Control-Plane configuration

Here are all options to configure the control-plane:

  1. # Environment Type, can be either "kubernetes" or "universal"
  2. environment: universal # ENV: KUMA_ENVIRONMENT
  3. mode: standalone # ENV: KUMA_MODE By default autoconfigured to standalone
  5. # Resource Store configuration
  6. store:
  7.   # Type of Store used in the Control Plane. Can be either "kubernetes", "postgres" or "memory"
  8.   type: memory # ENV: KUMA_STORE_TYPE
  10.   # Kubernetes Store configuration (used when store.type=kubernetes)
  11.   kubernetes:
  12.     # Namespace where Control Plane is installed to.
  13.     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
  15.   # Postgres Store configuration (used when store.type=postgres)
  16.   postgres:
  17.     # Host of the Postgres DB
  18.     host: 127.0.0.1 # ENV: KUMA_STORE_POSTGRES_HOST
  19.     # Port of the Postgres DB
  20.     port: 15432 # ENV: KUMA_STORE_POSTGRES_PORT
  21.     # User of the Postgres DB
  22.     user: kuma # ENV: KUMA_STORE_POSTGRES_USER
  23.     # Password of the Postgres DB
  24.     password: kuma # ENV: KUMA_STORE_POSTGRES_PASSWORD
  25.     # Database name of the Postgres DB
  26.     dbName: kuma # ENV: KUMA_STORE_POSTGRES_DB_NAME
  27.     # Connection Timeout to the DB in seconds
  28.     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
  29.     # Maximum number of open connections to the database
  30.     # `0` value means number of open connections is unlimited
  31.     maxOpenConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS
  32.     # Maximum number of connections in the idle connection pool
  33.     # <0 value means no idle connections and 0 means default max idle connections
  34.     maxIdleConnections: 50  # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
  35.     # TLS settings
  36.     tls:
  37.       # Mode of TLS connection. Available values (disable, verifyNone, verifyCa, verifyFull)
  38.       mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  39.       # Path to TLS Certificate of the client. Used in verifyCa and verifyFull modes
  40.       certPath: # ENV: KUMA_STORE_POSTGRES_TLS_CERT_PATH
  41.       # Path to TLS Key of the client. Used in verifyCa and verifyFull modes
  42.       keyPath: # ENV: KUMA_STORE_POSTGRES_TLS_KEY_PATH
  43.       # Path to the root certificate. Used in verifyCa and verifyFull modes.
  44.       caPath: # ENV: KUMA_STORE_POSTGRES_TLS_ROOT_CERT_PATH
  45.     # MinReconnectInterval controls the duration to wait before trying to
  46.     # re-establish the database connection after connection loss. After each
  47.     # consecutive failure this interval is doubled, until MaxReconnectInterval
  48.     # is reached. Successfully completing the connection establishment procedure
  49.     # resets the interval back to MinReconnectInterval.
  50.     minReconnectInterval: "10s" # ENV: KUMA_STORE_POSTGRES_MIN_RECONNECT_INTERVAL
  51.     # MaxReconnectInterval controls the maximum possible duration to wait before trying
  52.     # to re-establish the database connection after connection loss.
  53.     maxReconnectInterval: "60s" # ENV: KUMA_STORE_POSTGRES_MAX_RECONNECT_INTERVAL
  55.   # Cache for read only operations. This cache is local to the instance of the control plane.
  56.   cache:
  57.     # If true then cache is enabled
  58.     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
  59.     # Expiration time for elements in cache.
  60.     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
  62.   # Upsert configuration
  63.   upsert:
  64.     # Base time for exponential backoff on upsert (get and update) operations when retry is enabled
  65.     conflictRetryBaseBackoff: 100ms # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_BASE_BACKOFF
  66.     # Max retries on upsert (get and update) operation when retry is enabled
  67.     conflictRetryMaxTimes: 5 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
  69. # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
  70. bootstrapServer:
  71.   # The version of Envoy API (available: "v3")
  72.   apiVersion: v3
  73.   # Parameters of bootstrap configuration
  74.   params:
  75.     # Address of Envoy Admin
  76.     adminAddress: 127.0.0.1 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ADDRESS
  77.     # Port of Envoy Admin
  78.     adminPort: 9901 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT
  79.     # Path to access log file of Envoy Admin
  80.     adminAccessLogPath: /dev/null # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ACCESS_LOG_PATH
  81.     # Host of XDS Server. By default it is the same host as the one used by kuma-dp to connect to the control plane
  82.     xdsHost: "" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST
  83.     # Port of XDS Server. By default it is autoconfigured from KUMA_XDS_SERVER_GRPC_PORT
  84.     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
  85.     # Connection timeout to the XDS Server
  86.     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
  88. #  Monitoring Assignment Discovery Service (MADS) server configuration
  89. monitoringAssignmentServer:
  90.   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
  91.   port: 5676 # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_PORT
  92.   # Which MADS API versions to serve
  93.   apiVersions: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_API_VERSIONS
  94.     - v1
  95.   # Interval for re-generating monitoring assignments for clients connected to the Control Plane.
