<p>I have installed Istio as described <a href="https://istio.io/docs/setup/getting-started/" rel="nofollow noreferrer">here</a>.</p>
<p>I used <code>istioctl manifest apply --set profile=demo</code> for this purpose. And then installed <code>bookinfo</code> application.</p>
<p>And set kiali to use <code>NordPort</code> using <code>kubectl -n istio-system edit svc kiali</code>.</p>
<p><code>kubectl -n istio-system get svc kiali</code> shows its <code>NordPort</code> and Ports <code>20001:32173/TCP</code></p>
<p>When I try to access kiali dashboard using <code>192.168.123.456:32173/kiali</code>, with default username and password <code>admin</code> I get following warining.</p>
<blockquote>
<p>Your session has expired or was terminated in another window</p>
</blockquote>
<p>Why is it happening? I haven't change any default settings.</p>
<p>Kiali pod is running.</p>
<p>As <a href="https://stackoverflow.com/users/11977760/jt97">jt97</a> requested <code>curl -v externalIP:port/kiali</code></p>
<pre><code>*   Trying 192.168.123.456...
* TCP_NODELAY set
* Connected to 192.168.123.456 (192.168.123.456) port 15029 (#0)
&gt; GET /kiali/ HTTP/1.1
&gt; Host: 192.168.123.456:15029
&gt; User-Agent: curl/7.58.0
&gt; Accept: */*
&gt;
&lt; HTTP/1.1 200 OK
&lt; accept-ranges: bytes
&lt; content-length: 2330
&lt; content-type: text/html; charset=utf-8
&lt; last-modified: Mon, 04 May 2020 14:46:17 GMT
&lt; vary: Accept-Encoding
&lt; date: Mon, 04 May 2020 14:59:40 GMT
&lt; x-envoy-upstream-service-time: 0
&lt; server: istio-envoy
&lt;
&lt;!doctype html&gt;&lt;html lang=&quot;en&quot;&gt;&lt;head&gt;&lt;meta charset=&quot;utf-8&quot;/&gt;&lt;meta name=&quot;viewport&quot; content=&quot;width=device-width,initial-scale=1,shrink-to-fit=no&quot;/&gt;&lt;meta name=&quot;theme-color&quot; content=&quot;#000000&quot;/&gt;&lt;base href=&quot;/kiali/&quot;/&gt;&lt;script type=&quot;text/javascript&quot; src=&quot;./env.js&quot;&gt;&lt;/script&gt;&lt;link rel=&quot;manifest&quot; href=&quot;./manifest.json&quot;/&gt;&lt;link rel=&quot;shortcut icon&quot; href=&quot;./kiali_icon_lightbkg_16px.png&quot;/&gt;&lt;title&gt;Kiali Console&lt;/title&gt;&lt;link href=&quot;./static/css/2.51abb30a.chunk.css&quot; rel=&quot;stylesheet&quot;&gt;&lt;link href=&quot;./static/css/main.aebbfcdd.chunk.css&quot; rel=&quot;stylesheet&quot;&gt;&lt;/head&gt;&lt;body class=&quot;pf-m-redhat-font&quot;&gt;&lt;noscript&gt;You need to enable JavaScript to run this app.&lt;/noscript&gt;&lt;div id=&quot;root&quot;&gt;&lt;/div&gt;&lt;script&gt;!function(a){function e(e){for(var r,t,n=e[0],o=e[1],i=e[2],u=0,l=[];u&lt;n.length;u++)t=n[u],Object.prototype.hasOwnProperty.call(p,t)&amp;&amp;p[t]&amp;&amp;l.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&amp;&amp;(a[r]=o[r]);for(s&amp;&amp;s(e);l.length;)l.shift()();return c.push.apply(c,i||[]),f()}function f(){for(var e,r=0;r&lt;c.length;r++){for(var t=c[r],n=!0,o=1;o&lt;t.length;o++){var i=t[o];0!==p[i]&amp;&amp;(n=!1)}n&amp;&amp;(c.splice(r--,1),e=u(u.s=t[0]))}return e}var t={},p={1:0},c=[];function u(e){if(t[e])return t[e].exports;var r=t[e]={i:e,l:!1,exports:{}};return a[e].call(r.exports,r,r.exports,u),r.l=!0,r.exports}u.m=a,u.c=t,u.d=function(e,r,t){u.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},u.r=function(e){&quot;undefined&quot;!=typeof Symbol&amp;&amp;Symbol.toStringTag&amp;&amp;Object.defineProperty(e,Symbol.toStringTag,{value:&quot;Module&quot;}),Object.defineProperty(e,&quot;__esModule&quot;,{value:!0})},u.t=function(r,e){if(1&amp;e&amp;&amp;(r=u(r)),8&amp;e)return r;if(4&amp;e&amp;&amp;&quot;object&quot;==typeof r&amp;&amp;r&amp;&amp;r.__esModule)return r;var t=Object.create(null);if(u.r(t),Object.defineProperty(t,&quot;default&quot;,{enumerable:!0,value:r}),2&amp;e&amp;&amp;&quot;string&quot;!=typeof r)for(var n in r)u.d(t,n,function(e){return r[e]}.bind(null,n));return t},u.n=function(e){var r=e&amp;&amp;e.__esModule?function(){return e.default}:function(){return e};return u.d(r,&quot;a&quot;,r),r},u.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},u.p=&quot;./&quot;;var r=this[&quot;webpackJsonp@* Connection #0 to host 192.168.123.456 left intact
kiali/kiali-ui&quot;]=this[&quot;webpackJsonp@kiali/kiali-ui&quot;]||[],n=r.push.bind(r);r.push=e,r=r.slice();for(var o=0;o&lt;r.length;o++)e(r[o]);var s=n;f()}([])&lt;/script&gt;&lt;script src=&quot;./static/js/2.f84a82a8.chunk.js&quot;&gt;&lt;/script&gt;&lt;script src=&quot;./static/js/main.339a2916.chunk.js&quot;&gt;&lt;/script&gt;&lt;/body&gt;&lt;/html&gt;
</code></pre>
<p>Kiali log : <code>/var/log/containers/kiali-869c6894c5-4jp2v_istio-system_kiali-1xxx.log</code></p>
<pre><code>{&quot;log&quot;:&quot;I0505 04:49:19.151849       1 kiali.go:66] Kiali: Version: v1.15.2, Commit: 718aedca76e612e2f95498d022fab1e116613792\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2020-05-05T04:49:19.152333612Z&quot;}
{&quot;log&quot;:&quot;I0505 04:49:19.153038       1 kiali.go:205] Using authentication strategy [login]\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2020-05-05T04:49:19.153122786Z&quot;}
{&quot;log&quot;:&quot;I0505 04:49:19.158187       1 kiali.go:87] Kiali: Console version: 1.15.1\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2020-05-05T04:49:19.158268318Z&quot;}
{&quot;log&quot;:&quot;I0505 04:49:19.158210       1 kiali.go:286] Updating base URL in index.html with [/kiali]\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2020-05-05T04:49:19.158284789Z&quot;}
{&quot;log&quot;:&quot;I0505 04:49:19.158840       1 kiali.go:267] Generating env.js from config\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2020-05-05T04:49:19.158915814Z&quot;}
{&quot;log&quot;:&quot;I0505 04:49:19.168786       1 server.go:57] Server endpoint will start at [:20001/kiali]\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2020-05-05T04:49:19.168870138Z&quot;}
{&quot;log&quot;:&quot;I0505 04:49:19.168813       1 server.go:58] Server endpoint will serve static content from [/opt/kiali/console]\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2020-05-05T04:49:19.16888486Z&quot;}
{&quot;log&quot;:&quot;I0505 04:49:19.179424       1 metrics_server.go:18] Starting Metrics Server on [:9090]\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2020-05-05T04:49:19.179497168Z&quot;}
{&quot;log&quot;:&quot;I0505 04:49:19.179752       1 kiali.go:137] Secret is now available.\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2020-05-05T04:49:19.17998388Z&quot;}
</code></pre>
<p>I found another error, which is not visible at once. When I enter username and password, it gives :</p>
<blockquote>
<p>You are logged in, but there was a problem when fetching some required server configurations, try refreshing the page.</p>
</blockquote>

