Skip to content

Sign in for the first time

Claim the administrator account on your new Console, then finish setup.

Before you start

The first caller to reach a new Console can claim it

Restrict the Console port to trusted operator sources and create the administrator right after deployment. On Kubernetes, restrict the load balancer too.

Open the Console

Open your Console address and port in a browser:

https://<console-address>:8080/

The sign-in page appears. Use the configured Console address and port. Managed setup prints them when it finishes.

What the browser shows

The browser warns until it trusts the certificate generated during installation. Obtain the public certificate through your authenticated host connection, verify its fingerprint, and add it to the operator trust store before signing in. See Set up certificates and tokens for the export command, or install a certificate from your trusted authority.

Claim the administrator account

  1. Sign in with the first-run credential iris / irisisgreat!. You get a one-use setup grant, good for ten minutes, and the account-creation page.
  2. Create the administrator account, with a name and password of your own. You are signed in as that administrator.

Creating the administrator retires the first-run credential. The API claims the account the same way: see Console API. If you lose the password, recover the account from the host: see Routine maintenance tasks.

Finish the first three setup steps

The next sign-in opens the setup flow. You can skip any step, and the flow resumes at the first one outstanding.

  1. Telemetry destination. Where swarm progress, device reports and export health are published. Already done when the deployment sets IRIS_OTLP_ENDPOINT.
  2. Device packages. Whether each IOx package and the IOS-XR agent package iris-xr.rpm still match the record of how they were built, and whether the served and distributed runtime certificates agree. Setup prepares these packages automatically. Select Re-check to refresh their status. A ready wrapper matches its adjacent provenance record; this check does not verify native signatures.
  3. Image verification. The check of published images against Bulk Hash, the checksum Cisco publishes for an image. Refresh now, schedule a daily run, or import a feed file.

Verify

  • The Console shows the operator areas, not the account-creation page.
  • Sign out, then try iris / irisisgreat! again. It fails.
  • The Setup page in Settings reports all four items.

Next steps