Control-Plane configuration

Here are all options to configure the control-plane:

  1. # Environment type. Available values are: "kubernetes" or "universal"
  2. environment: universal # ENV: KUMA_ENVIRONMENT
  3. # Mode in which Kuma CP is running. Available values are: "standalone", "global", "zone"
  4. mode: standalone # ENV: KUMA_MODE
  6. # Resource Store configuration
  7. store:
  8.   # Type of Store used in the Control Plane. Available values are: "kubernetes", "postgres" or "memory"
  9.   type: memory # ENV: KUMA_STORE_TYPE
  11.   # Kubernetes Store configuration (used when store.type=kubernetes)
  12.   kubernetes:
  13.     # Namespace where Control Plane is installed to.
  14.     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
  16.   # Postgres Store configuration (used when store.type=postgres)
  17.   postgres:
  18.     # Host of the Postgres DB
  19.     host: 127.0.0.1 # ENV: KUMA_STORE_POSTGRES_HOST
  20.     # Port of the Postgres DB
  21.     port: 15432 # ENV: KUMA_STORE_POSTGRES_PORT
  22.     # User of the Postgres DB
  23.     user: kuma # ENV: KUMA_STORE_POSTGRES_USER
  24.     # Password of the Postgres DB
  25.     password: kuma # ENV: KUMA_STORE_POSTGRES_PASSWORD
  26.     # Database name of the Postgres DB
  27.     dbName: kuma # ENV: KUMA_STORE_POSTGRES_DB_NAME
  28.     # Connection Timeout to the DB in seconds
  29.     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
  30.     # Maximum number of open connections to the database
  31.     # `0` value means number of open connections is unlimited
  32.     maxOpenConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS
  33.     # Maximum number of connections in the idle connection pool
  34.     # <0 value means no idle connections and 0 means default max idle connections
  35.     maxIdleConnections: 50  # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
  36.     # TLS settings
  37.     tls:
  38.       # Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  39.       mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  40.       # Path to TLS Certificate of the client. Used in verifyCa and verifyFull modes
  41.       certPath: # ENV: KUMA_STORE_POSTGRES_TLS_CERT_PATH
  42.       # Path to TLS Key of the client. Used in verifyCa and verifyFull modes
  43.       keyPath: # ENV: KUMA_STORE_POSTGRES_TLS_KEY_PATH
  44.       # Path to the root certificate. Used in verifyCa and verifyFull modes.
  45.       caPath: # ENV: KUMA_STORE_POSTGRES_TLS_ROOT_CERT_PATH
  46.     # MinReconnectInterval controls the duration to wait before trying to
  47.     # re-establish the database connection after connection loss. After each
  48.     # consecutive failure this interval is doubled, until MaxReconnectInterval
  49.     # is reached. Successfully completing the connection establishment procedure
  50.     # resets the interval back to MinReconnectInterval.
  51.     minReconnectInterval: "10s" # ENV: KUMA_STORE_POSTGRES_MIN_RECONNECT_INTERVAL
  52.     # MaxReconnectInterval controls the maximum possible duration to wait before trying
  53.     # to re-establish the database connection after connection loss.
  54.     maxReconnectInterval: "60s" # ENV: KUMA_STORE_POSTGRES_MAX_RECONNECT_INTERVAL
  56.   # Cache for read only operations. This cache is local to the instance of the control plane.
  57.   cache:
  58.     # If true then cache is enabled
  59.     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
  60.     # Expiration time for elements in cache.
  61.     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
  63.   # Upsert (get and update) configuration
  64.   upsert:
  65.     # Base time for exponential backoff on upsert operations when retry is enabled
  66.     conflictRetryBaseBackoff: 100ms # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_BASE_BACKOFF
  67.     # Max retries on upsert (get and update) operation when retry is enabled
  68.     conflictRetryMaxTimes: 5 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
  70.   # If true, skips validation of resource delete.
