Control-Plane configuration

Here are all options to configure the control-plane:

  1. # Environment type. Available values are: "kubernetes" or "universal"
  2. environment: universal # ENV: KUMA_ENVIRONMENT
  3. # Mode in which Kuma CP is running. Available values are: "standalone", "global", "zone"
  4. mode: standalone # ENV: KUMA_MODE
  6. # Resource Store configuration
  7. store:
  8.   # Type of Store used in the Control Plane. Available values are: "kubernetes", "postgres" or "memory"
  9.   type: memory # ENV: KUMA_STORE_TYPE
  11.   # Kubernetes Store configuration (used when store.type=kubernetes)
  12.   kubernetes:
  13.     # Namespace where Control Plane is installed to.
  14.     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
  16.   # Postgres Store configuration (used when store.type=postgres)
  17.   postgres:
  18.     # Host of the Postgres DB
  19.     host: 127.0.0.1 # ENV: KUMA_STORE_POSTGRES_HOST
  20.     # Port of the Postgres DB
  21.     port: 15432 # ENV: KUMA_STORE_POSTGRES_PORT
  22.     # User of the Postgres DB
  23.     user: kuma # ENV: KUMA_STORE_POSTGRES_USER
  24.     # Password of the Postgres DB
  25.     password: kuma # ENV: KUMA_STORE_POSTGRES_PASSWORD
  26.     # Database name of the Postgres DB
  27.     dbName: kuma # ENV: KUMA_STORE_POSTGRES_DB_NAME
  28.     # Connection Timeout to the DB in seconds
  29.     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
  30.     # Maximum number of open connections to the database
  31.     # `0` value means number of open connections is unlimited
  32.     maxOpenConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS
  33.     # Maximum number of connections in the idle connection pool
  34.     # <0 value means no idle connections and 0 means default max idle connections
  35.     maxIdleConnections: 50  # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
  36.     # TLS settings
  37.     tls:
  38.       # Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  39.       mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  40.       # Path to TLS Certificate of the client. Used in verifyCa and verifyFull modes
  41.       certPath: # ENV: KUMA_STORE_POSTGRES_TLS_CERT_PATH
  42.       # Path to TLS Key of the client. Used in verifyCa and verifyFull modes
  43.       keyPath: # ENV: KUMA_STORE_POSTGRES_TLS_KEY_PATH
  44.       # Path to the root certificate. Used in verifyCa and verifyFull modes.
  45.       caPath: # ENV: KUMA_STORE_POSTGRES_TLS_ROOT_CERT_PATH
  46.     # MinReconnectInterval controls the duration to wait before trying to
  47.     # re-establish the database connection after connection loss. After each
  48.     # consecutive failure this interval is doubled, until MaxReconnectInterval
  49.     # is reached. Successfully completing the connection establishment procedure
  50.     # resets the interval back to MinReconnectInterval.
  51.     minReconnectInterval: "10s" # ENV: KUMA_STORE_POSTGRES_MIN_RECONNECT_INTERVAL
  52.     # MaxReconnectInterval controls the maximum possible duration to wait before trying
  53.     # to re-establish the database connection after connection loss.
  54.     maxReconnectInterval: "60s" # ENV: KUMA_STORE_POSTGRES_MAX_RECONNECT_INTERVAL
  56.   # Cache for read only operations. This cache is local to the instance of the control plane.
  57.   cache:
  58.     # If true then cache is enabled
  59.     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
  60.     # Expiration time for elements in cache.
  61.     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
  63.   # Upsert (get and update) configuration
  64.   upsert:
  65.     # Base time for exponential backoff on upsert operations when retry is enabled
  66.     conflictRetryBaseBackoff: 100ms # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_BASE_BACKOFF
  67.     # Max retries on upsert (get and update) operation when retry is enabled
  68.     conflictRetryMaxTimes: 5 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
  70.   # If true, skips validation of resource delete.
