Access the Dashboard#

The Aspen Mesh dashboard is accessible from the aspen-mesh-controlplane service in the istio-system namespace in your cluster, on port 19001. For example, a URL for accessing the dashboard in-cluster would be: http://aspen-mesh-controlplane.istio-system.svc.cluster.local:19001. To access the dashboard as a user outside the cluster, you have these options:

Port forward: For initial testing or lab environments, it may be suitable to just port forward and access it from your desktop client.

kubectl port-forward -n istio-system $(kubectl get pod -n istio-system -l app=aspen-mesh-controlplane -o jsonpath='{.items[0].metadata.name}') 19001

open http://localhost:19001/

Platform-specific: Your cloud or Kubernetes platform may already have a platform-specific technique for exposing services. For instance, you may expose services by defining Ingress resources. Consult your platform-specific documentation for this. If your platform will expose this on an untrusted network, please ensure your platform provides an authentication proxy.

You will need to expose the aspen-mesh-controlplane service in the istio-system namespace, port 19001. For example, an Ingress specification may look like:
```
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: aspen-mesh-ingress
  namespace: istio-system
  annotations:
    # Platform-specific annotations
    # We recommend enabling TLS
spec:
  rules:
  - host: aspenmesh.admin.yourenvironment.com
    http:
      paths:
      - backend:
          serviceName: aspen-mesh-controlplane
          servicePort: 19001
EOF
```

Service type:LoadBalancer: Your cloud or Kubernetes platform may create an external load balancer for you if you declare a service with type: LoadBalancer. If your platform will expose this load balancer on an untrusted network, please ensure your platform provides an authentication proxy.

You will need to create a service with type: LoadBalancer like this:

kubectl apply -f - <<EOF
apiVersion: v1
kind: Service
metadata:
  name: aspen-mesh-controlplane-external
  namespace: istio-system
  annotations:
    # Platform-specific annotations
    # We recommend enabling TLS
  labels:
    app: aspen-mesh-controlplane
spec:
  ports:
  - name: http
    port: 19001
    protocol: TCP
    targetPort: http
  - name: grpc
    port: 19000
    protocol: TCP
    targetPort: grpc
  selector:
    app: aspen-mesh-controlplane
  type: LoadBalancer
EOF

Sign In with Github (OAuth2 Proxy with TLS): If you do not already have an authentication system and your platform does not provide a suitable built-in, here is an example of how to configure one.
Sign In with OpenShift (OAuth2 Proxy with TLS): If you are running an OpenShift cluster and want to use the built-in OpenShift OAuth system for authentication, here are instructions for configuring the aspen-mesh-controlplane service.