kuma-cp configuration reference

Kuma CP configuration

  1. # Environment type. Available values are: "kubernetes" or "universal"
  2. environment: universal # ENV: KUMA_ENVIRONMENT
  3. # Mode in which Kuma CP is running. Available values are: "global", "zone", "standalone" (deprecated, use "zone")
  4. mode: zone # ENV: KUMA_MODE
  6. # Resource Store configuration
  7. store:
  8.   # Type of Store used in the Control Plane. Available values are: "kubernetes", "postgres" or "memory"
  9.   type: memory # ENV: KUMA_STORE_TYPE
  11.   # Kubernetes Store configuration (used when store.type=kubernetes)
  12.   kubernetes:
  13.     # Namespace where Control Plane is installed to.
  14.     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
  16.   # Postgres Store configuration (used when store.type=postgres)
  17.   postgres:
  18.     # Host of the Postgres DB
  19.     host: 127.0.0.1 # ENV: KUMA_STORE_POSTGRES_HOST
  20.     # Port of the Postgres DB
  21.     port: 15432 # ENV: KUMA_STORE_POSTGRES_PORT
  22.     # User of the Postgres DB
  23.     user: kuma # ENV: KUMA_STORE_POSTGRES_USER
  24.     # Password of the Postgres DB
  25.     password: kuma # ENV: KUMA_STORE_POSTGRES_PASSWORD
  26.     # Database name of the Postgres DB
  27.     dbName: kuma # ENV: KUMA_STORE_POSTGRES_DB_NAME
  28.     # Driver to use, one of: pgx, postgres
  29.     driverName: pgx # ENV: KUMA_STORE_POSTGRES_DRIVER_NAME
  30.     # Connection Timeout to the DB in seconds
  31.     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
  32.     # MaxConnectionLifetime (applied only when driverName=pgx) is the duration since creation after which a connection will be automatically closed
  33.     maxConnectionLifetime: "1h" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME
  34.     # MaxConnectionLifetimeJitter (applied only when driverName=pgx) is the duration after maxConnectionLifetime to randomly decide to close a connection.
  35.     # This helps prevent all connections from being closed at the exact same time, starving the pool.
  36.     maxConnectionLifetimeJitter: "1m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME_JITTER
  37.     # HealthCheckInterval (applied only when driverName=pgx) is the duration between checks of the health of idle connections.
  38.     healthCheckInterval: "30s" # ENV: KUMA_STORE_POSTGRES_HEALTH_CHECK_INTERVAL
  39.     # MinOpenConnections (applied only when driverName=pgx) is the minimum number of open connections to the database
  40.     minOpenConnections: 0 # ENV: KUMA_STORE_POSTGRES_MIN_OPEN_CONNECTIONS
  41.     # MaxOpenConnections is the maximum number of open connections to the database
  42.     # `0` value means number of open connections is unlimited
  43.     maxOpenConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS
  44.     # MaxIdleConnections is the maximum number of connections in the idle connection pool
  45.     # <0 value means no idle connections and 0 means default max idle connections.
  46.     # Deprecated: it's only used when driverName=postgres (lib/pq) which is deprecated, use driverName=pgx instead.
  47.     maxIdleConnections: 50  # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
  48.     # MaxListQueryElements defines maximum number of changed elements before requesting full list of elements from the store.
  49.     maxListQueryElements: 0 # ENV: KUMA_STORE_POSTGRES_MAX_LIST_QUERY_ELEMENTS
  50.     # TLS settings
  51.     tls:
  52.       # Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  53.       mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  54.       # Path to TLS Certificate of the client. Required when server has METHOD=cert
  55.       certPath: # ENV: KUMA_STORE_POSTGRES_TLS_CERT_PATH
  56.       # Path to TLS Key of the client. Required when server has METHOD=cert
  57.       keyPath: # ENV: KUMA_STORE_POSTGRES_TLS_KEY_PATH
  58.       # Path to the root certificate. Used in verifyCa and verifyFull modes.
  59.       caPath: # ENV: KUMA_STORE_POSTGRES_TLS_ROOT_CERT_PATH
  60.     # MinReconnectInterval controls the duration to wait before trying to
  61.     # re-establish the database connection after connection loss. After each
  62.     # consecutive failure this interval is doubled, until MaxReconnectInterval
  63.     # is reached. Successfully completing the connection establishment procedure
  64.     # resets the interval back to MinReconnectInterval.
