--- title: "Configure access to the web console" description: "Expose the Calico Enterprise web console outside the cluster through ingress, a load balancer service, or port forwarding for administrator access." product: "Calico Enterprise" version: "3.23 (latest)" section: "Operations" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/operations/cnx/access-the-manager" --- # Configure access to the web console ## Big picture Configure access to the Calico Enterprise web console user interface. ## Value For security, the Calico Enterprise web console is not exposed outside of the cluster by default. You can configure access to the Calico Enterprise web console using ingress, a load balancer service, or port forwarding. ## Before you begin **Required** - [Install Calico Enterprise](https://docs.tigera.io/calico-enterprise/latest/getting-started.md) - Choose one of the following access options and complete the required configuration: | Option | Description | Requirement | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Kubernetes ingress | Configure your cluster with an ingress controller to implement the `Ingress` resource using [Kubernetes ingress](https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer). | Ensure the Calico Enterprise web console receives a HTTPS (TLS) connection (not unencrypted HTTP). If you require TLS termination at your ingress, you must use a proxy that supports transparent HTTP/2 proxying, (for example, Envoy), or re-originate a TLS connection from your proxy to the Calico Enterprise web console. If you do not require TLS termination, configure your proxy to “pass thru” the TLS to the Calico Enterprise web console. | | Load balancer | Configure your cluster with a service load balancer controller to implement the external load balancer. See [Kubernetes loadbalancer](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/) | Ensure the Calico Enterprise web console receives a HTTPS (TLS) connection (not unencrypted HTTP). If you require TLS termination at your load balancer, you must use a load balancer that supports transparent HTTP/2 proxying, or re-originate a TLS connection from your load balancer to the Calico Enterprise web console. If you do not require TLS termination, configure your proxy to “pass thru” the TLS to the Calico Enterprise web console. | | Port forwarding | Forward traffic from a local port to the Kubernetes API server, where it is proxied to the web console. This approach is **not recommended for production**, but is useful if you do not have a load balancer or ingress infrastructure configured, or you need to get started quickly. | n/a | | OpenShift routes | Use OpenShift routes to expose a service by giving it an externally-reachable hostname (for example, `www.example.com`) . | n/a | ## How to Select the tab for the access option that you chose. **Tab: Ingress** **Basic ingress controller, no modification** The following example uses `calico-manager` as the backend service without modification. Use the `calico-manager` service only when edits to the service are not required. (Note if you try to make changes to `calico-manager`, changes may appear to take effect, but the service always resets to the default and is not overwritten.) ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: calico-manager namespace: calico-system spec: rules: - http: paths: - path: / pathType: ImplementationSpecific backend: service: name: calico-manager port: number: 9443 ``` **Advanced ingress controllers, with modifications** If you need to annotate or modify the service, you must create your own service (`serviceName: `) in the `calico-system` namespace, and use it in the ingress resource. For example: ```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: calico-manager namespace: calico-system spec: rules: - http: paths: - path: / pathType: ImplementationSpecific backend: service: name: annotated-service port: number: 9443 ``` **Log in to the Calico Enterprise web console** Access the Calico Enterprise web console in your browser using the URL for your ingress controller. For example: `https://`. **Tab: Load balancer service** To expose the manager using a load balancer, create the following service. ```yaml kind: Service apiVersion: v1 metadata: name: calico-manager-external namespace: calico-system spec: type: LoadBalancer selector: k8s-app: calico-manager externalTrafficPolicy: Local ports: - port: 9443 targetPort: 9443 protocol: TCP ``` After creating the service, it may take a few minutes for the load balancer to be created. Once complete, the load balancer IP address appears as an `ExternalIP` in `kubectl get services -n calico-system calico-manager-external`. **Log in to the Calico Enterprise web console** Access the Calico Enterprise web console in your browser using the load balancer's external IP address. For example: `https://:9443`. **Tab: Port forwarding** To forward traffic locally, use the following command: ```bash kubectl port-forward -n calico-system service/calico-manager 9443:9443 ``` **Log in to the Calico Enterprise web console** Access the Calico Enterprise web console in your browser at: `https://localhost:9443` **Tab: OpenShift routes** To expose the web console using OpenShift routes, create the following route with these required parameters: - host: `.` - name: `calico-manager` - targetPort: `9443` Both `passthrough` and `reencrypt` TLS termination work, but we recommend `reencrypt` because `passthrough` can cause intermittent routing issues when wildcard certificates are in use. The route requires a `destinationCACertificate` so HAProxy can verify the backend connection. If you provided your own `manager-tls` secret, use your own root CA here. Otherwise, extract the operator's CA with: ```bash kubectl get secret tigera-ca-private -n tigera-operator -o jsonpath='{.data.tls\.crt}' | base64 -d ``` **Example** ```yaml kind: Route apiVersion: route.openshift.io/v1 metadata: name: calico-manager namespace: calico-system spec: host: manager.apps.demo-ocp.tigera-solutions.io to: kind: Service name: calico-manager weight: 100 port: targetPort: 9443 tls: termination: reencrypt insecureEdgeTerminationPolicy: Redirect destinationCACertificate: | -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- wildcardPolicy: None ``` **Log in to the Calico Enterprise web console** Access the Calico Enterprise web console in your browser using the URL with clustername. For example: `https://manager.apps.demo-ocp.tigera-solutions.io` ## Additional resources - [Authentication quickstart](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/authentication-quickstart.md) - [Configure an external identity provider](https://docs.tigera.io/calico-enterprise/latest/operations/cnx/configure-identity-provider.md)