  71.   # For example you don't have to delete all Dataplane objects before you delete a Mesh
  72.   unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
  74. # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
  75. bootstrapServer:
  76.   # Parameters of bootstrap configuration
  77.   params:
  78.     # Address of Envoy Admin
  79.     adminAddress: 127.0.0.1 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ADDRESS
  80.     # Port of Envoy Admin
  81.     adminPort: 9901 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT
  82.     # Path to access log file of Envoy Admin
  83.     adminAccessLogPath: /dev/null # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ACCESS_LOG_PATH
  84.     # Host of XDS Server. By default it is the same host as the one used by kuma-dp to connect to the control plane
  85.     xdsHost: "" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST
  86.     # Port of XDS Server. By default it is autoconfigured from KUMA_DP_SERVER_PORT
  87.     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
  88.     # Connection timeout to the XDS Server
  89.     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
  91. #  Monitoring Assignment Discovery Service (MADS) server configuration
  92. monitoringAssignmentServer:
  93.   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
  94.   port: 5676 # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_PORT
  95.   # Which MADS API versions to serve
  96.   apiVersions: ["v1"] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_API_VERSIONS
  97.   # Interval for re-generating monitoring assignments for clients connected to the Control Plane.
  98.   assignmentRefreshInterval: 1s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL
  99.   # The default timeout for a single fetch-based discovery request, if not specified
  100.   defaultFetchTimeout: 30s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_DEFAULT_FETCH_TIMEOUT
  101.   # Path to TLS certificate file
  102.   tlsCertFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CERT_FILE
  103.   # Path to TLS key file
  104.   tlsKeyFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_KEY_FILE
  105.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  106.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MIN_VERSION
  107.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  108.   tlsMaxVersion: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MAX_VERSION
  109.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  110.   tlsCipherSuites: [] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CIPHER_SUITES
  112. # Envoy XDS server configuration
  113. xdsServer:
  114.   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
  115.   dataplaneConfigurationRefreshInterval: 1s # ENV: KUMA_XDS_SERVER_DATAPLANE_CONFIGURATION_REFRESH_INTERVAL
  116.   # Interval for flushing status of Dataplanes connected to the Control Plane
  117.   dataplaneStatusFlushInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_STATUS_FLUSH_INTERVAL
  118.   # Backoff that is executed when Control Plane is sending the response that was previously rejected by Dataplane
  119.   nackBackoff: 5s # ENV: KUMA_XDS_SERVER_NACK_BACKOFF
  120.   # A delay between proxy terminating a connection and the CP trying to deregister the proxy.
  121.   # It is used only in universal mode when you use direct lifecycle.
  122.   # Setting this setting to 0s disables the delay.
  123.   # Disabling this may cause race conditions that one instance of CP removes proxy object
  124.   # while proxy is connected to another instance of the CP.
  125.   dataplaneDeregistrationDelay: 10s # ENV: KUMA_XDS_DATAPLANE_DEREGISTRATION_DELAY
  127. # API Server configuration
  128. apiServer:
  129.   # HTTP configuration of the API Server
  130.   http:
  131.     # If true then API Server will be served on HTTP
  132.     enabled: true # ENV: KUMA_API_SERVER_HTTP_ENABLED
  133.     # Network interface on which HTTP API Server will be exposed
  134.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTP_INTERFACE
  135.     # Port of the API Server
  136.     port: 5681 # ENV: KUMA_API_SERVER_HTTP_PORT
  137.   # HTTPS configuration of the API Server
  138.   https:
  139.     # If true then API Server will be served on HTTPS
  140.     enabled: true # ENV: KUMA_API_SERVER_HTTPS_ENABLED
  141.     # Network interface on which HTTPS API Server will be exposed
  142.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTPS_INTERFACE
  143.     # Port of the HTTPS API Server
  144.     port: 5682 # ENV: KUMA_API_SERVER_HTTPS_PORT
  145.     # Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
  146.     tlsCertFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
  147.     # Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
  148.     tlsKeyFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
  149.     # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  150.     tlsMinVersion: "TLSv1_2" # ENV: KUMA_API_SERVER_HTTPS_TLS_MIN_VERSION
  151.     # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  152.     tlsMaxVersion: # ENV: KUMA_API_SERVER_HTTPS_TLS_MAX_VERSION
  153.     # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  154.     tlsCipherSuites: [] # ENV: KUMA_API_SERVER_HTTPS_TLS_CIPHER_SUITES
  155.   # Authentication configuration for administrative endpoints like Dataplane Token or managing Secrets
  156.   auth:
  157.     # Directory of authorized client certificates (only validate in HTTPS)
  158.     clientCertsDir: "" # ENV: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
  159.   # Api Server Authentication configuration
  160.   authn:
  161.     # Type of authentication mechanism (available values: "adminClientCerts", "tokens")
  162.     type: tokens # ENV: KUMA_API_SERVER_AUTHN_TYPE
  163.     # Localhost is authenticated as a user admin of group admin
  164.     localhostIsAdmin: true # ENV: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
  165.     # Configuration for tokens authentication
  166.     tokens:
  167.       # If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma secret
  168.       bootstrapAdminToken: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_BOOTSTRAP_ADMIN_TOKEN
  169.   # If true, then API Server will operate in read only mode (serving GET requests)
  170.   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
  171.   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
  172.   corsAllowedDomains:
  173.     - ".*" # ENV: KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
  175. # Environment-specific configuration
  176. runtime:
  177.   # Kubernetes-specific configuration
  178.   kubernetes:
  179.     # Service name of the Kuma Control Plane. It is used to point Kuma DP to proper URL.