  65.     # Deprecated: it's only used when driverName=postgres (lib/pq) which is deprecated, use driverName=pgx instead.
  66.     minReconnectInterval: "10s" # ENV: KUMA_STORE_POSTGRES_MIN_RECONNECT_INTERVAL
  67.     # MaxReconnectInterval controls the maximum possible duration to wait before trying
  68.     # to re-establish the database connection after connection loss.
  69.     # Deprecated: it's only used when driverName=postgres (lib/pq) which is deprecated, use driverName=pgx instead.
  70.     maxReconnectInterval: "60s" # ENV: KUMA_STORE_POSTGRES_MAX_RECONNECT_INTERVAL
  71.     # ReadReplica is a setting for a DB replica used only for read queries
  72.     readReplica:
  73.       # Host of the Postgres DB read replica. If not set, read replica is not used.
  74.       host: "" # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_HOST
  75.       # Port of the Postgres DB read replica
  76.       port: 5432 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_PORT
  77.       # Ratio in [0-100] range. How many SELECT queries (out of 100) will use read replica.
  78.       ratio: 100 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_RATIO
  80.   # Cache for read only operations. This cache is local to the instance of the control plane.
  81.   cache:
  82.     # If true then cache is enabled
  83.     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
  84.     # Expiration time for elements in cache.
  85.     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
  87.   # Upsert (get and update) configuration
  88.   upsert:
  89.     # Base time for exponential backoff on upsert operations when retry is enabled
  90.     conflictRetryBaseBackoff: 200ms # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_BASE_BACKOFF
  91.     # Max retries on upsert (get and update) operation when retry is enabled
  92.     conflictRetryMaxTimes: 10 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
  93.     # Percentage of jitter. For example: if backoff is 20s, and this value 10, the backoff will be between 18s and 22s.
  94.     conflictRetryJitterPercent: 30 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_JITTER_PERCENT
  96.   # If true, skips validation of resource delete.
  97.   # For example you don't have to delete all Dataplane objects before you delete a Mesh
  98.   unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
  100. # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
  101. bootstrapServer:
  102.   # Parameters of bootstrap configuration
  103.   params:
  104.     # Address of Envoy Admin
  105.     adminAddress: 127.0.0.1 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ADDRESS
  106.     # Port of Envoy Admin
  107.     adminPort: 9901 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT
  108.     # Path to access log file of Envoy Admin
  109.     adminAccessLogPath: /dev/null # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ACCESS_LOG_PATH
  110.     # Host of XDS Server. By default it is the same host as the one used by kuma-dp to connect to the control plane
  111.     xdsHost: "" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST
  112.     # Port of XDS Server. By default it is autoconfigured from KUMA_DP_SERVER_PORT
  113.     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
  114.     # Connection timeout to the XDS Server
  115.     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
  117. #  Monitoring Assignment Discovery Service (MADS) server configuration
  118. monitoringAssignmentServer:
  119.   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
  120.   port: 5676 # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_PORT
  121.   # Which MADS API versions to serve
  122.   apiVersions: ["v1"] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_API_VERSIONS
  123.   # Interval for re-generating monitoring assignments for clients connected to the Control Plane.
  124.   assignmentRefreshInterval: 1s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL
  125.   # The default timeout for a single fetch-based discovery request, if not specified
  126.   defaultFetchTimeout: 30s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_DEFAULT_FETCH_TIMEOUT
  127.   # Path to TLS certificate file
  128.   tlsCertFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CERT_FILE
  129.   # Path to TLS key file
  130.   tlsKeyFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_KEY_FILE
  131.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  132.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MIN_VERSION
  133.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  134.   tlsMaxVersion: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MAX_VERSION
  135.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  136.   tlsCipherSuites: [] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CIPHER_SUITES
  138. # Envoy XDS server configuration
  139. xdsServer:
  140.   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
  141.   dataplaneConfigurationRefreshInterval: 1s # ENV: KUMA_XDS_SERVER_DATAPLANE_CONFIGURATION_REFRESH_INTERVAL
  142.   # Interval for flushing status of Dataplanes connected to the Control Plane
  143.   dataplaneStatusFlushInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_STATUS_FLUSH_INTERVAL
  144.   # Backoff that is executed when Control Plane is sending the response that was previously rejected by Dataplane
  145.   nackBackoff: 5s # ENV: KUMA_XDS_SERVER_NACK_BACKOFF
  146.   # A delay between proxy terminating a connection and the CP trying to deregister the proxy.
