PMREQ-821: Document UI access through Calico Ingress Gateway - #2930
Draft
vara2504 wants to merge 1 commit into
Draft
PMREQ-821: Document UI access through Calico Ingress Gateway#2930vara2504 wants to merge 1 commit into
vara2504 wants to merge 1 commit into
Conversation
Enterprise: add a Calico Ingress Gateway tab to the web console access page, alongside ingress, load balancer, port forwarding, and OpenShift routes, plus a row in the options table. Covers the GatewayAPI prerequisite, the hostname and optional gateway namespace and class, and the OIDC requirement that managerDomain match the hostname. Open source: document exposing Whisker the same way, next to the existing port-forwarding instructions, including that Whisker has no authentication of its own and that Calico restricts access to the gateway's proxy pods while the field is set.
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
❌ Deploy Preview for tigera failed. Why did it fail? →Built without sensitive environment variables
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds documentation for exposing the Whisker (OSS) and Manager (Enterprise) UIs via Calico Ingress Gateway, aligning the “access UI” guidance with the new spec.ingressGateway configuration.
Changes:
- Calico OSS: adds steps to expose Whisker through Calico Ingress Gateway (hostname, gateway address lookup, DNS, and teardown).
- Calico Enterprise: adds a new “$[prodname] Ingress Gateway” access option and tab, including OIDC
managerDomain/redirect URL guidance.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| calico/observability/view-flow-logs.mdx | Adds a new section describing Whisker UI exposure via Calico Ingress Gateway. |
| calico-enterprise/operations/cnx/access-the-manager.mdx | Adds an access-option row and a new tab documenting Manager UI exposure via $[prodname] Ingress Gateway, including OIDC notes. |
Suppressed comments (1)
calico-enterprise/operations/cnx/access-the-manager.mdx:222
- The note says to set
managerDomainto the “same hostname”, but the example sets it to a full URL (https://...). Rewording to “same URL you use to access the web console” avoids ambiguity.
If your cluster uses OIDC, set the `Authentication` resource's `managerDomain` to the same hostname. The two must match, or the operator reports the $[prodname] web console as degraded:
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+154
to
+158
| 1. Wait for the Gateway to be programmed and read its address: | ||
|
|
||
| ```bash | ||
| kubectl get gateway -n calico-system calico-whisker-gateway | ||
| ``` |
Comment on lines
+207
to
+211
| 1. Wait for the Gateway to be programmed and read its address: | ||
|
|
||
| ```bash | ||
| kubectl get gateway -n calico-system calico-manager-gateway | ||
| ``` |
|
|
||
| </TabItem> | ||
|
|
||
| <TabItem label="$[prodname] Ingress Gateway" value="Calico Ingress Gateway-4"> |
| | Load balancer | Configure your cluster with a service load balancer controller to implement the external load balancer. See [Kubernetes loadbalancer](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/) | Ensure the $[prodname] web console receives a HTTPS (TLS) connection (not unencrypted HTTP). If you require TLS termination at your load balancer, you must use a load balancer that supports transparent HTTP/2 proxying, or re-originate a TLS connection from your load balancer to the $[prodname] web console. If you do not require TLS termination, configure your proxy to “pass thru” the TLS to the $[prodname] web console. | | ||
| | Port forwarding | Forward traffic from a local port to the Kubernetes API server, where it is proxied to the web console. This approach is **not recommended for production**, but is useful if you do not have a load balancer or ingress infrastructure configured, or you need to get started quickly. | n/a | | ||
| | OpenShift routes | Use OpenShift routes to expose a service by giving it an externally-reachable hostname (for example, `www.example.com`) . | n/a | | ||
| | $[prodname] Ingress Gateway | Expose the web console through $[prodname] Ingress Gateway by setting `spec.ingressGateway` on the `Manager` resource. The operator creates and manages the Gateway, route, and TLS certificate for you. | Requires the `GatewayAPI` resource to be installed. If your cluster uses OIDC, the `Authentication` resource's `managerDomain` must match the hostname you choose. | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Documents exposing the UIs through Calico Ingress Gateway, the feature added by
tigera/operator#5146 (Whisker) and #5032 (Manager).
beside ingress, load balancer, port forwarding and OpenShift routes, plus a row
in the options table. Covers the
GatewayAPIprerequisite,spec.ingressGatewaywith optional
gatewayNamespaceandgatewayClassName, finding the gatewayaddress, and turning it off again. A note covers OIDC:
Authentication'smanagerDomainmust match the hostname, and the identity provider needs the twocallback URLs.
WhiskerCR, next to the existingport-forwarding instructions, including that Whisker has no authentication of its
own and that Calico restricts access to the gateway's proxy pods while the field
is set.
Draft, pending three decisions
certificate, and neither says how to supply your own. The operator honours a
pre-created secret in
tigera-operator, and withInstallation.spec.certificateManagementset that is the only supported route,since the operator now degrades rather than writing a keyless secret. Wording
still to agree.
also exists in
calico_versioned_docs/version-3.3x/; the release these ship indecides which folders need the same change.
yarn buildhas not been run.Merge order
Should not merge before the operator and chart changes land, since it documents a
field that is not in a release yet: tigera/operator#5146,
projectcalico/calico#13521, tigera/calico-private#13247.