  96.   assignmentRefreshInterval: 1s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL
  97.   # The default timeout for a single fetch-based discovery request, if not specified
  98.   defaultFetchTimeout: 30s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_DEFAULT_FETCH_TIMEOUT
  100. # Envoy XDS server configuration
  101. xdsServer:
  102.   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
  103.   dataplaneConfigurationRefreshInterval: 1s # ENV: KUMA_XDS_SERVER_DATAPLANE_CONFIGURATION_REFRESH_INTERVAL
  104.   # Interval for flushing status of Dataplanes connected to the Control Plane
  105.   dataplaneStatusFlushInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_STATUS_FLUSH_INTERVAL
  106.   # Backoff that is executed when Control Plane is sending the response that was previously rejected by Dataplane
  107.   nackBackoff: 5s # ENV: KUMA_XDS_SERVER_NACK_BACKOFF
  109. # API Server configuration
  110. apiServer:
  111.   # HTTP configuration of the API Server
  112.   http:
  113.     # If true then API Server will be served on HTTP
  114.     enabled: true # ENV: KUMA_API_SERVER_HTTP_ENABLED
  115.     # Network interface on which HTTP API Server will be exposed
  116.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTP_INTERFACE
  117.     # Port of the API Server
  118.     port: 5681 # ENV: KUMA_API_SERVER_HTTP_PORT
  119.   # HTTPS configuration of the API Server
  120.   https:
  121.     # If true then API Server will be served on HTTPS
  122.     enabled: true # ENV: KUMA_API_SERVER_HTTPS_ENABLED
  123.     # Network interface on which HTTPS API Server will be exposed
  124.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTPS_INTERFACE
  125.     # Port of the HTTPS API Server
  126.     port: 5682 # ENV: KUMA_API_SERVER_HTTPS_PORT
  127.     # Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
  128.     tlsCertFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
  129.     # Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
  130.     tlsKeyFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
  131.   # Authentication configuration for administrative endpoints like Dataplane Token or managing Secrets
  132.   auth:
  133.     # Directory of authorized client certificates (only validate in HTTPS)
  134.     clientCertsDir: "" # ENV: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
  135.   # Api Server Authentication configuration
  136.   authn:
  137.     # Type of authentication mechanism (available values: "adminClientCerts", "tokens")
  138.     type: tokens # ENV: KUMA_API_SERVER_AUTHN_TYPE
  139.     # Localhost is authenticated as a user admin of group admin
  140.     localhostIsAdmin: true # ENV: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
  141.     # Configuration for tokens authentication
  142.     tokens:
  143.       # If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma secret
  144.       bootstrapAdminToken: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_BOOTSTRAP_ADMIN_TOKEN
  145.   # If true, then API Server will operate in read only mode (serving GET requests)
  146.   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
  147.   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
  148.   corsAllowedDomains:
  149.     - ".*" # ENV: KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
  151. # Environment-specific configuration
  152. runtime:
  153.   # Kubernetes-specific configuration
  154.   kubernetes:
  155.     # Service name of the Kuma Control Plane. It is used to point Kuma DP to proper URL.
  156.     controlPlaneServiceName: kuma-control-plane # ENV: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
  157.     # Name of Service Account that is used to run the Control Plane
  158.     serviceAccountName: "system:serviceaccount:kuma-system:kuma-control-plane" # ENV: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
  159.     # Admission WebHook Server configuration
  160.     admissionServer:
  161.       # Address the Admission WebHook Server should be listening on
  162.       address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
  163.       # Port the Admission WebHook Server should be listening on
  164.       port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
  165.       # Directory with a TLS cert and private key for the Admission WebHook Server.