  71.   # For example you don't have to delete all Dataplane objects before you delete a Mesh
  72.   unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
  74. # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
  75. bootstrapServer:
  76.   # Parameters of bootstrap configuration
  77.   params:
  78.     # Address of Envoy Admin
  79.     adminAddress: 127.0.0.1 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ADDRESS
  80.     # Port of Envoy Admin
  81.     adminPort: 9901 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT
  82.     # Path to access log file of Envoy Admin
  83.     adminAccessLogPath: /dev/null # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ACCESS_LOG_PATH
  84.     # Host of XDS Server. By default it is the same host as the one used by kuma-dp to connect to the control plane
  85.     xdsHost: "" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST
  86.     # Port of XDS Server. By default it is autoconfigured from KUMA_DP_SERVER_PORT
  87.     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
  88.     # Connection timeout to the XDS Server
  89.     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
  91. #  Monitoring Assignment Discovery Service (MADS) server configuration
  92. monitoringAssignmentServer:
  93.   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
  94.   port: 5676 # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_PORT
  95.   # Which MADS API versions to serve
  96.   apiVersions: ["v1"] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_API_VERSIONS
  97.   # Interval for re-generating monitoring assignments for clients connected to the Control Plane.
  98.   assignmentRefreshInterval: 1s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL
  99.   # The default timeout for a single fetch-based discovery request, if not specified
  100.   defaultFetchTimeout: 30s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_DEFAULT_FETCH_TIMEOUT
  102. # Envoy XDS server configuration
  103. xdsServer:
  104.   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
  105.   dataplaneConfigurationRefreshInterval: 1s # ENV: KUMA_XDS_SERVER_DATAPLANE_CONFIGURATION_REFRESH_INTERVAL
  106.   # Interval for flushing status of Dataplanes connected to the Control Plane
  107.   dataplaneStatusFlushInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_STATUS_FLUSH_INTERVAL
  108.   # Backoff that is executed when Control Plane is sending the response that was previously rejected by Dataplane
  109.   nackBackoff: 5s # ENV: KUMA_XDS_SERVER_NACK_BACKOFF
  110.   # A delay between proxy terminating a connection and the CP trying to deregister the proxy.
  111.   # It is used only in universal mode when you use direct lifecycle.
  112.   # Setting this setting to 0s disables the delay.
  113.   # Disabling this may cause race conditions that one instance of CP removes proxy object
  114.   # while proxy is connected to another instance of the CP.
  115.   dataplaneDeregistrationDelay: 10s # ENV: KUMA_XDS_DATAPLANE_DEREGISTRATION_DELAY
  117. # API Server configuration
  118. apiServer:
  119.   # HTTP configuration of the API Server
  120.   http:
  121.     # If true then API Server will be served on HTTP
  122.     enabled: true # ENV: KUMA_API_SERVER_HTTP_ENABLED
  123.     # Network interface on which HTTP API Server will be exposed
  124.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTP_INTERFACE
  125.     # Port of the API Server
  126.     port: 5681 # ENV: KUMA_API_SERVER_HTTP_PORT
  127.   # HTTPS configuration of the API Server
  128.   https:
  129.     # If true then API Server will be served on HTTPS
  130.     enabled: true # ENV: KUMA_API_SERVER_HTTPS_ENABLED
  131.     # Network interface on which HTTPS API Server will be exposed
  132.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTPS_INTERFACE
  133.     # Port of the HTTPS API Server
  134.     port: 5682 # ENV: KUMA_API_SERVER_HTTPS_PORT
  135.     # Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
  136.     tlsCertFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
  137.     # Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
  138.     tlsKeyFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
  139.   # Authentication configuration for administrative endpoints like Dataplane Token or managing Secrets
  140.   auth:
  141.     # Directory of authorized client certificates (only validate in HTTPS)
  142.     clientCertsDir: "" # ENV: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
  143.   # Api Server Authentication configuration
  144.   authn:
  145.     # Type of authentication mechanism (available values: "adminClientCerts", "tokens")
  146.     type: tokens # ENV: KUMA_API_SERVER_AUTHN_TYPE
  147.     # Localhost is authenticated as a user admin of group admin
  148.     localhostIsAdmin: true # ENV: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
  149.     # Configuration for tokens authentication
  150.     tokens:
  151.       # If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma secret
  152.       bootstrapAdminToken: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_BOOTSTRAP_ADMIN_TOKEN
  153.   # If true, then API Server will operate in read only mode (serving GET requests)
  154.   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
  155.   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
  156.   corsAllowedDomains:
  157.     - ".*" # ENV: KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
  159. # Environment-specific configuration
  160. runtime:
  161.   # Kubernetes-specific configuration
  162.   kubernetes:
  163.     # Service name of the Kuma Control Plane. It is used to point Kuma DP to proper URL.
