Deploy the console

The Ziti Admin Console (ZAC) is bundled with the ziti-controller Helm chart and is available once the controller is deployed.

Find the Console URL

Use the console by navigating to the controller's address with path /zac/ in a web browser. If you published the controller at ctrl.ziti.example.com:443, then the console URL is https://ctrl.ziti.example.com/zac/.

The correct console URL is displayed after Helm install or upgrade and may be fetched at any time with Helm.

Substitute your Helm release name for 'ziti-controller'

helm get notes "ziti-controller"

Authenticate with a Username and Password

Print the username and password

kubectl get secrets ziti-controller-admin-secret \
--output go-template=\
'{{range $k,$v := .data}}'\
'{{printf "%s: " $k}}{{if not $v}}{{$v}}{{else}}{{$v|base64decode}}{{end}}{{"\n"}}'\
'{{end}}'

Output

admin-password: UJ2Z4xK1OpagXG94GkAXkR0M4MRNvcOh
admin-user: admin

Authenticate with an Admin Client Certificate

1. Enroll an admin identity. Link to instructions

2. Unwrap the JSON file to obtain the certificate and private key.

   ziti ops unwrap admin2.json

3. Compose a keystore from the certificate and private key. The -legacy flag is necessary when importing the keystore into some versions of macOS Keychain Access.

   openssl pkcs12 -export -in admin2.cert -inkey admin2.key -out admin2.p12 -name "admin2" -legacy -password 'pass:mypassword'

4. Import the keystore:

   • macOS: Import into System Keychain via Keychain Access application for Google Chrome. You can run a terminal command or double-click the keystore file or drag it onto the login keychain to import it.

     security import admin2.p12 -k ~/Library/Keychains/login.keychain -T /Applications/Google\ Chrome.app -P 'mypass'

   • Windows: Import into the Windows Certificate Store (Personal store) via certmgr.msc.

   • Linux: Import into your browser's certificate store or system certificate store (e.g., Chrome Settings > Privacy and Security > Security > Manage certificates).

5. Visit the console in your web browser. The browser will prompt with a list of imported client certificates. Select the one you imported in the previous step.

6. Press the "LOGIN" button without entering a password.