  147.   # It is used only in universal mode when you use direct lifecycle.
  148.   # Setting this setting to 0s disables the delay.
  149.   # Disabling this may cause race conditions that one instance of CP removes proxy object
  150.   # while proxy is connected to another instance of the CP.
  151.   dataplaneDeregistrationDelay: 10s # ENV: KUMA_XDS_DATAPLANE_DEREGISTRATION_DELAY
  153. # API Server configuration
  154. apiServer:
  155.   # HTTP configuration of the API Server
  156.   http:
  157.     # If true then API Server will be served on HTTP
  158.     enabled: true # ENV: KUMA_API_SERVER_HTTP_ENABLED
  159.     # Network interface on which HTTP API Server will be exposed
  160.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTP_INTERFACE
  161.     # Port of the API Server
  162.     port: 5681 # ENV: KUMA_API_SERVER_HTTP_PORT
  163.   # HTTPS configuration of the API Server
  164.   https:
  165.     # If true then API Server will be served on HTTPS
  166.     enabled: true # ENV: KUMA_API_SERVER_HTTPS_ENABLED
  167.     # Network interface on which HTTPS API Server will be exposed
  168.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTPS_INTERFACE
  169.     # Port of the HTTPS API Server
  170.     port: 5682 # ENV: KUMA_API_SERVER_HTTPS_PORT
  171.     # Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
  172.     tlsCertFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
  173.     # Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
  174.     tlsKeyFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
  175.     # Path to the CA certificate which is used to sign client certificates. It is used only for verifying client certificates.
  176.     tlsCaFile: "" # ENV: KUMA_API_SERVER_HTTPS_CLIENT_CERTS_CA_FILE
  177.     # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  178.     tlsMinVersion: "TLSv1_2" # ENV: KUMA_API_SERVER_HTTPS_TLS_MIN_VERSION
  179.     # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  180.     tlsMaxVersion: # ENV: KUMA_API_SERVER_HTTPS_TLS_MAX_VERSION
  181.     # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  182.     tlsCipherSuites: [] # ENV: KUMA_API_SERVER_HTTPS_TLS_CIPHER_SUITES
  183.     # If true, then HTTPS connection will require client cert.
  184.     requireClientCert: false # ENV: KUMA_API_SERVER_HTTPS_REQUIRE_CLIENT_CERT
  185.   # Authentication configuration for administrative endpoints like Dataplane Token or managing Secrets
  186.   auth:
  187.     # Directory of authorized client certificates (only validate in HTTPS)
  188.     clientCertsDir: "" # ENV: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
  189.   # Api Server Authentication configuration
  190.   authn:
  191.     # Type of authentication mechanism (available values: "adminClientCerts", "tokens")
  192.     type: tokens # ENV: KUMA_API_SERVER_AUTHN_TYPE
  193.     # Localhost is authenticated as a user admin of group admin
  194.     localhostIsAdmin: true # ENV: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
  195.     # Configuration for tokens authentication
  196.     tokens:
  197.       # If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma secret
  198.       bootstrapAdminToken: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_BOOTSTRAP_ADMIN_TOKEN
  199.       # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  200.       enableIssuer: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_ENABLE_ISSUER
  201.       # Token validator configuration
  202.       validator:
  203.         # If true then Kuma secrets with prefix "user-token-signing-key" are considered as signing keys.
  204.         useSecrets: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_VALIDATOR_USE_SECRETS
  205.         # List of public keys used to validate the token. Example:
  206.         # - kid: 1
  207.         #   key: |
  208.         #     -----BEGIN RSA PUBLIC KEY-----
  209.         #     MIIBCgKCAQEAq....