  164.     controlPlaneServiceName: kuma-control-plane # ENV: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
  165.     # Name of Service Account that is used to run the Control Plane
  166.     serviceAccountName: "system:serviceaccount:kuma-system:kuma-control-plane" # ENV: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
  167.     # Taint controller that prevents applications from scheduling until CNI is ready.
  168.     nodeTaintController:
  169.       # If true enables the taint controller.
  170.       enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_ENABLED
  171.       # Value of app label on CNI pod that indicates if node can be ready.
  172.       cniApp: "" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_APP
  173.     # Admission WebHook Server configuration
  174.     admissionServer:
  175.       # Address the Admission WebHook Server should be listening on
  176.       address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
  177.       # Port the Admission WebHook Server should be listening on
  178.       port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
  179.       # Directory with a TLS cert and private key for the Admission WebHook Server.
  180.       # TLS certificate file must be named `tls.crt`.
  181.       # TLS key file must be named `tls.key`.
  182.       certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
  183.     # Injector defines configuration of a Kuma Sidecar Injector.
  184.     injector:
  185.       # if true runs kuma-cp in CNI compatible mode
  186.       cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
  187.       # list of exceptions for Kuma injection
  188.       exceptions:
  189.         # a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
  190.         labels:
  191.           openshift.io/build.name: "*"
  192.           openshift.io/deployer-pod-for.name: "*"
  193.       # VirtualProbesEnabled enables automatic converting HttpGet probes to virtual. Virtual probe
  194.       #    serves on sub-path of insecure port 'virtualProbesPort',
  195.       #    i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
  196.       virtualProbesEnabled: true # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
  197.       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
  198.       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
  199.       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
  200.       caCertFile:  # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
  201.       # SidecarContainer defines configuration of the Kuma sidecar container.
  202.       sidecarContainer:
  203.         # Image name.
  204.         image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
  205.         # Redirect port for inbound traffic.
  206.         redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
  207.         # Redirect port for inbound traffic.
  208.         redirectPortInboundV6: 15010 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND_V6
  209.         # Redirect port for outbound traffic.
  210.         redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
  211.         # User ID.
  212.         uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
  213.         # Group ID.
  214.         gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
  215.         # Drain time for listeners.
  216.         drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
  217.         # Readiness probe.
  218.         readinessProbe:
  219.           # Number of seconds after the container has started before readiness probes are initiated.
  220.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
  221.           # Number of seconds after which the probe times out.
  222.           timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
  223.           # Number of seconds after which the probe times out.
  224.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
  225.           # Minimum consecutive successes for the probe to be considered successful after having failed.
  226.           successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
  227.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  228.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
  229.         # Liveness probe.
  230.         livenessProbe:
  231.           # Number of seconds after the container has started before liveness probes are initiated.
  232.           initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
  233.           # Number of seconds after which the probe times out.
  234.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
  235.           # How often (in seconds) to perform the probe.
  236.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
  237.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  238.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
  239.         # Compute resource requirements.
  240.         resources:
  241.           # Minimum amount of compute resources required.
