Explore the UI with insights

After connecting to the Gloo UI, explore the basic layout. Review your Gloo Mesh Gateway components, Istio workloads, insights, your security posture, and more.

Launch the UI

The Gloo UI is served from the gloo-mesh-ui service on port 8090. When you have access to the management cluster, you can launch the Gloo UI from your local machine. You can connect by using the meshctl or kubectl CLIs.

1. Open the Gloo UI. The Gloo UI is served from the gloo-mesh-ui service on port 8090. You can connect by using the meshctl or kubectl CLIs.

• meshctl: For more information, see the CLI documentation.

  meshctl dashboard
• kubectl:
  1. Port-forward the gloo-mesh-ui service on 8090.

     kubectl port-forward -n gloo-mesh svc/gloo-mesh-ui 8090:8090
  2. Open your browser and connect to http://localhost:8090.

Home

View the health and performance of your Gloo Mesh Gateway components and gateways, and view recommendations to harden your setup by using the Dashboard and Insights pages.

Dashboard

The Gloo UI dashboard provides an at-a-glance overview of the health of your Gloo Mesh Gateway components, your Istio gateway installation, and different tiles to quickly determine the security posture, compliance, inventories, and health of your Gloo Mesh Gateway environment.

Insights

Gloo Mesh Gateway comes with an insights engine that automatically analyzes your Istio gateways for health issues. These issues are displayed in the UI along with recommendations to harden your Istio gateway setup. The insights give you a checklist to address issues that might otherwise be hard to detect across your environment. For an overview of available insights, see Insights.

Inventory

The Inventory section provides an at-a-glance look at the health of registered clusters and discovered services that make up your Gloo Mesh Gateway environment.

Workspaces

The Workspaces page lists all workspaces across your setup, and lists the number of clusters, namespaces, and destinations that the workspace spans.

Click a workspace to review its details. On this page, you can review whether federation and service isolation are enabled for the workspace, as well as the clusters and namespaces that the workspace spans.

You can also use the Destinations, Virtual Destinations, Routing, and Policies tabs to see the resources that exist in this workspace. By default, all resources, including resources that are imported into this workspace from other workspaces, are displayed. To filter the resources, you can use the Import Status dropdown to filter by whether the resources are imported, exported, or neither, and the Type dropdown to filter by Kubernetes services within the clusters or external services outside of the clusters.

Finally, the Imported Workspaces, Export to, and Available to import cards show the workspace’s relationship to other workspaces in the Gloo setup.

For more information about configuring workspaces, see the Multitenancy with workspaces guides.

Clusters

On the Clusters page, review details of the cluster where Gloo Mesh Gateway is installed, such as insights, the health of the Gloo Mesh Gateway control and data planes, relay certificate information (in multicluster setups only), and applied routes, gateways, destinations, and policies.

Single cluster: In a single-cluster setup, you can review the details of the cluster where you deployed Gloo Mesh Gateway.

Multicluster: In a multicluster setup, you can review the details of each cluster that you registered with the Gloo management plane.

1. To filter clusters by the cluster’s installation health, click the Healthy and Unhealthy buttons. You can also use the Sort by Name dropdown or the search bar to filter clusters by name.

   

   

2. Click More Details to see a more detailed dashboard for the cluster. This dashboard can help you find errors in your Gloo and Istio setups. Note that if you run multiple versions of Istio within the same cluster, you can click each version in the Version tab to see its details.

   

   

Global services

If you have a multicluster ambient or sidecar mesh setup, and made services available across clusters, the Global Services page lists the global service hostnames that are available for those services. For example, the following image shows the productpage.bookinfo.mesh.internal global hostname for the productpage service, which has services instances in two clusters of the multicluster setup.

Traffic

The Traffic section provides an overview of deployed Gateways, routes, policies, and destinations.

Gateways

On the Gateways page, you can view the YAML configuration of gateway-related resources, such as GatewayClass, Gateway, and GatewayParameters when using the Kubernetes Gateway API, and any Istio Gateways that you set up.

To filter the list of resources, you can choose between the following options:

• Use the Search bar to find a resource by name, namespace, or other properties
• Use the Filter menu to filter by:
  • Status: Filter between healthy and unhealthy resources.
  • Type: Display the resource types that you are interested in.
  • Label: Filter resources by label key and value.

