Label key and value fields to filter resources by their labels.
    • Use the Filter to display the resource types that you are interested in.
    • Use the Search bar to find a resource by name, namespace, or other properties
    Figure: Istio resources page
    Figure: Istio resources page
    Figure: Istio resources page
    Figure: Istio resources page

    Gateway API

    View all Kubernetes Gateway API resources in your environment. For more information, see the Kubernetes Gateway API guide in the Istio documentation.

    To filter the list of resources, you can choose between the following options:

    • Use the Status field to filter between healthy and unhealthy gateway resources.
    • Use the Label key and value fields to filter resources by their labels.
    • Use the Filter to display the resource types that you are interested in.
    • Use the Search bar to find a resource by name, namespace, or other properties

    Kubernetes

    View all Kubernetes resources in your cluster, such as services, service accounts, secrets, or cluster roles. Use the Filter options to filter the list by namespace and Kubernetes resource type. To view the YAML configuration for a resource, click YAML.

    To filter the list of resources, you can choose between the following options:

    • Use the Status field to filter between healthy and unhealthy gateway resources.
    • Use the Label key and value fields to filter resources by their labels.
    • Use the Filter to display the resource types that you are interested in.
    • Use the Search bar to find a resource by name, namespace, or other properties
    Figure: Kubernetes resources page
    Figure: Kubernetes resources page
    Figure: Kubernetes resources page
    Figure: Kubernetes resources page

    Observability

    The Gloo UI consumes telemetry data from Prometheus and Jaeger and visualizes this data in the Observability section.

    Graph

    The Gloo UI includes a Graph page to visualize the network traffic that reaches your service mesh. The graph is based off Prometheus metrics that the built-in telemetry pipeline collects and exposes.

    Layout settings

    From the footer toolbar, click Layout Settings. Toggle on or off the following settings.

    Graph UI layout settings
    Graph UI layout settings

    Layout settings:

    • Animations: Change the paths between nodes from a directional animation to a solid line.
    • Mutual TLS: Toggle the lock icons along paths between node that are mTLS encrypted.
    • TCP: Review TCP traffic.

    Node Types displayed:
    Nodes represent the application “nodes” of the graph. (Note that nodes represent your apps, not Kubernetes compute nodes.) You can toggle on and off views for the following nodes:

    • Kubernetes services
    • External services
    • Gateways

    Node states displayed:
    Toggle on or off idle nodes, which are nodes that do not receive traffic.

    Header, filter, and footer toolbars for navigation

    Legend

    From the footer toolbar, click Show Legend.

    Node Types describes the icons that are used for the application “nodes” of the graph. For example, a node might be a Kubernetes service, such as a gateway proxy, mesh workload, or waypoint proxy, or an external service, such as a virtual machine (VM), external workload, or Lambda function.

    Node States and Edges show whether a service’s traffic behaves normally or not, as indicated by a color or icon.

    Color or iconStateDescription
    BlueNormalThe node sends and responds to traffic as expected.
    RedDangerThe node has some sort of failure. For example, a policy might be applied to a route that blocks traffic to a service.
    YellowWarnThe node has some sort of degraded traffic. For example, a policy might be applied to a route that rate limits traffic to a service. Most of the requests are successful, but some are not.
    GrayIdleThe node does not yet accept or send traffic. For example, the deployment might be pending.
    Dashed, black lineL7The traffic between nodes is sent over Layer 7 (application). For this traffic, you can apply L7 HTTP/HTTPS policies that are supported in Gloo Mesh Enterprise, Gloo Mesh Gateway, and Gloo Gateway only.
    Solid, navy lineL4The traffic between nodes is sent over Layer 4 (transport).
    Colorful trianglesFailure, Healthy, Degraded, or IdleThe connection is in a state of failure, healthy, degraded, or idle, depending on the color. Try describing the resources in your cluster to troubleshoot further.
    Blue lock iconmTLS appliedService isolation is enabled for the traffic, with communication secured via mTLS. You can change service isolation settings via an access policy for a specific destination, or for the entire workspace via the workspace settings.
    Istio iconEnforced by IstioThe traffic connection is enforced by Istio.
    Figure: Graph UI legend
    Figure: Graph UI legend
    Figure: Graph UI legend
    Figure: Graph UI legend

    Networking views

    Tracing

    Gloo Network integrates with Jaeger as the tracing platform. Jaeger is an open source tool that helps you follow the path of a request as it is forwarded between microservices. The chain of events and interactions are then captured by the Gloo telemetry pipeline and visualized in the Jaeger UI that is embedded on the Tracing page of the Gloo UI. You can use this data to troubleshoot issues in your microservices and identify bottlenecks.

    To access the Jaeger UI through the Gloo UI, you must enable tracing in the Gloo telemetry pipeline and instrument your apps to collect traces. If you have an existing Jaeger instance that you want to use to visualize traces, you can configure the Gloo UI to embed the UI of your Jaeger instance. For more information, see Add Istio request traces.

    Figure: Tracing UI
    Figure: Tracing UI

    Logs

    You can use the Gloo UI log viewer to see the logs of Gloo and Istio components, such as the Gloo management server, the Gloo telemetry collector agent, or the Gloo UI. These logs can help you monitor the health of your Gloo components and troubleshoot issues.

    To view logs, use the log viewer filter options to select the cluster, Gloo component, pod name, and, if applicable, the container that you want to check the logs for. You can also use the search capability to find logs that match a specific search term, or download the logs so that you can share them with your team.

    Figure: Log viewer
    Figure: Log viewer