Quick Start with Kubernetes

Manage your Kubernetes clusters with Meshery. Deploy Meshery inside a Kubernetes cluster (in-cluster) or outside of it (out-of-cluster). Note: We recommend installing Meshery in your Kubernetes clusters.

Prerequisites

Install the Meshery command line client, mesheryctl.
Install kubectl on your local machine.
Access to an active Kubernetes cluster.

Available Deployment Methods

In-cluster Installation

Follow the steps below to install Meshery in your Kubernetes cluster.

Preflight Checks

Before you deploy Meshery on Kubernetes, check the following.

Preflight: Cluster Connectivity

Verify that your kubeconfig’s current context points at the cluster you want to deploy Meshery to.

	
		kubectl config current-context

Installation: Using `mesheryctl`

Start Meshery. mesheryctl deploys to the platform of your current mesheryctl context, which is kubernetes by default. To check it, run mesheryctl system context view. To deploy to Kubernetes regardless of the context, pass -p kubernetes:

	
		mesheryctl system start -p kubernetes

mesheryctl installs the Meshery Helm chart into the meshery namespace of your current cluster.

Installation: Using Helm

To install Meshery with Helm 3, see the Helm Installation guide.

Post-Installation Steps

Optionally, verify the health of your Meshery deployment with mesheryctl system check.

You’re ready to use Meshery. Open Meshery UI in your browser.

Accessing Meshery UI

Once Meshery is running, mesheryctl system start opens Meshery UI in your default browser. On Docker, Meshery UI listens at http://localhost:9081 by default. On Kubernetes, mesheryctl opens the address of the meshery service in the meshery namespace, which the Helm chart creates as a LoadBalancer service on port 9081.

To open Meshery UI in your default browser at any time, run:


mesheryctl system dashboard

If your cluster does not give the meshery service a reachable address, forward a local port to Meshery instead. By default, mesheryctl listens on local port 9081; use -p to choose another port.


mesheryctl system dashboard --port-forward

You can also port-forward with kubectl:


kubectl port-forward svc/meshery 9081:9081 --namespace meshery

Verify Kubernetes Connection

Whichever way you installed Meshery, verify that Meshery is connected to your cluster:

In the Meshery UI, navigate to Lifecycle from the menu on the left.
Select Connections.
Ensure that your cluster appears in the list of connections and is marked as Connected.
Click the cluster name to run a connectivity test and confirm that Meshery can reach your cluster.

Customizing Your Meshery Provider Callback URL

You can customize the callback URL that your Meshery Provider redirects to after sign-in. This helps when Meshery runs behind several layers of networking infrastructure.

For production deployments, we recommend that you expose Meshery UI through a reverse proxy or a load balancer. A custom callback URL makes sure that sign-in completes even when requests pass through several routing layers.

Note: For production deployments, use a Remote Provider so that you control which identity providers can sign users in. Learn more about this in the Extensibility: Providers guide.

To set a custom callback URL, set the MESHERY_SERVER_CALLBACK_URL environment variable when you start Meshery:


MESHERY_SERVER_CALLBACK_URL=https://custom-host mesheryctl system start

On Kubernetes, Meshery UI is then available at the EXTERNAL-IP of the meshery service. Run kubectl get svc meshery -n meshery to find it.

Exposing Meshery Service (LoadBalancer)

When you install Meshery in-cluster, a Kubernetes Service named meshery in the meshery namespace serves Meshery UI. The Helm chart creates this Service as type LoadBalancer by default (service.type), forwarding port 9081 to the Meshery Server container on port 8080.

On a managed Kubernetes offering, such as GKE, EKS, AKS, or DigitalOcean Kubernetes, a LoadBalancer Service tells the cloud provider to provision an external load balancer and assign it a routable EXTERNAL-IP. Retrieve the address with:

	
		kubectl get service meshery --namespace meshery

Once the EXTERNAL-IP column shows an address instead of <pending>, open Meshery UI in your browser at http://[EXTERNAL-IP]:9081.

If the Service was previously set to another type (for example, ClusterIP), switch it back to LoadBalancer:

	
		kubectl patch service meshery --namespace meshery --type merge -p '{"spec":{"type":"LoadBalancer"}}'

EXTERNAL-IP not assigned?

A LoadBalancer Service gets an external address only when the cluster runs a load balancer controller. Managed clouds provide one out of the box, but bare-metal and local clusters (for example, Minikube or kind) do not. On those clusters, install a load balancer implementation such as MetalLB, expose Meshery through a NodePort Service instead, or reach the UI with port-forwarding by following the mesheryctl system dashboard guide.

Out-of-cluster Installation

Install Meshery on Docker (out-of-cluster) and connect it to your Kubernetes cluster. Follow Install on Docker, then sign in with mesheryctl system login and add your cluster with mesheryctl connection create --type <aks|eks|gke|minikube>, or upload its kubeconfig in Meshery UI under Lifecycle > Connections.

If you expose Meshery through an ingress on Minikube, the following steps set up an ingress controller and cert-manager.

Set up Ingress on Minikube with the NGINX Ingress Controller

Enable the NGINX Ingress controller for your cluster:

	
		minikube addons enable ingress

Check that the NGINX Ingress controller is running:

	
		kubectl get pods -n ingress-nginx

Installing cert-manager with kubectl

Install cert-manager in your cluster:

	
		kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.3/cert-manager.yaml

Air-Gapped Installation - Install Meshery on Kubernetes in an air-gapped (offline) environment using Helm, a private registry, or side-loaded images.
AKS - Manage your AKS clusters with Meshery. Deploy Meshery in AKS in-cluster or out-of-cluster.
DigitalOcean - Install Meshery on DigitalOcean. Deploy Meshery out-of-cluster with Docker on a Droplet, or in-cluster on DigitalOcean Kubernetes (DOKS).
EKS - Install Meshery on Elastic Kubernetes Service. Deploy Meshery in EKS in-cluster or outside of EKS out-of-cluster.
GKE - Install Meshery on Google Kubernetes Engine. Deploy Meshery in GKE in-cluster or outside of GKE out-of-cluster.
Helm - Install Meshery on Kubernetes using Helm. Deploy Meshery in Kubernetes in-cluster.
KinD - Install Meshery on KinD. Deploy Meshery in KinD in-cluster or outside of KinD out-of-cluster.
KubeSphere - Install Meshery on KubeSphere
Minikube - Install Meshery on Minikube. Deploy Meshery in Minikube in-cluster or outside of Minikube out-of-cluster.

Docker Extension

Air-Gapped Installation