  166.       # TLS certificate file must be named `tls.crt`.
  167.       # TLS key file must be named `tls.key`.
  168.       certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
  169.     # Injector defines configuration of a Kuma Sidecar Injector.
  170.     injector:
  171.       # if true runs kuma-cp in CNI compatible mode
  172.       cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
  173.       # list of exceptions for Kuma injection
  174.       exceptions:
  175.         # a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
  176.         labels:
  177.           openshift.io/build.name: "*"
  178.           openshift.io/deployer-pod-for.name: "*"
  179.       # VirtualProbesEnabled enables automatic converting HttpGet probes to virtual. Virtual probe
  180.       #    serves on sub-path of insecure port 'virtualProbesPort',
  181.       #    i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
  182.       virtualProbesEnabled: true # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
  183.       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
  184.       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
  185.       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
  186.       caCertFile:  # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
  187.       # SidecarContainer defines configuration of the Kuma sidecar container.
  188.       sidecarContainer:
  189.         # Image name.
  190.         image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
  191.         # Redirect port for inbound traffic.
  192.         redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
  193.         # Redirect port for inbound traffic.
  194.         redirectPortInboundV6: 15010 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND_V6
  195.         # Redirect port for outbound traffic.
  196.         redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
  197.         # User ID.
  198.         uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
  199.         # Group ID.
  200.         gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
  201.         # Drain time for listeners.
  202.         drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
  203.         # Readiness probe.
  204.         readinessProbe:
  205.           # Number of seconds after the container has started before readiness probes are initiated.
  206.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
  207.           # Number of seconds after which the probe times out.
  208.           timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
  209.           # Number of seconds after which the probe times out.
  210.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
  211.           # Minimum consecutive successes for the probe to be considered successful after having failed.
  212.           successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
  213.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  214.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
  215.         # Liveness probe.
  216.         livenessProbe:
  217.           # Number of seconds after the container has started before liveness probes are initiated.
  218.           initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
  219.           # Number of seconds after which the probe times out.
  220.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
  221.           # How often (in seconds) to perform the probe.
  222.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
  223.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  224.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
  225.         # Compute resource requirements.
  226.         resources:
  227.           # Minimum amount of compute resources required.
  228.           requests:
  229.             # CPU, in cores. (500m = .5 cores)
  230.             cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
  231.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  232.             memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
  233.           # Maximum amount of compute resources allowed.
  234.           limits:
  235.             # CPU, in cores. (500m = .5 cores)
  236.             cpu: 1000m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
  237.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  238.             memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
  239.         # Additional environment variables that can be placed on Kuma DP sidecar
  240.         envVars: # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ENV_VARS
  241.       # InitContainer defines configuration of the Kuma init container
  242.       initContainer:
  243.         # Image name.
  244.         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
  245.       # Configuration for a traffic that is intercepted by sidecar
  246.       sidecarTraffic:
  247.         # List of inbound ports that will be excluded from interception.
  248.         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
  249.         excludeInboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
  250.         # List of outbound ports that will be excluded from interception.