Routes

On the Routes page, you can view the HTTPRoute and TCPRoute resources (Kubernetes Gateway API) that you created in your cluster.

To filter the list of resources, you can choose between the following options:

• Use the Search bar to find a resource by name, namespace, or other properties
• Use the Filter menu to filter by:
  • Status: Filter between healthy and unhealthy resources.
  • Type: Display the resource types that you are interested in.
  • Label: Filter resources by label key and value.

From the Details page of a route:

• To debug the route, click View YAML to view the route’s YAML configuration.
• Find the hostnames that the route matches on in the Hostnames card.
• Find the gateway that serves this route in the Gateways card.
• View the matchers that the route defines, its backing destinations, and any filters that you applied to the route in the Rule card.

Policies

On the Policies page, you can view any policies that you applied in your environment, such as . To view the policy configuration, you can click YAML.

To filter the list of resources, you can choose between the following options:

• Use the Search bar to find a resource by name, namespace, or other properties
• Use the Filter menu to filter by:
  • Status: Filter between healthy and unhealthy resources.
  • Type: Display the resource types that you are interested in.
  • Label: Filter resources by label key and value.

Destinations

On the Destination page, review a list of discovered destinations, such as Kubernetes services, Istio ServiceEntries, or WorkloadEntries.

To filter the list of resources, you can choose between the following options:

• Use the Search bar to find a resource by name, namespace, or other properties
• Use the Filter menu to filter by:
  • Status: Filter between healthy and unhealthy resources.
  • Type: Display the resource types that you are interested in.
  • Label: Filter resources by label key and value.

From the Details page of a destination:

• To debug the service, click View YAML to view the destination’s YAML configuration.
• See an analysis of the service’s error rate and latency in the Service Signals card.
• View the Graph tab to visualize the network traffic that reaches your destination. For more information about how to use the graph, see Graph.
• If you enable tracing in the Gloo telemetry pipeline, you can see request traces for a service in the built-in Jaeger UI that you can find in the Tracing tab. For more information about how to enable and use the tracing interface, see Tracing.

Security

Security insights

The Dashboard and Security Insights pages of the Gloo UI can help you review the overall security posture of your Istio setup, including insights and recommendations regarding your certificates, encrypted traffic, FIPS compliance, and more.

For more information, see Review your security posture.

Certificates

View a list of all Istio and relay certificates in your environment. This list provides the Filter by expiration… dropdown to filter certificates by validity status, and the Filter by type… dropdown to filter certificates by type, such as Istio root or intermediate.

To view the details of a certificate, such as the issue details, total validity period, and fingerprints, click the certificate name. On the certificate details page, you can review general information, such as the common name and organization the certificate is issued to, and check the validity period and fingerprints of the certificate.

Resources

Find an overview of resources that are deployed in your cluster and use the filter options in the Gloo UI to find the resource that you need.

Solo

View the Gloo Mesh Gateway custom resources that you created in your environment. Use the Filter by options to filter the list by resource type. To view the YAML configuration for a resource, click YAML.

To filter the list of resources, you can choose between the following options:

• Use the Search bar to find a resource by name, namespace, or other properties
• Use the Filter menu to filter by:
  • Status: Filter between healthy and unhealthy resources.
  • Type: Display the resource types that you are interested in.
  • Label: Filter resources by label key and value.

Istio

View the Istio resources in your Gloo Mesh Gateway environment, such as virtual services, gateways, or Istio operators. Use the Filter options to filter the list by namespace and Istio resource type. To view the YAML configuration for a resource, click YAML.

To filter the list of resources, you can choose between the following options:

• Use the Search bar to find a resource by name, namespace, or other properties
• Use the Filter menu to filter by:
  • Status: Filter between healthy and unhealthy resources.
  • Type: Display the resource types that you are interested in.
  • Label: Filter resources by label key and value.

Gateway API

View all Kubernetes Gateway API resources in your environment. For more information, see the Kubernetes Gateway API guide in the Istio documentation.

To filter the list of resources, you can choose between the following options:

• Use the Search bar to find a resource by name, namespace, or other properties
• Use the Filter menu to filter by:
  • Status: Filter between healthy and unhealthy resources.
  • Type: Display the resource types that you are interested in.
  • Label: Filter resources by label key and value.

