LINSTOR GUI

The linstor-gui package deploys LINBIT’s LINSTOR GUI — a web console for browsing and managing LINSTOR nodes, resource definitions, volumes, storage pools, and snapshots. The UI proxies the LINSTOR controller REST API in-cluster using mTLS, so no credentials are ever exposed in the browser.

The package is opt-in. The CLI workflow is unchanged — enabling the GUI does not affect any LINSTOR behaviour.

Enable the package

Add cozystack.linstor-gui to bundles.enabledPackages in the Platform Package:

kubectl patch packages.cozystack.io cozystack.cozystack-platform --type=json \
  -p '[{"op": "add", "path": "/spec/components/platform/values/bundles/enabledPackages/-", "value": "cozystack.linstor-gui"}]'

Wait a minute for the platform chart to reconcile, then verify the HelmRelease has been created:

kubectl get helmrelease --namespace cozy-linstor linstor-gui

Access the UI

Option 1 — Keycloak-protected Ingress (recommended)

When OIDC authentication is enabled, you can publish the UI at https://linstor-gui.<root-host> behind the cluster Keycloak realm. Add linstor-gui to publishing.exposedServices in the Platform Package:

kubectl patch packages.cozystack.io cozystack.cozystack-platform --type=json \
  -p '[{"op": "add", "path": "/spec/components/platform/values/publishing/exposedServices/-", "value": "linstor-gui"}]'

Access is restricted to members of the cozystack-cluster-admin Keycloak group — the same group that grants cluster-admin RBAC on the host cluster. Once enabled, open https://linstor-gui.<root-host> in your browser and log in with your Keycloak credentials.

Option 2 — Port-forward

For ad-hoc access without Keycloak, forward the ClusterIP service:

kubectl -n cozy-linstor port-forward svc/linstor-gui 3373:80

Then open http://localhost:3373.