  251.         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
  252.         excludeOutboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
  253.       builtinDNS:
  254.         # Use the built-in DNS
  255.         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
  256.         # Redirect port for DNS
  257.         port: 15053 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_PORT
  258.     marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
  259.   # Universal-specific configuration
  260.   universal:
  261.     # DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
  262.     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
  264. # Default Kuma entities configuration
  265. defaults:
  266.   skipMeshCreation: false # ENV: KUMA_DEFAULTS_SKIP_MESH_CREATION
  268. # Metrics configuration
  269. metrics:
  270.   dataplane:
  271.     # Enables collecting metrics from Dataplane
  272.     enabled: true # ENV: KUMA_METRICS_DATAPLANE_ENABLED
  273.     # How many latest subscriptions will be stored in DataplaneInsight object, if equals 0 then unlimited
  274.     subscriptionLimit: 2 # ENV: KUMA_METRICS_DATAPLANE_SUBSCRIPTION_LIMIT
  275.     # How long data plane proxy can stay Online without active xDS connection
  276.     idleTimeout: 5m # ENV: KUMA_METRICS_DATAPLANE_IDLE_TIMEOUT
  277.   zone:
  278.     # Enables collecting metrics from Zone
  279.     enabled: true # ENV: KUMA_METRICS_ZONE_ENABLED
  280.     # How many latest subscriptions will be stored in ZoneInsights object, if equals 0 then unlimited
  281.     subscriptionLimit: 10 # ENV: KUMA_METRICS_ZONE_SUBSCRIPTION_LIMIT
  282.     # How long zone can stay Online without active KDS connection
  283.     idleTimeout: 5m # ENV: KUMA_METRICS_ZONE_IDLE_TIMEOUT
  284.   mesh:
  285.     # Min time that should pass between MeshInsight resync
  286.     minResyncTimeout: 1s # ENV: KUMA_METRICS_MESH_MIN_RESYNC_TIMEOUT
  287.     # Max time that MeshInsight could spend without resync
  288.     maxResyncTimeout: 20s # ENV: KUMA_METRICS_MESH_MAX_RESYNC_TIMEOUT
  290. # Reports configuration
  291. reports:
  292.   # If true then usage stats will be reported
  293.   enabled: false # ENV: KUMA_REPORTS_ENABLED
  295. # General configuration
  296. general:
  297.   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
  298.   dnsCacheTTL: 10s # ENV: KUMA_GENERAL_DNS_CACHE_TTL
  299.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert that will be used across all the Kuma Servers.
  300.   tlsCertFile: # ENV: KUMA_GENERAL_TLS_CERT_FILE
  301.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key that will be used across all the Kuma Servers.
  302.   tlsKeyFile: # ENV: KUMA_GENERAL_TLS_KEY_FILE
  303.   workDir: ""
  305. # Web GUI Server configuration
  306. guiServer:
  307.   # URL of the Api Server
  308.   apiServerUrl: # ENV: KUMA_GUI_SERVER_API_SERVER_URL
  310. # DNS Server configuration
  311. dnsServer:
  312.   # The domain that the server will resolve the services for
  313.   domain: "mesh" # ENV: KUMA_DNS_SERVER_DOMAIN
  314.   # Port on which the server is exposed
  315.   port: 5653 # ENV: KUMA_DNS_SERVER_PORT
  316.   # The CIDR range used to allocate
  317.   CIDR: "240.0.0.0/4" # ENV: KUMA_DNS_SERVER_CIDR
  318.   # Will create a service "<kuma.io/service>.mesh" dns entry for every service.
  319.   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
  321. # Multizone mode
  322. multizone:
  323.   global:
  324.     kds:
  325.       # Port of a gRPC server that serves Kuma Discovery Service (KDS).
  326.       grpcPort: 5685 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_GRPC_PORT
  327.       # Interval for refreshing state of the world
  328.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_REFRESH_INTERVAL
  329.       # Interval for flushing Zone Insights (stats of multi-zone communication)
  330.       zoneInsightFlushInterval: 10s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_ZONE_INSIGHT_FLUSH_INTERVAL
  331.       # TlsCertFile defines a path to a file with PEM-encoded TLS cert.
  332.       tlsCertFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
  333.       # TTlsKeyFile defines a path to a file with PEM-encoded TLS key.
  334.       tlsKeyFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
  335.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  336.       # In practice this means a limit on full list of one resource type.
  337.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MAX_MSG_SIZE
  338.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  339.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  340.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MSG_SEND_TIMEOUT
  341.   zone:
  342.     # Kuma Zone name used to mark the zone dataplane resources
  343.     name: "" # ENV: KUMA_MULTIZONE_ZONE_NAME
  344.     # GlobalAddress URL of Global Kuma CP
  345.     globalAddress: # ENV KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
  346.     kds:
  347.       # Interval for refreshing state of the world
  348.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_KDS_REFRESH_INTERVAL
  349.       # RootCAFile defines a path to a file with PEM-encoded Root CA. Client will verify server by using it.
  350.       rootCaFile: # ENV: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
  351.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  352.       # In practice this means a limit on full list of one resource type.