  210.         #     -----END RSA PUBLIC KEY-----
  211.         # - kid: 2
  212.         #   keyFile: /keys/public.pem
  213.         publicKeys: []
  215.   # If true, then API Server will operate in read only mode (serving GET requests)
  216.   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
  217.   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
  218.   corsAllowedDomains:
  219.     - ".*" # ENV: KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
  220.   # Can be used if you use a reverse proxy
  221.   rootUrl: "" # ENV: KUMA_API_SERVER_ROOT_URL
  222.   # The path to serve the API from
  223.   basePath: "/" # ENV: KUMA_API_SERVER_BASE_PATH
  224.   # configuration specific to the GUI
  225.   gui:
  226.     # Whether to serve the gui (if mode=zone this has no effect)
  227.     enabled: true # ENV: KUMA_API_SERVER_GUI_ENABLED
  228.     # Can be used if you use a reverse proxy or want to serve the gui from a different path
  229.     rootUrl: "" # ENV: KUMA_API_SERVER_GUI_ROOT_URL
  230.     # The path to serve the GUI from
  231.     basePath: "/gui" # ENV: KUMA_API_SERVER_GUI_BASE_PATH
  233. # Environment-specific configuration
  234. runtime:
  235.   # Kubernetes-specific configuration
  236.   kubernetes:
  237.     # Service name of the Kuma Control Plane. It is used to point Kuma DP to proper URL.
  238.     controlPlaneServiceName: kuma-control-plane # ENV: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
  239.     # Name of Service Account that is used to run the Control Plane
  240.     serviceAccountName: "system:serviceaccount:kuma-system:kuma-control-plane" # ENV: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
  241.     # Taint controller that prevents applications from scheduling until CNI is ready.
  242.     nodeTaintController:
  243.       # If true enables the taint controller.
  244.       enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_ENABLED
  245.       # Value of app label on CNI pod that indicates if node can be ready.
  246.       cniApp: "" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_APP
  247.       # Value of CNI namespace.
  248.       cniNamespace: "kube-system" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_NAMESPACE
  249.     # Admission WebHook Server configuration
  250.     admissionServer:
  251.       # Address the Admission WebHook Server should be listening on
  252.       address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
  253.       # Port the Admission WebHook Server should be listening on
  254.       port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
  255.       # Directory with a TLS cert and private key for the Admission WebHook Server.
  256.       # TLS certificate file must be named `tls.crt`.
  257.       # TLS key file must be named `tls.key`.
  258.       certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
  259.     # Injector defines configuration of a Kuma Sidecar Injector.
  260.     injector:
  261.       # if true runs kuma-cp in CNI compatible mode
  262.       cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
  263.       # list of exceptions for Kuma injection
  264.       exceptions:
  265.         # a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
  266.         labels:
  267.           openshift.io/build.name: "*"
  268.           openshift.io/deployer-pod-for.name: "*"
  269.       # VirtualProbesEnabled enables automatic converting HttpGet probes to virtual. Virtual probe
  270.       #    serves on sub-path of insecure port 'virtualProbesPort',
  271.       #    i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
  272.       virtualProbesEnabled: true # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
  273.       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
  274.       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
  275.       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
  276.       caCertFile:  # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
  277.       # SidecarContainer defines configuration of the Kuma sidecar container.
  278.       sidecarContainer:
  279.         # Image name.
  280.         image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
  281.         # Redirect port for inbound traffic.
  282.         redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
  283.         # Redirect port for inbound traffic.
  284.         redirectPortInboundV6: 15010 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND_V6
  285.         # Redirect port for outbound traffic.
  286.         redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
  287.         # User ID.
  288.         uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
  289.         # Group ID.
  290.         gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
  291.         # Drain time for listeners.
  292.         drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
  293.         # Readiness probe.
  294.         readinessProbe:
  295.           # Number of seconds after the container has started before readiness probes are initiated.
  296.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
  297.           # Number of seconds after which the probe times out.
  298.           timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
  299.           # Number of seconds after which the probe times out.
  300.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
  301.           # Minimum consecutive successes for the probe to be considered successful after having failed.
  302.           successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
  303.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  304.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
  305.         # Liveness probe.
  306.         livenessProbe:
  307.           # Number of seconds after the container has started before liveness probes are initiated.
  308.           initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
  309.           # Number of seconds after which the probe times out.
  310.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
  311.           # How often (in seconds) to perform the probe.