<p>As mentioned in istio docs <a href="https://istio.io/docs/tasks/observability/gateways/#option-2-insecure-access-http" rel="nofollow noreferrer">here</a> </p>

<p>If you want to acces kiali dashboard you should install your istio demo profile with <code>--set values.kiali.enabled=true</code></p>

<pre><code>istioctl manifest apply --set profile=demo --set values.kiali.enabled=true
</code></pre>

<p>Then apply virtual service, gateway and destination rule</p>

<pre><code>cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: kiali-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 15029
      name: http-kiali
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: kiali-vs
  namespace: istio-system
spec:
  hosts:
  - "*"
  gateways:
  - kiali-gateway
  http:
  - match:
    - port: 15029
    route:
    - destination:
        host: kiali
        port:
          number: 20001
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: kiali
  namespace: istio-system
spec:
  host: kiali
  trafficPolicy:
    tls:
      mode: DISABLE
---
EOF
</code></pre>

<p>Get your external-ip with</p>

<pre><code>kubectl get svc istio-ingressgateway -n istio-system
</code></pre>

<p>And visit kiali via your browser with <code>http://&lt;EXTERNAL-IP&gt;:15029/</code>and credentials admin:admin.</p>

<hr>

<p>Additionally if you want to change the kiali credentials check this <a href="https://stackoverflow.com/questions/61107694/changing-secrets-of-kiali-in-istio-is-not-working/61116599#61116599">stackoverflow question</a>.</p>