Kubernetes

View all Kubernetes resources in your cluster, such as services, service accounts, secrets, or cluster roles. Use the Filter options to filter the list by namespace and Kubernetes resource type. To view the YAML configuration for a resource, click YAML.

To filter the list of resources, you can choose between the following options:

• Use the Search bar to find a resource by name, namespace, or other properties
• Use the Filter menu to filter by:
  • Status: Filter between healthy and unhealthy resources.
  • Type: Display the resource types that you are interested in.
  • Label: Filter resources by label key and value.

Observability

The Gloo UI consumes telemetry data from Prometheus and Jaeger and visualizes this data in the Observability section.

Graph

The Gloo UI includes a Graph page to visualize the network traffic that reaches your service mesh. The graph is based off Prometheus metrics that the built-in telemetry pipeline collects and exposes.

Note that in version 2.7 and later, the new Graph experience is displayed by default. To switch back to the original Graph, click View the original Graph experience.

Filters

Default Graph:

In the Search bar, filter the services that you want to see in the graph. You can choose to include or hide those services.

From the Cluster and Namespace dropdown, select the cluster and namespace for which you want to visualize traffic.

• Use the + and - buttons to zoom in and out of the graph.
• Use the arrow button to center and fit the graph to the canvas size. This action might be helpful if you rearranged the nodes and zoomed in.
• Use the lock button to lock the current viewpoint. You cannot move any of the boxes or arrows if the lock is enabled.
• Use the expanded arrows button to open a full-screen view of the graph. You can press escape to exit the full-screen view.
• Use the grid button to reset the layout.

Original Graph experience:

In the Search bar, filter the services that you want to see in the graph. You can choose to include or hide those services.

From the Traffic dropdown, select the range of time that you want the graph to show, such as traffic from the last 15 minutes.

From the Refresh dropdown, select how often you want the graph to refresh the data, such as every 5 seconds. You can also refresh on demand by clicking REFRESH.

After the header toolbar, you can filter what the graph shows by namespace and cluster. Filters work like the logical operator AND, so results must meet all the criteria. For example, if you filter by bookinfo namespace and cluster1, then the graph shows services that meet all these criteria.

Toggle Errors Only to see services that experienced traffic errors during the traffic time range you selected from the header toolbar.

Within the graph views, you can navigate by clicking and dragging whitespace within the main canvas, or by using the navigation arrow buttons, as shown in the following figure.

After the header toolbar, filter, and main canvas, you can choose more viewing options in the footer toolbar.

#	Icon name	Description
1	Fullscreen	Click to expand your browser to fullscreen. Click again or enter ESC to return to the normal screen size.
2	Zoom in and out	Zoom in or out on the main view’s canvas. Depending on your mouse settings, you can also scroll to zoom in and out.
3	Reset	If you moved the position of nodes on the graph, reset the nodes to their original positions.
4	Fit to canvas	Click to center and fit the content of the current view to the canvas size. This action might be helpful if you rearranged the nodes and zoomed in.
5	Networking graph views	Click one of the networking graph views to change how the nodes are displayed in the main canvas. For more information, see Networking views.
6	View legend	Open the graph legend. For more information, see Legend.
7	Layout settings	Open the graph layout settings. For more information, see Layout settings.

Layout settings

Click the settings icon to view the layout settings for the graph.

From the footer toolbar, click Layout Settings. Toggle on or off the following settings.

General:

• Animations: Animate edges with a speed proportional to the requests per second.
• Mutual TLS: Toggle the lock icons along paths between node that are mTLS encrypted.
• TCP: Review TCP traffic.

Node types displayed:
Nodes represent the application “nodes” of the graph. (Note that nodes represent your apps, not Kubernetes compute nodes.) You can toggle on and off views for the following nodes:

• Kubernetes services
• External services
• Gateways

Node status displayed:
Toggle on or off idle nodes, which are nodes that do not receive traffic.

Legend

Click on the eye icon to view the Graph legend.

Kubernetes Services and External Services describe the icons that are used for the application “nodes” of the graph. For example, a node might be a Kubernetes service, such as a gateway proxy, mesh workload, or waypoint proxy, or an external service, such as a virtual machine (VM), external workload, or Lambda function.