  312.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
  313.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  314.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
  315.         # Compute resource requirements.
  316.         resources:
  317.           # Minimum amount of compute resources required.
  318.           requests:
  319.             # CPU, in cores. (500m = .5 cores)
  320.             cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
  321.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  322.             memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
  323.           # Maximum amount of compute resources allowed.
  324.           limits:
  325.             # CPU, in cores. (500m = .5 cores)
  326.             cpu: 1000m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
  327.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  328.             memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
  329.         # Additional environment variables that can be placed on Kuma DP sidecar
  330.         envVars: {} # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ENV_VARS
  331.         # If true, it enables a postStart script that waits until Envoy is ready.
  332.         # With the current Kubernetes behavior, any other container in the Pod will wait until the script is complete.
  333.         waitForDataplaneReady: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_WAIT_FOR_DATAPLANE_READY
  334.       # InitContainer defines configuration of the Kuma init container
  335.       initContainer:
  336.         # Image name.
  337.         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
  338.       # ContainerPatches is an optional list of ContainerPatch names which will be applied
  339.       # to init and sidecar containers if workload is not annotated with a patch list.
  340.       containerPatches: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
  341.       # Configuration for a traffic that is intercepted by sidecar
  342.       sidecarTraffic:
  343.         # List of inbound ports that will be excluded from interception.
  344.         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
  345.         excludeInboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
  346.         # List of outbound ports that will be excluded from interception.
  347.         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
  348.         excludeOutboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
  349.       builtinDNS:
  350.         # Use the built-in DNS
  351.         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
  352.         # Redirect port for DNS
  353.         port: 15053 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_PORT
  354.         # Enable coredns query logging if true
  355.         logging: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_LOGGING
  356.       # EBPF defines configuration for the ebpf, when transparent proxy is marked to be
  357.       # installed using ebpf instead of iptables
  358.       ebpf:
  359.         # Install transparent proxy using ebpf
  360.         enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_ENABLED
  361.         # Name of the environmental variable which will include IP address of the pod
  362.         instanceIPEnvVarName: INSTANCE_IP # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_INSTANCE_IP_ENV_VAR_NAME
  363.         # Path where BPF file system will be mounted for pinning ebpf programs and maps
  364.         bpffsPath: /sys/fs/bpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
  365.         # Path of mounted cgroup2
  366.         cgroupPath: /sys/fs/cgroup # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH
  367.         # Name of the network interface which should be used to attach to it TC programs
  368.         # when not specified, we will try to automatically determine it
  369.         tcAttachIface: "" # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_TC_ATTACH_IFACE
  370.         # Path where compiled eBPF programs are placed
  371.         programsSourcePath: /kuma/ebpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_PROGRAMS_SOURCE_PATH
  372.       # IgnoredServiceSelectorLabels defines a list ignored labels in Service selector.
  373.       # If Pod matches a Service with ignored labels, but does not match it fully, it gets Ignored inbound.
  374.       # It is useful when you change Service selector and expect traffic to be sent immediately.
  375.       # An example of this is ArgoCD's BlueGreen deployment and "rollouts-pod-template-hash" selector.
  376.       ignoredServiceSelectorLabels: [] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_IGNORED_SERVICE_SELECTOR_LABELS
  377.     marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
  378.     # Kubernetes's resources reconciliation concurrency configuration
  379.     controllersConcurrency:
  380.       # PodController defines maximum concurrent reconciliations of Pod resources
  381.       # Default value 10. If set to 0 kube controller-runtime default value of 1 will be used.
  382.       podController: 10 # ENV: KUMA_RUNTIME_KUBERNETES_CONTROLLERS_CONCURRENCY_POD_CONTROLLER
  383.     # Kubernetes client configuration
  384.     clientConfig:
  385.       # Qps defines maximum requests kubernetes client is allowed to make per second.
  386.       # Default value 100. If set to 0 kube-client default value of 5 will be used.
  387.       qps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_QPS
  388.       # BurstQps defines maximum burst requests kubernetes client is allowed to make per second
  389.       # Default value 100. If set to 0 kube-client default value of 10 will be used.
  390.       burstQps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_BURST_QPS
  391.     leaderElection:
  392.       # LeaseDuration is the duration that non-leader candidates will
  393.       # wait to force acquire leadership. This is measured against time of
  394.       # last observed ack. Default is 15 seconds.