  242.           requests:
  243.             # CPU, in cores. (500m = .5 cores)
  244.             cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
  245.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  246.             memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
  247.           # Maximum amount of compute resources allowed.
  248.           limits:
  249.             # CPU, in cores. (500m = .5 cores)
  250.             cpu: 1000m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
  251.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  252.             memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
  253.         # Additional environment variables that can be placed on Kuma DP sidecar
  254.         envVars: {} # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ENV_VARS
  255.       # InitContainer defines configuration of the Kuma init container
  256.       initContainer:
  257.         # Image name.
  258.         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
  259.       # ContainerPatches is an optional list of ContainerPatch names which will be applied
  260.       # to init and sidecar containers if workload is not annotated with a patch list.
  261.       containerPatches: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
  262.       # Configuration for a traffic that is intercepted by sidecar
  263.       sidecarTraffic:
  264.         # List of inbound ports that will be excluded from interception.
  265.         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
  266.         excludeInboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
  267.         # List of outbound ports that will be excluded from interception.
  268.         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
  269.         excludeOutboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
  270.       builtinDNS:
  271.         # Use the built-in DNS
  272.         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
  273.         # Redirect port for DNS
  274.         port: 15053 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_PORT
  275.     marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
  276.   # Universal-specific configuration
  277.   universal:
  278.     # DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
  279.     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
  281. # Default Kuma entities configuration
  282. defaults:
  283.   # If true, it skips creating the default Mesh
  284.   skipMeshCreation: false # ENV: KUMA_DEFAULTS_SKIP_MESH_CREATION
  285.   # If true, instead of providing inbound clusters with address of dataplane, generates cluster with localhost.
  286.   # Enabled can cause security threat by exposing application listing on localhost. This configuration is going to
  287.   # be removed in the future.
  288.   enableLocalhostInboundClusters: false #ENV: KUMA_DEFAULTS_ENABLE_LOCALHOST_INBOUND_CLUSTERS
  290. # Metrics configuration
  291. metrics:
  292.   dataplane:
  293.     # Enables collecting metrics from Dataplane
  294.     enabled: true # ENV: KUMA_METRICS_DATAPLANE_ENABLED
  295.     # How many latest subscriptions will be stored in DataplaneInsight object, if equals 0 then unlimited
  296.     subscriptionLimit: 2 # ENV: KUMA_METRICS_DATAPLANE_SUBSCRIPTION_LIMIT
  297.     # How long data plane proxy can stay Online without active xDS connection
  298.     idleTimeout: 5m # ENV: KUMA_METRICS_DATAPLANE_IDLE_TIMEOUT
  299.   zone:
  300.     # Enables collecting metrics from Zone
  301.     enabled: true # ENV: KUMA_METRICS_ZONE_ENABLED
  302.     # How many latest subscriptions will be stored in ZoneInsights object, if equals 0 then unlimited
  303.     subscriptionLimit: 10 # ENV: KUMA_METRICS_ZONE_SUBSCRIPTION_LIMIT
  304.     # How long zone can stay Online without active KDS connection
  305.     idleTimeout: 5m # ENV: KUMA_METRICS_ZONE_IDLE_TIMEOUT
  306.   mesh:
  307.     # Min time that should pass between MeshInsight resync
  308.     minResyncTimeout: 1s # ENV: KUMA_METRICS_MESH_MIN_RESYNC_TIMEOUT
  309.     # Max time that MeshInsight could spend without resync
  310.     maxResyncTimeout: 20s # ENV: KUMA_METRICS_MESH_MAX_RESYNC_TIMEOUT
  312. # Reports configuration
  313. reports:
  314.   # If true then usage stats will be reported
  315.   enabled: false # ENV: KUMA_REPORTS_ENABLED
  317. # General configuration
  318. general:
  319.   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
  320.   dnsCacheTTL: 10s # ENV: KUMA_GENERAL_DNS_CACHE_TTL
  321.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert that will be used across all the Kuma Servers.