Node States, L7 Edges, and L4 Edges show whether a service’s traffic behaves normally or not, as indicated by a color or icon.

Node States:

Node color	State	Description
Blue	Healthy	The node is operative, and sends and responds to traffic as expected.
Orange	Warning	The node has some sort of degraded status or operation.
Gray	Idle	The node does not yet accept or send traffic. For example, the deployment might be pending.
Red	Error	The node has some sort of failure.

L7 Edges:

Dashed line color or icon	State	Description
Green	Healthy	Traffic is flowing between the nodes as expected, in the direction indicated.
Yellow	Warning	Traffic is degraded in some way. For example, a policy might be applied to a route that rate limits traffic to a service. Most of the requests are successful, but some are not.
Gray	Idle	The traffic connection is established, but requests are not yet sent or received along the connection.
Red	Error	Traffic is failing. For example, a policy might be applied to a route that blocks traffic to a service.
Black lock icon	mTLS applied	Service isolation is enabled for the traffic, with communication secured via mTLS.You can change service isolation settings via an access policy for a specific destination, or for the entire workspace via the workspace settings.

L4 Edges:

Solid line color or icon	State	Description
Blue	Active	Traffic is flowing between the nodes as expected, in the direction indicated.
Gray	Idle	The traffic connection is established, but requests are not yet sent or received along the connection.
Black lock icon	mTLS applied	Service isolation is enabled for the traffic, with communication secured via mTLS.You can change service isolation settings via an access policy for a specific destination, or for the entire workspace via the workspace settings.

From the footer toolbar, click Show Legend.

Node Types describes the icons that are used for the application “nodes” of the graph. For example, a node might be a Kubernetes service, such as a gateway proxy, mesh workload, or waypoint proxy, or an external service, such as a virtual machine (VM), external workload, or Lambda function.

Node States and Edges show whether a service’s traffic behaves normally or not, as indicated by a color or icon.

Color or icon	State	Description
Blue	Normal	The node sends and responds to traffic as expected.
Red	Danger	The node has some sort of failure. For example, a policy might be applied to a route that blocks traffic to a service.
Yellow	Warn	The node has some sort of degraded traffic. For example, a policy might be applied to a route that rate limits traffic to a service. Most of the requests are successful, but some are not.
Gray	Idle	The node does not yet accept or send traffic. For example, the deployment might be pending.
Dashed, black line	L7	The traffic between nodes is sent over Layer 7 (application). For this traffic, you can apply L7 HTTP/HTTPS policies that are supported in Gloo Mesh (Gloo Platform APIs), Gloo Mesh Gateway, and Gloo Gateway only.
Solid, navy or gray line	L4	The traffic between nodes is sent over Layer 4 (transport).
Colorful triangles	Failure, Healthy, Degraded, or Idle	The connection is in a state of failure, healthy, degraded, or idle, depending on the color. Try describing the resources in your cluster to troubleshoot further.
Blue lock icon	mTLS applied	Service isolation is enabled for the traffic, with communication secured via mTLS. You can change service isolation settings via an access policy for a specific destination, or for the entire workspace via the workspace settings.
Istio icon	Enforced by Istio	The traffic connection is enforced by Istio.

Tracing

Gloo Mesh Gateway integrates with Jaeger as the tracing platform. Jaeger is an open source tool that helps you follow the path of a request as it is forwarded between microservices. The chain of events and interactions are then captured by the telemetry pipeline, which you can visualize by embedding your own Jaeger instance UI in the Tracing page of the Gloo UI. You can use this data to troubleshoot issues in your microservices and identify bottlenecks.

To configure the Gloo UI to embed the UI of your Jaeger instance, you must enable tracing in the telemetry pipeline and instrument your apps to collect traces. For more information, see Add Istio request traces.

Logs

You can use the Gloo UI log viewer to see the logs of Gloo Mesh Gateway and Istio components, such as the management server, the telemetry collector agent, or the Gloo UI. These logs can help you monitor the health of your Gloo Mesh Gateway components and troubleshoot issues.

To view logs, use the log viewer filter options to select the cluster, component, pod name, and, if applicable, the container that you want to check the logs for. You can also use the search capability to find logs that match a specific search term, or download the logs so that you can share them with your team.