Helm

To install and run Kuma on Kubernetes with Helm charts execute the following steps:

1. Add the Kuma charts repository
2. Run Kuma
3. Use Kuma

Finally you can follow the Quickstart to take it from here and continue your Kuma journey.

Please note that at least version 3.8.0 of Helm is required to use the Kuma Helm charts. If you are using an older version of Helm, please upgrade to version 3.8.0 first.

Kuma also provides an alternative Kubernetes distribution that we can use instead of Helm charts.

Add the Kuma charts repository

To start using Kuma with Helm charts, we first need to add the Kuma charts repository to our local Helm deployment:

helm repo add kuma https://kumahq.github.io/charts

Once the repo is added, all following updates can be fetched with helm repo update.

Run Kuma

At this point we can install and run Kuma using the following commands. We could use any Kubernetes namespace to install Kuma, by default we suggest using kuma-system:

helm install --create-namespace --namespace kuma-system kuma kuma/kuma

This example will run Kuma in standalone mode for a “flat” deployment, but there are more advanced deployment modes like “multi-zone”.

Use Kuma

Kuma (kuma-cp) will be installed in the newly created kuma-system namespace! Now that Kuma has been installed, you can access the control-plane via either the GUI, kubectl, the HTTP API, or the CLI:

GUI (Read-Only))
kubectl (Read & Write))
HTTP API (Read-Only))
kumactl (Read-Only))

Kuma ships with a read-only GUI that you can use to retrieve Kuma resources. By default the GUI listens on the API port and defaults to :5681/gui.

To access Kuma we need to first port-forward the API service with:

kubectl port-forward svc/kuma-control-plane -n kuma-system 5681:5681

And then navigate to 127.0.0.1:5681/gui to see the GUI.

You can use Kuma with kubectl to perform read and write operations on Kuma resources. For example:

kubectl get meshes
# NAME          AGE
# default       1m

or you can enable mTLS on the default Mesh with:

echo "apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  mtls:
    enabledBackend: ca-1
    backends:
    - name: ca-1
      type: builtin" | kubectl apply -f -

Kuma ships with a read-only HTTP API that you can use to retrieve Kuma resources.

By default the HTTP API listens on port 5681. To access Kuma we need to first port-forward the API service with:

kubectl port-forward svc/kuma-control-plane -n kuma-system 5681:5681

And then you can navigate to 127.0.0.1:5681 to see the HTTP API.

You can use the kumactl CLI to perform read-only operations on Kuma resources. The kumactl binary is a client to the Kuma HTTP API, you will need to first port-forward the API service with:

kubectl port-forward svc/kuma-control-plane -n kuma-system 5681:5681

and then run kumactl, for example:

kumactl get meshes
# NAME          mTLS      METRICS      LOGGING   TRACING
# default       off       off          off       off

You can configure kumactl to point to any zone kuma-cp instance by running:

kumactl config control-planes add --name=XYZ --address=http://{address-to-kuma}:5681

You will notice that Kuma automatically creates a Mesh entity with name default.

Quickstart

Congratulations! You have successfully installed Kuma on Kubernetes 🚀.

In order to start using Kuma, it’s time to check out the quickstart guide for Kubernetes deployments.

Argo CD

Kuma requires a certificate to verify a connection between the control plane and a data plane proxy. Kuma Helm chart autogenerate self-signed certificate if the certificate isn’t explicitly set. Argo CD uses helm template to compare and apply Kubernetes YAMLs. Helm template doesn’t work with chart logic to verify if the certificate is present. This results in replacing the certificate on each Argo redeployment. The solution to this problem is to explicitly set the certificates. See “Data plane proxy to control plane communication” to learn how to preconfigure Kuma with certificates.