  180.     controlPlaneServiceName: kuma-control-plane # ENV: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
  181.     # Name of Service Account that is used to run the Control Plane
  182.     serviceAccountName: "system:serviceaccount:kuma-system:kuma-control-plane" # ENV: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
  183.     # Taint controller that prevents applications from scheduling until CNI is ready.
  184.     nodeTaintController:
  185.       # If true enables the taint controller.
  186.       enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_ENABLED
  187.       # Value of app label on CNI pod that indicates if node can be ready.
  188.       cniApp: "" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_APP
  189.     # Admission WebHook Server configuration
  190.     admissionServer:
  191.       # Address the Admission WebHook Server should be listening on
  192.       address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
  193.       # Port the Admission WebHook Server should be listening on
  194.       port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
  195.       # Directory with a TLS cert and private key for the Admission WebHook Server.
  196.       # TLS certificate file must be named `tls.crt`.
  197.       # TLS key file must be named `tls.key`.
  198.       certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
  199.     # Injector defines configuration of a Kuma Sidecar Injector.
  200.     injector:
  201.       # if true runs kuma-cp in CNI compatible mode
  202.       cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
  203.       # list of exceptions for Kuma injection
  204.       exceptions:
  205.         # a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
  206.         labels:
  207.           openshift.io/build.name: "*"
  208.           openshift.io/deployer-pod-for.name: "*"
  209.       # VirtualProbesEnabled enables automatic converting HttpGet probes to virtual. Virtual probe
  210.       #    serves on sub-path of insecure port 'virtualProbesPort',
  211.       #    i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
  212.       virtualProbesEnabled: true # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
  213.       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
  214.       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
  215.       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
  216.       caCertFile:  # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
  217.       # SidecarContainer defines configuration of the Kuma sidecar container.
  218.       sidecarContainer:
  219.         # Image name.
  220.         image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
  221.         # Redirect port for inbound traffic.
  222.         redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
  223.         # Redirect port for inbound traffic.
  224.         redirectPortInboundV6: 15010 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND_V6
  225.         # Redirect port for outbound traffic.
  226.         redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
  227.         # User ID.
  228.         uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
  229.         # Group ID.
  230.         gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
  231.         # Drain time for listeners.
  232.         drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
  233.         # Readiness probe.
  234.         readinessProbe:
  235.           # Number of seconds after the container has started before readiness probes are initiated.
  236.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
  237.           # Number of seconds after which the probe times out.
  238.           timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
  239.           # Number of seconds after which the probe times out.
  240.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
  241.           # Minimum consecutive successes for the probe to be considered successful after having failed.
  242.           successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
  243.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  244.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
  245.         # Liveness probe.
  246.         livenessProbe:
  247.           # Number of seconds after the container has started before liveness probes are initiated.
  248.           initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
  249.           # Number of seconds after which the probe times out.
  250.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
  251.           # How often (in seconds) to perform the probe.
  252.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
  253.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  254.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
  255.         # Compute resource requirements.
  256.         resources:
  257.           # Minimum amount of compute resources required.
  258.           requests:
  259.             # CPU, in cores. (500m = .5 cores)
  260.             cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
  261.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  262.             memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
  263.           # Maximum amount of compute resources allowed.
  264.           limits:
  265.             # CPU, in cores. (500m = .5 cores)
  266.             cpu: 1000m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
  267.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  268.             memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
  269.         # Additional environment variables that can be placed on Kuma DP sidecar
  270.         envVars: {} # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ENV_VARS
  271.       # InitContainer defines configuration of the Kuma init container
  272.       initContainer:
  273.         # Image name.
  274.         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
  275.       # ContainerPatches is an optional list of ContainerPatch names which will be applied
  276.       # to init and sidecar containers if workload is not annotated with a patch list.
