Post-Install

First Login

How you sign in for the first time depends on the authentication you configured during setup. In every case the administrator account is the email you supplied (orgAdminEmail).

External OIDC provider. The login screen shows a sign-in button labelled with the provider name you entered at setup. Authenticate through your identity provider with the account whose email matches orgAdminEmail; you sign in through the provider rather than with a Manifest password or a reset email. The provider's issuer URL must be reachable from the cluster.
SMTP, no external OIDC. Follow the password-reset flow on first sign-in; the reset email is delivered through your mail server.
Neither SMTP nor external OIDC. The platform cannot send a reset email, so sign in with the initial password the installer generated, then change it from account settings. Retrieve it from config.yaml:
```
manifest-installer deploy-config decrypt | grep orgAdminInitialPassword
```
deploy-config decrypt prints the config to stdout whether or not it is encrypted. Use orgAdminInitialPassword (the application login), not keycloakAdminPassword (the Keycloak service-admin console), which the Manifest sign-in screen rejects.

Add Ingress Certificate to Trust Store

Manifest generates a self-signed CA certificate for the web ingress. To avoid browser security warnings, you must export this certificate from the cluster and trust it on every machine that will access the platform's web UI.

Export the CA Certificate

Run on the Manifest host:

kubectl get secret -n cert-manager mfst-ca-tls -o jsonpath='{.data.ca\.crt}' | base64 -d > manifest-ca.crt

Distribute manifest-ca.crt to user workstations and apply one of the OS-specific commands below to trust it.

Trust the Certificate

macOS

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain manifest-ca.crt

Linux (Ubuntu/Debian)

sudo cp manifest-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

Linux (RHEL/CentOS)

sudo cp manifest-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Windows (PowerShell as Administrator)

Import-Certificate -FilePath manifest-ca.crt -CertStoreLocation Cert:\LocalMachine\Root

Use a Custom Ingress Certificate

Detailed instructions coming soon.