Control-Plane configuration

Here are all options to configure the control-plane:

  1. # Environment Type, can be either "kubernetes" or "universal"
  2. environment: universal # ENV: KUMA_ENVIRONMENT
  3. mode: standalone # ENV: KUMA_MODE By default autoconfigured to standalone
  5. # Resource Store configuration
  6. store:
  7.   # Type of Store used in the Control Plane. Can be either "kubernetes", "postgres" or "memory"
  8.   type: memory # ENV: KUMA_STORE_TYPE
  10.   # Kubernetes Store configuration (used when store.type=kubernetes)
  11.   kubernetes:
  12.     # Namespace where Control Plane is installed to.
  13.     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
  15.   # Postgres Store configuration (used when store.type=postgres)
  16.   postgres:
  17.     # Host of the Postgres DB
  18.     host: 127.0.0.1 # ENV: KUMA_STORE_POSTGRES_HOST
  19.     # Port of the Postgres DB
  20.     port: 15432 # ENV: KUMA_STORE_POSTGRES_PORT
  21.     # User of the Postgres DB
  22.     user: kuma # ENV: KUMA_STORE_POSTGRES_USER
  23.     # Password of the Postgres DB
  24.     password: kuma # ENV: KUMA_STORE_POSTGRES_PASSWORD
  25.     # Database name of the Postgres DB
  26.     dbName: kuma # ENV: KUMA_STORE_POSTGRES_DB_NAME
  27.     # Connection Timeout to the DB in seconds
  28.     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
  29.     # Maximum number of open connections to the database
  30.     # `0` value means number of open connections is unlimited
  31.     maxOpenConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS
  32.     # Maximum number of connections in the idle connection pool
  33.     # <0 value means no idle connections and 0 means default max idle connections
  34.     maxIdleConnections: 50  # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
  35.     # TLS settings
  36.     tls:
  37.       # Mode of TLS connection. Available values (disable, verifyNone, verifyCa, verifyFull)
  38.       mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  39.       # Path to TLS Certificate of the client. Used in verifyCa and verifyFull modes
  40.       certPath: # ENV: KUMA_STORE_POSTGRES_TLS_CERT_PATH
  41.       # Path to TLS Key of the client. Used in verifyCa and verifyFull modes
  42.       keyPath: # ENV: KUMA_STORE_POSTGRES_TLS_KEY_PATH
  43.       # Path to the root certificate. Used in verifyCa and verifyFull modes.
  44.       caPath: # ENV: KUMA_STORE_POSTGRES_TLS_ROOT_CERT_PATH
  45.     # MinReconnectInterval controls the duration to wait before trying to
  46.     # re-establish the database connection after connection loss. After each
  47.     # consecutive failure this interval is doubled, until MaxReconnectInterval
  48.     # is reached. Successfully completing the connection establishment procedure
  49.     # resets the interval back to MinReconnectInterval.
  50.     minReconnectInterval: "10s" # ENV: KUMA_STORE_POSTGRES_MIN_RECONNECT_INTERVAL
  51.     # MaxReconnectInterval controls the maximum possible duration to wait before trying
  52.     # to re-establish the database connection after connection loss.
  53.     maxReconnectInterval: "60s" # ENV: KUMA_STORE_POSTGRES_MAX_RECONNECT_INTERVAL
  55.   # Cache for read only operations. This cache is local to the instance of the control plane.
  56.   cache:
  57.     # If true then cache is enabled
  58.     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
  59.     # Expiration time for elements in cache.
  60.     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
  62.   # Upsert configuration
  63.   upsert:
  64.     # Base time for exponential backoff on upsert (get and update) operations when retry is enabled
  65.     conflictRetryBaseBackoff: 100ms # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_BASE_BACKOFF
  66.     # Max retries on upsert (get and update) operation when retry is enabled
  67.     conflictRetryMaxTimes: 5 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
  69.   # If true, skips validation of resource delete.