  277.       containerPatches: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
  278.       # Configuration for a traffic that is intercepted by sidecar
  279.       sidecarTraffic:
  280.         # List of inbound ports that will be excluded from interception.
  281.         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
  282.         excludeInboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
  283.         # List of outbound ports that will be excluded from interception.
  284.         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
  285.         excludeOutboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
  286.       builtinDNS:
  287.         # Use the built-in DNS
  288.         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
  289.         # Redirect port for DNS
  290.         port: 15053 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_PORT
  291.       transparentProxyV2: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_TRANSPARENT_PROXY_V2
  292.       # EBPF defines configuration for the ebpf, when transparent proxy is marked to be
  293.       # installed using ebpf instead of iptables
  294.       ebpf:
  295.         # Install transparent proxy using ebpf
  296.         enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_ENABLED
  297.         # Name of the environmental variable which will include IP address of the pod
  298.         instanceIPEnvVarName: INSTANCE_IP # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_INSTANCE_IP_ENV_VAR_NAME
  299.         # Path where BPF file system will be mounted for pinning ebpf programs and maps
  300.         bpffsPath: /sys/fs/bpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
  301.         # Path of mounted cgroup2
  302.         cgroupPath: /sys/fs/cgroup # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH
  303.         # Name of the network interface which should be used to attach to it TC programs
  304.         # when not specified, we will try to automatically determine it
  305.         tcAttachIface: "" # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_TC_ATTACH_IFACE
  306.         # Path where compiled eBPF programs are placed
  307.         programsSourcePath: /kuma/ebpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_PROGRAMS_SOURCE_PATH
  308.     marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
  309.   # Universal-specific configuration
  310.   universal:
  311.     # DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
  312.     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
  314. # Default Kuma entities configuration
  315. defaults:
  316.   # If true, it skips creating the default Mesh
  317.   skipMeshCreation: false # ENV: KUMA_DEFAULTS_SKIP_MESH_CREATION
  318.   # If true, instead of providing inbound clusters with address of dataplane, generates cluster with localhost.
  319.   # Enabled can cause security threat by exposing application listing on localhost. This configuration is going to
  320.   # be removed in the future.
  321.   enableLocalhostInboundClusters: false #ENV: KUMA_DEFAULTS_ENABLE_LOCALHOST_INBOUND_CLUSTERS
  323. # Metrics configuration
  324. metrics:
  325.   dataplane:
  326.     # How many latest subscriptions will be stored in DataplaneInsight object, if equals 0 then unlimited
  327.     subscriptionLimit: 2 # ENV: KUMA_METRICS_DATAPLANE_SUBSCRIPTION_LIMIT
  328.     # How long data plane proxy can stay Online without active xDS connection
  329.     idleTimeout: 5m # ENV: KUMA_METRICS_DATAPLANE_IDLE_TIMEOUT
  330.   zone:
  331.     # How many latest subscriptions will be stored in ZoneInsights object, if equals 0 then unlimited
  332.     subscriptionLimit: 10 # ENV: KUMA_METRICS_ZONE_SUBSCRIPTION_LIMIT
  333.     # How long zone can stay Online without active KDS connection
  334.     idleTimeout: 5m # ENV: KUMA_METRICS_ZONE_IDLE_TIMEOUT
  335.   mesh:
  336.     # Min time that should pass between MeshInsight resync
  337.     minResyncTimeout: 1s # ENV: KUMA_METRICS_MESH_MIN_RESYNC_TIMEOUT
  338.     # Max time that MeshInsight could spend without resync
  339.     maxResyncTimeout: 20s # ENV: KUMA_METRICS_MESH_MAX_RESYNC_TIMEOUT
  341. # Reports configuration
  342. reports:
  343.   # If true then usage stats will be reported
  344.   enabled: false # ENV: KUMA_REPORTS_ENABLED
  346. # General configuration
  347. general:
  348.   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
  349.   dnsCacheTTL: 10s # ENV: KUMA_GENERAL_DNS_CACHE_TTL
  350.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert that will be used across all the Kuma Servers.
  351.   tlsCertFile: # ENV: KUMA_GENERAL_TLS_CERT_FILE
  352.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key that will be used across all the Kuma Servers.