  322.   tlsCertFile: # ENV: KUMA_GENERAL_TLS_CERT_FILE
  323.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key that will be used across all the Kuma Servers.
  324.   tlsKeyFile: # ENV: KUMA_GENERAL_TLS_KEY_FILE
  325.   # WorkDir defines a path to the working directory
  326.   # Kuma stores in this directory autogenerated entities like certificates.
  327.   # If empty then the working directory is $HOME/.kuma
  328.   workDir: "" # ENV: KUMA_GENERAL_WORK_DIR
  330. # DNS Server configuration
  331. dnsServer:
  332.   # The domain that the server will resolve the services for
  333.   domain: "mesh" # ENV: KUMA_DNS_SERVER_DOMAIN
  334.   # The CIDR range used to allocate
  335.   CIDR: "240.0.0.0/4" # ENV: KUMA_DNS_SERVER_CIDR
  336.   # Will create a service "<kuma.io/service>.mesh" dns entry for every service.
  337.   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
  339. # Multizone mode
  340. multizone:
  341.   global:
  342.     kds:
  343.       # Port of a gRPC server that serves Kuma Discovery Service (KDS).
  344.       grpcPort: 5685 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_GRPC_PORT
  345.       # Interval for refreshing state of the world
  346.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_REFRESH_INTERVAL
  347.       # Interval for flushing Zone Insights (stats of multi-zone communication)
  348.       zoneInsightFlushInterval: 10s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_ZONE_INSIGHT_FLUSH_INTERVAL
  349.       # TlsCertFile defines a path to a file with PEM-encoded TLS cert.
  350.       tlsCertFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
  351.       # TTlsKeyFile defines a path to a file with PEM-encoded TLS key.
  352.       tlsKeyFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
  353.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  354.       # In practice this means a limit on full list of one resource type.
  355.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MAX_MSG_SIZE
  356.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  357.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  358.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MSG_SEND_TIMEOUT
  359.   zone:
  360.     # Kuma Zone name used to mark the zone dataplane resources
  361.     name: "" # ENV: KUMA_MULTIZONE_ZONE_NAME
  362.     # GlobalAddress URL of Global Kuma CP
  363.     globalAddress: # ENV KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
  364.     kds:
  365.       # Interval for refreshing state of the world
  366.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_KDS_REFRESH_INTERVAL
  367.       # RootCAFile defines a path to a file with PEM-encoded Root CA. Client will verify server by using it.
  368.       rootCaFile: # ENV: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
  369.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  370.       # In practice this means a limit on full list of one resource type.
  371.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_ZONE_KDS_MAX_MSG_SIZE
  372.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  373.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  374.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_ZONE_KDS_MSG_SEND_TIMEOUT
  376. # Diagnostics configuration
  377. diagnostics:
  378.   # Port of Diagnostic Server for checking health and readiness of the Control Plane
  379.   serverPort: 5680 # ENV: KUMA_DIAGNOSTICS_SERVER_PORT
  380.   # If true, enables https://golang.org/pkg/net/http/pprof/ debug endpoints
  381.   debugEndpoints: false # ENV: KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS
  383. # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
  384. dpServer:
  385.   # Port of the DP Server
  386.   port: 5678 # ENV: KUMA_DP_SERVER_PORT
  387.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  388.   tlsCertFile: # ENV: KUMA_DP_SERVER_TLS_CERT_FILE
  389.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  390.   tlsKeyFile: # ENV: KUMA_DP_SERVER_TLS_KEY_FILE
  391.   # Auth defines an authentication configuration for the DP Server
  392.   auth:
  393.     # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  394.     # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  395.     type: "" # ENV: KUMA_DP_SERVER_AUTH_TYPE
  396.   # Hds defines a Health Discovery Service configuration
  397.   hds:
  398.     # Enabled if true then Envoy will actively check application's ports, but only on Universal.