  70.   # For example you don't have to delete all Dataplane objects before you delete a Mesh
  71.   unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
  73. # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
  74. bootstrapServer:
  75.   # The version of Envoy API (available: "v3")
  76.   apiVersion: v3
  77.   # Parameters of bootstrap configuration
  78.   params:
  79.     # Address of Envoy Admin
  80.     adminAddress: 127.0.0.1 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ADDRESS
  81.     # Port of Envoy Admin
  82.     adminPort: 9901 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT
  83.     # Path to access log file of Envoy Admin
  84.     adminAccessLogPath: /dev/null # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ACCESS_LOG_PATH
  85.     # Host of XDS Server. By default it is the same host as the one used by kuma-dp to connect to the control plane
  86.     xdsHost: "" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST
  87.     # Port of XDS Server. By default it is autoconfigured from KUMA_XDS_SERVER_GRPC_PORT
  88.     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
  89.     # Connection timeout to the XDS Server
  90.     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
  92. #  Monitoring Assignment Discovery Service (MADS) server configuration
  93. monitoringAssignmentServer:
  94.   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
  95.   port: 5676 # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_PORT
  96.   # Which MADS API versions to serve
  97.   apiVersions: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_API_VERSIONS
  98.     - v1
  99.   # Interval for re-generating monitoring assignments for clients connected to the Control Plane.
  100.   assignmentRefreshInterval: 1s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL
  101.   # The default timeout for a single fetch-based discovery request, if not specified
  102.   defaultFetchTimeout: 30s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_DEFAULT_FETCH_TIMEOUT
  104. # Envoy XDS server configuration
  105. xdsServer:
  106.   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
  107.   dataplaneConfigurationRefreshInterval: 1s # ENV: KUMA_XDS_SERVER_DATAPLANE_CONFIGURATION_REFRESH_INTERVAL
  108.   # Interval for flushing status of Dataplanes connected to the Control Plane
  109.   dataplaneStatusFlushInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_STATUS_FLUSH_INTERVAL
  110.   # Backoff that is executed when Control Plane is sending the response that was previously rejected by Dataplane
  111.   nackBackoff: 5s # ENV: KUMA_XDS_SERVER_NACK_BACKOFF
  113. # API Server configuration
  114. apiServer:
  115.   # HTTP configuration of the API Server
  116.   http:
  117.     # If true then API Server will be served on HTTP
  118.     enabled: true # ENV: KUMA_API_SERVER_HTTP_ENABLED
  119.     # Network interface on which HTTP API Server will be exposed
  120.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTP_INTERFACE
  121.     # Port of the API Server
  122.     port: 5681 # ENV: KUMA_API_SERVER_HTTP_PORT
  123.   # HTTPS configuration of the API Server
  124.   https:
  125.     # If true then API Server will be served on HTTPS
  126.     enabled: true # ENV: KUMA_API_SERVER_HTTPS_ENABLED
  127.     # Network interface on which HTTPS API Server will be exposed
  128.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTPS_INTERFACE
  129.     # Port of the HTTPS API Server
  130.     port: 5682 # ENV: KUMA_API_SERVER_HTTPS_PORT
  131.     # Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
  132.     tlsCertFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
  133.     # Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
  134.     tlsKeyFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
  135.   # Authentication configuration for administrative endpoints like Dataplane Token or managing Secrets
  136.   auth:
  137.     # Directory of authorized client certificates (only validate in HTTPS)
  138.     clientCertsDir: "" # ENV: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
  139.   # Api Server Authentication configuration
  140.   authn:
  141.     # Type of authentication mechanism (available values: "adminClientCerts", "tokens")
  142.     type: tokens # ENV: KUMA_API_SERVER_AUTHN_TYPE
  143.     # Localhost is authenticated as a user admin of group admin
  144.     localhostIsAdmin: true # ENV: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
  145.     # Configuration for tokens authentication
  146.     tokens:
  147.       # If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma secret
  148.       bootstrapAdminToken: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_BOOTSTRAP_ADMIN_TOKEN
  149.   # If true, then API Server will operate in read only mode (serving GET requests)
  150.   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
  151.   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
  152.   corsAllowedDomains:
  153.     - ".*" # ENV: KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
  155. # Environment-specific configuration
  156. runtime:
  157.   # Kubernetes-specific configuration
  158.   kubernetes:
  159.     # Service name of the Kuma Control Plane. It is used to point Kuma DP to proper URL.
  160.     controlPlaneServiceName: kuma-control-plane # ENV: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
  161.     # Name of Service Account that is used to run the Control Plane
  162.     serviceAccountName: "system:serviceaccount:kuma-system:kuma-control-plane" # ENV: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
  163.     # Admission WebHook Server configuration
  164.     admissionServer:
  165.       # Address the Admission WebHook Server should be listening on
  166.       address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
  167.       # Port the Admission WebHook Server should be listening on
  168.       port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
  169.       # Directory with a TLS cert and private key for the Admission WebHook Server.