  353.   tlsKeyFile: # ENV: KUMA_GENERAL_TLS_KEY_FILE
  354.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  355.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_GENERAL_TLS_MIN_VERSION
  356.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  357.   tlsMaxVersion: # ENV: KUMA_GENERAL_TLS_MAX_VERSION
  358.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  359.   tlsCipherSuites: [] # ENV: KUMA_GENERAL_TLS_CIPHER_SUITES
  360.   # WorkDir defines a path to the working directory
  361.   # Kuma stores in this directory autogenerated entities like certificates.
  362.   # If empty then the working directory is $HOME/.kuma
  363.   workDir: "" # ENV: KUMA_GENERAL_WORK_DIR
  365. # DNS Server configuration
  366. dnsServer:
  367.   # The domain that the server will resolve the services for
  368.   domain: "mesh" # ENV: KUMA_DNS_SERVER_DOMAIN
  369.   # The CIDR range used to allocate
  370.   CIDR: "240.0.0.0/4" # ENV: KUMA_DNS_SERVER_CIDR
  371.   # Will create a service "<kuma.io/service>.mesh" dns entry for every service.
  372.   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
  373.   # The port to use along with the `<kuma.io/service>.mesh` dns entry
  374.   serviceVipPort: 80 # ENV: KUMA_DNS_SERVICE_SERVICE_VIP_PORT
  376. # Multizone mode
  377. multizone:
  378.   global:
  379.     kds:
  380.       # Port of a gRPC server that serves Kuma Discovery Service (KDS).
  381.       grpcPort: 5685 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_GRPC_PORT
  382.       # Interval for refreshing state of the world
  383.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_REFRESH_INTERVAL
  384.       # Interval for flushing Zone Insights (stats of multi-zone communication)
  385.       zoneInsightFlushInterval: 10s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_ZONE_INSIGHT_FLUSH_INTERVAL
  386.       # TlsCertFile defines a path to a file with PEM-encoded TLS cert.
  387.       tlsCertFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
  388.       # TlsKeyFile defines a path to a file with PEM-encoded TLS key.
  389.       tlsKeyFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
  390.       # TlsMinVersion the minimum version of TLS
  391.       tlsMinVersion: "TLSv1_2" # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MIN_VERSION
  392.       # TlsMaxVersion the maximum version of TLS
  393.       tlsMaxVersion: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MAX_VERSION
  394.       # TlsCipherSuites the list of cipher suites
  395.       tlsCipherSuites: [] # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CIPHER_SUITES
  396.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  397.       # In practice this means a limit on full list of one resource type.
  398.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MAX_MSG_SIZE
  399.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  400.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  401.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MSG_SEND_TIMEOUT
  402.   zone:
  403.     # Kuma Zone name used to mark the zone dataplane resources
  404.     name: "" # ENV: KUMA_MULTIZONE_ZONE_NAME
  405.     # GlobalAddress URL of Global Kuma CP
  406.     globalAddress: # ENV KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
  407.     kds:
  408.       # Interval for refreshing state of the world
  409.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_KDS_REFRESH_INTERVAL
  410.       # RootCAFile defines a path to a file with PEM-encoded Root CA. Client will verify server by using it.
  411.       rootCaFile: # ENV: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
  412.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  413.       # In practice this means a limit on full list of one resource type.
  414.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_ZONE_KDS_MAX_MSG_SIZE
  415.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  416.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  417.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_ZONE_KDS_MSG_SEND_TIMEOUT
  419. # Diagnostics configuration
  420. diagnostics:
  421.   # Port of Diagnostic Server for checking health and readiness of the Control Plane
  422.   serverPort: 5680 # ENV: KUMA_DIAGNOSTICS_SERVER_PORT
  423.   # If true, enables https://golang.org/pkg/net/http/pprof/ debug endpoints
  424.   debugEndpoints: false # ENV: KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS
  426. # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
  427. dpServer:
  428.   # Port of the DP Server
  429.   port: 5678 # ENV: KUMA_DP_SERVER_PORT
  430.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  431.   tlsCertFile: # ENV: KUMA_DP_SERVER_TLS_CERT_FILE
  432.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  433.   tlsKeyFile: # ENV: KUMA_DP_SERVER_TLS_KEY_FILE
  434.   # TlsMinVersion the minimum version of TLS
  435.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_DP_SERVER_TLS_MIN_VERSION
  436.   # TlsMaxVersion the maximum version of TLS
  437.   tlsMaxVersion: # ENV: KUMA_DP_SERVER_TLS_MAX_VERSION
  438.   # TlsCipherSuites the list of cipher suites
  439.   tlsCipherSuites: [] # ENV: KUMA_DP_SERVER_TLS_CIPHER_SUITES
  440.   # Auth defines an authentication configuration for the DP Server
  441.   auth:
  442.     # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  443.     # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  444.     type: "" # ENV: KUMA_DP_SERVER_AUTH_TYPE
  445.   # Hds defines a Health Discovery Service configuration
  446.   hds:
  447.     # Enabled if true then Envoy will actively check application's ports, but only on Universal.
