az account set --subscription [SUBSCRIPTION_ID]
1. Download the cluster's credentials and make it your current context:
az aks get-credentials --resource-group [RESOURCE_GROUP] --name [AKS_SERVICE_NAME]
### Installation: Using `mesheryctl`
With your AKS cluster as the current context, start Meshery on Kubernetes:
mesheryctl system start -p kubernetes
Meshery Server runs in the cluster and connects to it automatically, so you do not need to upload a kubeconfig. To connect a Meshery Server that runs elsewhere to this cluster, sign in with `mesheryctl system login` and run `mesheryctl connection create --type aks`, which prompts for the resource group and cluster name. (`mesheryctl system config aks` is deprecated.)
If `mesheryctl` reports an authentication error, sign in with `mesheryctl system login`. See [Authenticate with Meshery via CLI](/guides/mesheryctl/authenticate-with-meshery-via-cli/).
### Installation: Using Helm
To install Meshery with Helm 3, see the [Helm Installation](/installation/kubernetes/helm/) guide.
## Post-Installation Steps
Optionally, verify the health of your Meshery deployment with mesheryctl system check.
You're ready to use Meshery. Open Meshery UI in your browser.
Once Meshery is running, mesheryctl system start opens Meshery UI in your default browser. On Docker, Meshery UI listens at http://localhost:9081 by default. On Kubernetes, mesheryctl opens the address of the meshery service in the meshery namespace, which the Helm chart creates as a LoadBalancer service on port 9081.
To open Meshery UI in your default browser at any time, run:
mesheryctl system dashboard
If your cluster does not give the meshery service a reachable address, forward a local port to Meshery instead. By default, mesheryctl listens on local port 9081; use -p to choose another port.
mesheryctl system dashboard --port-forward
You can also port-forward with kubectl:
kubectl port-forward svc/meshery 9081:9081 --namespace meshery
Connected.You can customize the callback URL that your Meshery Provider redirects to after sign-in. This helps when Meshery runs behind several layers of networking infrastructure.
For production deployments, we recommend that you expose Meshery UI through a reverse proxy or a load balancer. A custom callback URL makes sure that sign-in completes even when requests pass through several routing layers.
Note: For production deployments, use a Remote Provider so that you control which identity providers can sign users in. Learn more about this in the Extensibility: Providers guide.
To set a custom callback URL, set the MESHERY_SERVER_CALLBACK_URL environment variable when you start Meshery:
MESHERY_SERVER_CALLBACK_URL=https://custom-host/api/user/token mesheryctl system start
On Kubernetes, Meshery UI is then available at the EXTERNAL-IP of the meshery service. Run kubectl get svc meshery -n meshery to find it.