  170.       # TLS certificate file must be named `tls.crt`.
  171.       # TLS key file must be named `tls.key`.
  172.       certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
  173.     # Injector defines configuration of a Kuma Sidecar Injector.
  174.     injector:
  175.       # if true runs kuma-cp in CNI compatible mode
  176.       cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
  177.       # list of exceptions for Kuma injection
  178.       exceptions:
  179.         # a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
  180.         labels:
  181.           openshift.io/build.name: "*"
  182.           openshift.io/deployer-pod-for.name: "*"
  183.       # VirtualProbesEnabled enables automatic converting HttpGet probes to virtual. Virtual probe
  184.       #    serves on sub-path of insecure port 'virtualProbesPort',
  185.       #    i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
  186.       virtualProbesEnabled: true # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
  187.       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
  188.       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
  189.       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
  190.       caCertFile:  # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
  191.       # SidecarContainer defines configuration of the Kuma sidecar container.
  192.       sidecarContainer:
  193.         # Image name.
  194.         image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
  195.         # Redirect port for inbound traffic.
  196.         redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
  197.         # Redirect port for inbound traffic.
  198.         redirectPortInboundV6: 15010 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND_V6
  199.         # Redirect port for outbound traffic.
  200.         redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
  201.         # User ID.
  202.         uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
  203.         # Group ID.
  204.         gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
  205.         # Drain time for listeners.
  206.         drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
  207.         # Readiness probe.
  208.         readinessProbe:
  209.           # Number of seconds after the container has started before readiness probes are initiated.
  210.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
  211.           # Number of seconds after which the probe times out.
  212.           timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
  213.           # Number of seconds after which the probe times out.
  214.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
  215.           # Minimum consecutive successes for the probe to be considered successful after having failed.
  216.           successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
  217.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  218.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
  219.         # Liveness probe.
  220.         livenessProbe:
  221.           # Number of seconds after the container has started before liveness probes are initiated.
  222.           initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
  223.           # Number of seconds after which the probe times out.
  224.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
  225.           # How often (in seconds) to perform the probe.
  226.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
  227.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  228.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
  229.         # Compute resource requirements.
  230.         resources:
  231.           # Minimum amount of compute resources required.
  232.           requests:
  233.             # CPU, in cores. (500m = .5 cores)
  234.             cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
  235.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  236.             memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
  237.           # Maximum amount of compute resources allowed.
  238.           limits:
  239.             # CPU, in cores. (500m = .5 cores)
  240.             cpu: 1000m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
  241.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  242.             memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
  243.         # Additional environment variables that can be placed on Kuma DP sidecar
  244.         envVars: # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ENV_VARS
  245.       # InitContainer defines configuration of the Kuma init container
  246.       initContainer:
  247.         # Image name.
  248.         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
  249.       # ContainerPatches is an optional list of ContainerPatch names which will be applied
  250.       # to init and sidecar containers if workload is not annotated with a patch list.
  251.       containerPatches: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
  252.       # Configuration for a traffic that is intercepted by sidecar
  253.       sidecarTraffic:
  254.         # List of inbound ports that will be excluded from interception.
  255.         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
  256.         excludeInboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
  257.         # List of outbound ports that will be excluded from interception.