  399.     # On Kubernetes this feature disabled for now regardless the flag value
  400.     enabled: true # ENV: KUMA_DP_SERVER_HDS_ENABLED
  401.     # Interval for Envoy to send statuses for HealthChecks
  402.     interval: 5s # ENV: KUMA_DP_SERVER_HDS_INTERVAL
  403.     # RefreshInterval is an interval for re-genarting configuration for Dataplanes connected to the Control Plane
  404.     refreshInterval: 10s # ENV: KUMA_DP_SERVER_HDS_REFRESH_INTERVAL
  405.     # Check defines a HealthCheck configuration
  406.     checkDefaults:
  407.       # Timeout is a time to wait for a health check response. If the timeout is reached the
  408.       # health check attempt will be considered a failure
  409.       timeout: 2s # ENV: KUMA_DP_SERVER_HDS_CHECK_TIMEOUT
  410.       # Interval between health checks
  411.       interval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_INTERVAL
  412.       # NoTrafficInterval is a special health check interval that is used when a cluster has
  413.       #    never had traffic routed to it
  414.       noTrafficInterval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_NO_TRAFFIC_INTERVAL
  415.       # HealthyThreshold is a number of healthy health checks required before a host is marked healthy
  416.       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
  417.       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
  418.       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
  420. # Access Control configuration
  421. access:
  422.   # Type of access strategy (available values: "static")
  423.   type: static
  424.   # Configuration of static access strategy
  425.   static:
  426.     # AdminResources defines an access to admin resources (Secret/GlobalSecret)
  427.     adminResources:
  428.       # List of users that are allowed to access admin resources
  429.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_USERS
  430.       # List of groups that are allowed to access admin resources
  431.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_GROUPS
  432.     # GenerateDPToken defines an access to generating dataplane token
  433.     generateDpToken:
  434.       # List of users that are allowed to generate dataplane token
  435.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_USERS
  436.       # List of groups that are allowed to generate dataplane token
  437.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_GROUPS
  438.     # GenerateUserToken defines an access to generating user token
  439.     generateUserToken:
  440.       # List of users that are allowed to generate user token
  441.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_USERS
  442.       # List of groups that are allowed to generate user token
  443.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_GROUPS
  444.     # GenerateZoneToken defines an access to generating zone token
  445.     generateZoneToken:
  446.       # List of users that are allowed to generate zone token
  447.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_USERS
  448.       # List of groups that are allowed to generate zone token
  449.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
  450.     viewConfigDump:
  451.       # List of users that are allowed to get envoy config dump
  452.       users: [ ] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
  453.       # List of groups that are allowed to get envoy config dump
  454.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
  455.     viewStats:
  456.       # List of users that are allowed to get envoy stats
  457.       users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
  458.       # List of groups that are allowed to get envoy stats
  459.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
  460.     viewClusters:
  461.       # List of users that are allowed to get envoy clusters
  462.       users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
  463.       # List of groups that are allowed to get envoy clusters
  464.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
  466. # Configuration of experimental features of Kuma
  467. experimental:
  468.   # If true, experimental Gateway API is enabled
  469.   gatewayAPI: false # ENV: KUMA_EXPERIMENTAL_GATEWAY_API
  470.   # If true, instead of embedding kubernetes outbounds into Dataplane object, they are persisted next to VIPs in ConfigMap
  471.   # This can improve performance, but it should be enabled only after all instances are migrated to version that supports this config
  472.   kubeOutboundsAsVIPs: false # ENV: KUMA_EXPERIMENTAL_KUBE_OUTBOUNDS_AS_VIPS
  474. proxy:
  475.   gateway:
  476.     # Sets the envoy runtime value to limit maximum number of incoming
  477.     # connections to a builtin gateway data plane proxy
  478.     globalDownstreamMaxConnections: 50000 # ENV: KUMA_PROXY_GATEWAY_GLOBAL_DOWNSTREAM_MAX_CONNECTIONS