  353.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_ZONE_KDS_MAX_MSG_SIZE
  354.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  355.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  356.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_ZONE_KDS_MSG_SEND_TIMEOUT
  358. # Diagnostics configuration
  359. diagnostics:
  360.   # Port of Diagnostic Server for checking health and readiness of the Control Plane
  361.   serverPort: 5680 # ENV: KUMA_DIAGNOSTICS_SERVER_PORT
  362.   # If true, enables https://golang.org/pkg/net/http/pprof/ debug endpoints
  363.   debugEndpoints: false # ENV: KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS
  365. # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
  366. dpServer:
  367.   # Port of the DP Server
  368.   port: 5678 # ENV: KUMA_DP_SERVER_PORT
  369.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  370.   tlsCertFile: # ENV: KUMA_DP_SERVER_TLS_CERT_FILE
  371.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  372.   tlsKeyFile: # ENV: KUMA_DP_SERVER_TLS_KEY_FILE
  373.   # Auth defines an authentication configuration for the DP Server
  374.   auth:
  375.     # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  376.     # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  377.     type: "" # ENV: KUMA_DP_SERVER_AUTH_TYPE
  378.   # Hds defines a Health Discovery Service configuration
  379.   hds:
  380.     # Enabled if true then Envoy will actively check application's ports, but only on Universal.
  381.     # On Kubernetes this feature disabled for now regardless the flag value
  382.     enabled: true # ENV: KUMA_DP_SERVER_HDS_ENABLED
  383.     # Interval for Envoy to send statuses for HealthChecks
  384.     interval: 5s # ENV: KUMA_DP_SERVER_HDS_INTERVAL
  385.     # RefreshInterval is an interval for re-genarting configuration for Dataplanes connected to the Control Plane
  386.     refreshInterval: 10s # ENV: KUMA_DP_SERVER_HDS_REFRESH_INTERVAL
  387.     # Check defines a HealthCheck configuration
  388.     checkDefaults:
  389.       # Timeout is a time to wait for a health check response. If the timeout is reached the
  390.       # health check attempt will be considered a failure
  391.       timeout: 2s # ENV: KUMA_DP_SERVER_HDS_CHECK_TIMEOUT
  392.       # Interval between health checks
  393.       interval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_INTERVAL
  394.       # NoTrafficInterval is a special health check interval that is used when a cluster has
  395.       #    never had traffic routed to it
  396.       noTrafficInterval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_NO_TRAFFIC_INTERVAL
  397.       # HealthyThreshold is a number of healthy health checks required before a host is marked healthy
  398.       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
  399.       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
  400.       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
  402. # Access Control configuration
  403. access:
  404.   # Type of access strategy (available values: "static")
  405.   type: static
  406.   # Configuration of static access strategy
  407.   static:
  408.     # AdminResources defines an access to admin resources (Secret/GlobalSecret)
  409.     adminResources:
  410.       # List of users that are allowed to access admin resources
  411.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_USERS
  412.       # List of groups that are allowed to access admin resources
  413.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_GROUPS
  414.     # GenerateDPToken defines an access to generating dataplane token
  415.     generateDpToken:
  416.       # List of users that are allowed to generate dataplane token
  417.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_USERS
  418.       # List of groups that are allowed to generate dataplane token
  419.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_GROUPS
  420.     # GenerateUserToken defines an access to generating user token
  421.     generateUserToken:
  422.       # List of users that are allowed to generate user token
  423.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_USERS
  424.       # List of groups that are allowed to generate user token
  425.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_GROUPS
  426.     # GenerateZoneToken defines an access to generating zone token
  427.     generateZoneToken:
  428.       # List of users that are allowed to generate zone token
  429.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_USERS
  430.       # List of groups that are allowed to generate zone token
  431.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
  432.     viewConfigDump:
  433.       # List of users that are allowed to get envoy config dump
  434.       users: [ ] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
  435.       # List of groups that are allowed to get envoy config dump
  436.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
  438. # Configuration of experimental features of Kuma
  439. experimental:
  440.   # If true, experimental built-in gateway is enabled
  441.   meshGateway: false # ENV: KUMA_EXPERIMENTAL_MESHGATEWAY
  442.   # If true, experimental Gateway API is enabled
  443.   gatewayAPI: false # ENV: KUMA_EXPERIMENTAL_GATEWAY_API
  444.   # If true, instead of embedding kubernetes outbounds into Dataplane object, they are persisted next to VIPs in ConfigMap
  445.   # This can improve performance, but it should be enabled only after all instances are migrated to version that supports this config
  446.   kubeOutboundsAsVIPs: false # ENV: KUMA_EXPERIMENTAL_KUBE_OUTBOUNDS_AS_VIPS