  258.         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
  259.         excludeOutboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
  260.       builtinDNS:
  261.         # Use the built-in DNS
  262.         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
  263.         # Redirect port for DNS
  264.         port: 15053 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_PORT
  265.     marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
  266.   # Universal-specific configuration
  267.   universal:
  268.     # DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
  269.     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
  271. # Default Kuma entities configuration
  272. defaults:
  273.   skipMeshCreation: false # ENV: KUMA_DEFAULTS_SKIP_MESH_CREATION
  275. # Metrics configuration
  276. metrics:
  277.   dataplane:
  278.     # Enables collecting metrics from Dataplane
  279.     enabled: true # ENV: KUMA_METRICS_DATAPLANE_ENABLED
  280.     # How many latest subscriptions will be stored in DataplaneInsight object, if equals 0 then unlimited
  281.     subscriptionLimit: 2 # ENV: KUMA_METRICS_DATAPLANE_SUBSCRIPTION_LIMIT
  282.     # How long data plane proxy can stay Online without active xDS connection
  283.     idleTimeout: 5m # ENV: KUMA_METRICS_DATAPLANE_IDLE_TIMEOUT
  284.   zone:
  285.     # Enables collecting metrics from Zone
  286.     enabled: true # ENV: KUMA_METRICS_ZONE_ENABLED
  287.     # How many latest subscriptions will be stored in ZoneInsights object, if equals 0 then unlimited
  288.     subscriptionLimit: 10 # ENV: KUMA_METRICS_ZONE_SUBSCRIPTION_LIMIT
  289.     # How long zone can stay Online without active KDS connection
  290.     idleTimeout: 5m # ENV: KUMA_METRICS_ZONE_IDLE_TIMEOUT
  291.   mesh:
  292.     # Min time that should pass between MeshInsight resync
  293.     minResyncTimeout: 1s # ENV: KUMA_METRICS_MESH_MIN_RESYNC_TIMEOUT
  294.     # Max time that MeshInsight could spend without resync
  295.     maxResyncTimeout: 20s # ENV: KUMA_METRICS_MESH_MAX_RESYNC_TIMEOUT
  297. # Reports configuration
  298. reports:
  299.   # If true then usage stats will be reported
  300.   enabled: false # ENV: KUMA_REPORTS_ENABLED
  302. # General configuration
  303. general:
  304.   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
  305.   dnsCacheTTL: 10s # ENV: KUMA_GENERAL_DNS_CACHE_TTL
  306.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert that will be used across all the Kuma Servers.
  307.   tlsCertFile: # ENV: KUMA_GENERAL_TLS_CERT_FILE
  308.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key that will be used across all the Kuma Servers.
  309.   tlsKeyFile: # ENV: KUMA_GENERAL_TLS_KEY_FILE
  310.   workDir: ""
  312. # Web GUI Server configuration
  313. guiServer:
  314.   # URL of the Api Server
  315.   apiServerUrl: # ENV: KUMA_GUI_SERVER_API_SERVER_URL
  317. # DNS Server configuration
  318. dnsServer:
  319.   # The domain that the server will resolve the services for
  320.   domain: "mesh" # ENV: KUMA_DNS_SERVER_DOMAIN
  321.   # The CIDR range used to allocate
  322.   CIDR: "240.0.0.0/4" # ENV: KUMA_DNS_SERVER_CIDR
  323.   # Will create a service "<kuma.io/service>.mesh" dns entry for every service.
  324.   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
  326. # Multizone mode
  327. multizone:
  328.   global:
  329.     kds:
  330.       # Port of a gRPC server that serves Kuma Discovery Service (KDS).
  331.       grpcPort: 5685 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_GRPC_PORT
  332.       # Interval for refreshing state of the world
  333.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_REFRESH_INTERVAL
  334.       # Interval for flushing Zone Insights (stats of multi-zone communication)
  335.       zoneInsightFlushInterval: 10s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_ZONE_INSIGHT_FLUSH_INTERVAL
  336.       # TlsCertFile defines a path to a file with PEM-encoded TLS cert.
  337.       tlsCertFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
  338.       # TTlsKeyFile defines a path to a file with PEM-encoded TLS key.
  339.       tlsKeyFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
  340.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  341.       # In practice this means a limit on full list of one resource type.
  342.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MAX_MSG_SIZE
  343.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  344.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  345.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MSG_SEND_TIMEOUT
  346.   zone:
  347.     # Kuma Zone name used to mark the zone dataplane resources
  348.     name: "" # ENV: KUMA_MULTIZONE_ZONE_NAME
  349.     # GlobalAddress URL of Global Kuma CP
  350.     globalAddress: # ENV KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
  351.     kds:
  352.       # Interval for refreshing state of the world
  353.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_KDS_REFRESH_INTERVAL
  354.       # RootCAFile defines a path to a file with PEM-encoded Root CA. Client will verify server by using it.
  355.       rootCaFile: # ENV: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
  356.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  357.       # In practice this means a limit on full list of one resource type.