  448.     # On Kubernetes this feature disabled for now regardless the flag value
  449.     enabled: true # ENV: KUMA_DP_SERVER_HDS_ENABLED
  450.     # Interval for Envoy to send statuses for HealthChecks
  451.     interval: 5s # ENV: KUMA_DP_SERVER_HDS_INTERVAL
  452.     # RefreshInterval is an interval for re-genarting configuration for Dataplanes connected to the Control Plane
  453.     refreshInterval: 10s # ENV: KUMA_DP_SERVER_HDS_REFRESH_INTERVAL
  454.     # Check defines a HealthCheck configuration
  455.     checkDefaults:
  456.       # Timeout is a time to wait for a health check response. If the timeout is reached the
  457.       # health check attempt will be considered a failure
  458.       timeout: 2s # ENV: KUMA_DP_SERVER_HDS_CHECK_TIMEOUT
  459.       # Interval between health checks
  460.       interval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_INTERVAL
  461.       # NoTrafficInterval is a special health check interval that is used when a cluster has
  462.       #    never had traffic routed to it
  463.       noTrafficInterval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_NO_TRAFFIC_INTERVAL
  464.       # HealthyThreshold is a number of healthy health checks required before a host is marked healthy
  465.       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
  466.       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
  467.       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
  469. # Access Control configuration
  470. access:
  471.   # Type of access strategy (available values: "static")
  472.   type: static
  473.   # Configuration of static access strategy
  474.   static:
  475.     # AdminResources defines an access to admin resources (Secret/GlobalSecret)
  476.     adminResources:
  477.       # List of users that are allowed to access admin resources
  478.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_USERS
  479.       # List of groups that are allowed to access admin resources
  480.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_GROUPS
  481.     # GenerateDPToken defines an access to generating dataplane token
  482.     generateDpToken:
  483.       # List of users that are allowed to generate dataplane token
  484.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_USERS
  485.       # List of groups that are allowed to generate dataplane token
  486.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_GROUPS
  487.     # GenerateUserToken defines an access to generating user token
  488.     generateUserToken:
  489.       # List of users that are allowed to generate user token
  490.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_USERS
  491.       # List of groups that are allowed to generate user token
  492.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_GROUPS
  493.     # GenerateZoneToken defines an access to generating zone token
  494.     generateZoneToken:
  495.       # List of users that are allowed to generate zone token
  496.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_USERS
  497.       # List of groups that are allowed to generate zone token
  498.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
  499.     viewConfigDump:
  500.       # List of users that are allowed to get envoy config dump
  501.       users: [ ] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
  502.       # List of groups that are allowed to get envoy config dump
  503.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
  504.     viewStats:
  505.       # List of users that are allowed to get envoy stats
  506.       users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
  507.       # List of groups that are allowed to get envoy stats
  508.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
  509.     viewClusters:
  510.       # List of users that are allowed to get envoy clusters
  511.       users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
  512.       # List of groups that are allowed to get envoy clusters
  513.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
  515. # Configuration of experimental features of Kuma
  516. experimental:
  517.   # If true, experimental Gateway API is enabled
  518.   gatewayAPI: false # ENV: KUMA_EXPERIMENTAL_GATEWAY_API
  519.   # If true, instead of embedding kubernetes outbounds into Dataplane object, they are persisted next to VIPs in ConfigMap
  520.   # This can improve performance, but it should be enabled only after all instances are migrated to version that supports this config
  521.   kubeOutboundsAsVIPs: false # ENV: KUMA_EXPERIMENTAL_KUBE_OUTBOUNDS_AS_VIPS
  523. proxy:
  524.   gateway:
  525.     # Sets the envoy runtime value to limit maximum number of incoming
  526.     # connections to a builtin gateway data plane proxy
  527.     globalDownstreamMaxConnections: 50000 # ENV: KUMA_PROXY_GATEWAY_GLOBAL_DOWNSTREAM_MAX_CONNECTIONS