  358.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_ZONE_KDS_MAX_MSG_SIZE
  359.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  360.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  361.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_ZONE_KDS_MSG_SEND_TIMEOUT
  363. # Diagnostics configuration
  364. diagnostics:
  365.   # Port of Diagnostic Server for checking health and readiness of the Control Plane
  366.   serverPort: 5680 # ENV: KUMA_DIAGNOSTICS_SERVER_PORT
  367.   # If true, enables https://golang.org/pkg/net/http/pprof/ debug endpoints
  368.   debugEndpoints: false # ENV: KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS
  370. # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
  371. dpServer:
  372.   # Port of the DP Server
  373.   port: 5678 # ENV: KUMA_DP_SERVER_PORT
  374.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  375.   tlsCertFile: # ENV: KUMA_DP_SERVER_TLS_CERT_FILE
  376.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  377.   tlsKeyFile: # ENV: KUMA_DP_SERVER_TLS_KEY_FILE
  378.   # Auth defines an authentication configuration for the DP Server
  379.   auth:
  380.     # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  381.     # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  382.     type: "" # ENV: KUMA_DP_SERVER_AUTH_TYPE
  383.   # Hds defines a Health Discovery Service configuration
  384.   hds:
  385.     # Enabled if true then Envoy will actively check application's ports, but only on Universal.
  386.     # On Kubernetes this feature disabled for now regardless the flag value
  387.     enabled: true # ENV: KUMA_DP_SERVER_HDS_ENABLED
  388.     # Interval for Envoy to send statuses for HealthChecks
  389.     interval: 5s # ENV: KUMA_DP_SERVER_HDS_INTERVAL
  390.     # RefreshInterval is an interval for re-genarting configuration for Dataplanes connected to the Control Plane
  391.     refreshInterval: 10s # ENV: KUMA_DP_SERVER_HDS_REFRESH_INTERVAL
  392.     # Check defines a HealthCheck configuration
  393.     checkDefaults:
  394.       # Timeout is a time to wait for a health check response. If the timeout is reached the
  395.       # health check attempt will be considered a failure
  396.       timeout: 2s # ENV: KUMA_DP_SERVER_HDS_CHECK_TIMEOUT
  397.       # Interval between health checks
  398.       interval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_INTERVAL
  399.       # NoTrafficInterval is a special health check interval that is used when a cluster has
  400.       #    never had traffic routed to it
  401.       noTrafficInterval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_NO_TRAFFIC_INTERVAL
  402.       # HealthyThreshold is a number of healthy health checks required before a host is marked healthy
  403.       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
  404.       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
  405.       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
  407. # Access Control configuration
  408. access:
  409.   # Type of access strategy (available values: "static")
  410.   type: static
  411.   # Configuration of static access strategy
  412.   static:
  413.     # AdminResources defines an access to admin resources (Secret/GlobalSecret)
  414.     adminResources:
  415.       # List of users that are allowed to access admin resources
  416.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_USERS
  417.       # List of groups that are allowed to access admin resources
  418.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_GROUPS
  419.     # GenerateDPToken defines an access to generating dataplane token
  420.     generateDpToken:
  421.       # List of users that are allowed to generate dataplane token
  422.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_USERS
  423.       # List of groups that are allowed to generate dataplane token
  424.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_GROUPS
  425.     # GenerateUserToken defines an access to generating user token
  426.     generateUserToken:
  427.       # List of users that are allowed to generate user token
  428.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_USERS
  429.       # List of groups that are allowed to generate user token
  430.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_GROUPS
  431.     # GenerateZoneToken defines an access to generating zone token
  432.     generateZoneToken:
  433.       # List of users that are allowed to generate zone token
  434.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_USERS
  435.       # List of groups that are allowed to generate zone token
  436.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
  437.     viewConfigDump:
  438.       # List of users that are allowed to get envoy config dump
  439.       users: [ ] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
  440.       # List of groups that are allowed to get envoy config dump
  441.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
  443. # Configuration of experimental features of Kuma
  444. experimental:
  445.   # If true, experimental Gateway API is enabled
  446.   gatewayAPI: false # ENV: KUMA_EXPERIMENTAL_GATEWAY_API
  447.   # If true, instead of embedding kubernetes outbounds into Dataplane object, they are persisted next to VIPs in ConfigMap
  448.   # This can improve performance, but it should be enabled only after all instances are migrated to version that supports this config
  449.   kubeOutboundsAsVIPs: false # ENV: KUMA_EXPERIMENTAL_KUBE_OUTBOUNDS_AS_VIPS