  395.       leaseDuration: 15s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_LEASE_DURATION
  396.       # RenewDeadline is the duration that the acting controlplane will retry
  397.       # refreshing leadership before giving up. Default is 10 seconds.
  398.       renewDeadline: 10s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_RENEW_DEADLINE
  399.   # Universal-specific configuration
  400.   universal:
  401.     # DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
  402.     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
  403.     # VIPRefreshInterval defines how often all meshes' VIPs should be recomputed
  404.     vipRefreshInterval: 500ms # ENV: KUMA_RUNTIME_UNIVERSAL_VIP_REFRESH_INTERVAL
  406. # Default Kuma entities configuration
  407. defaults:
  408.   # If true, it skips creating the default Mesh
  409.   skipMeshCreation: false # ENV: KUMA_DEFAULTS_SKIP_MESH_CREATION
  410.   # If true, it skips creating the default tenant resources
  411.   skipTenantResources: false # ENV: KUMA_DEFAULTS_SKIP_TENANT_RESOURCES
  412.   # If true, it creates the default routing (TrafficPermisson and TrafficRoute) resources for a new Mesh
  413.   createMeshRoutingResources: false # ENV: KUMA_DEFAULTS_CREATE_MESH_ROUTING_RESOURCES
  415. # Metrics configuration
  416. metrics:
  417.   dataplane:
  418.     # How many latest subscriptions will be stored in DataplaneInsight object, if equals 0 then unlimited
  419.     subscriptionLimit: 2 # ENV: KUMA_METRICS_DATAPLANE_SUBSCRIPTION_LIMIT
  420.     # How long data plane proxy can stay Online without active xDS connection
  421.     idleTimeout: 5m # ENV: KUMA_METRICS_DATAPLANE_IDLE_TIMEOUT
  422.   zone:
  423.     # How many latest subscriptions will be stored in ZoneInsights object, if equals 0 then unlimited
  424.     subscriptionLimit: 10 # ENV: KUMA_METRICS_ZONE_SUBSCRIPTION_LIMIT
  425.     # How long zone can stay Online without active KDS connection
  426.     idleTimeout: 5m # ENV: KUMA_METRICS_ZONE_IDLE_TIMEOUT
  427.     # Compact finished metrics (do not store config and details of KDS exchange).
  428.     compactFinishedSubscriptions: false # ENV: KUMA_METRICS_ZONE_COMPACT_FINISHED_SUBSCRIPTIONS
  429.   mesh:
  430.     # Minimum time between 2 refresh of insights
  431.     minResyncInterval: 1s # ENV: KUMA_METRICS_MESH_MIN_RESYNC_INTERVAL
  432.     # time between triggering a full refresh of all the insights
  433.     fullResyncInterval: 20s # ENV: KUMA_METRICS_MESH_FULL_RESYNC_INTERVAL
  434.     # the size of the buffer between event creation and processing
  435.     bufferSize: 1000 # ENV: KUMA_METRICS_MESH_BUFFER_SIZE
  436.     # the number of workers that process metrics events
  437.     eventProcessors: 1 # ENV: KUMA_METRICS_MESH_EVENT_PROCESSORS
  438.   controlPlane:
  439.     # If true metrics show number of resources in the system should be reported
  440.     reportResourcesCount: true # ENV: KUMA_METRICS_CONTROL_PLANE_REPORT_RESOURCES_COUNT
  442. # Reports configuration
  443. reports:
  444.   # If true then usage stats will be reported
  445.   enabled: false # ENV: KUMA_REPORTS_ENABLED
  447. # General configuration
  448. general:
  449.   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
  450.   dnsCacheTTL: 10s # ENV: KUMA_GENERAL_DNS_CACHE_TTL
  451.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert that will be used across all the Kuma Servers.
  452.   tlsCertFile: # ENV: KUMA_GENERAL_TLS_CERT_FILE
  453.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key that will be used across all the Kuma Servers.
  454.   tlsKeyFile: # ENV: KUMA_GENERAL_TLS_KEY_FILE
  455.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  456.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_GENERAL_TLS_MIN_VERSION
  457.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  458.   tlsMaxVersion: # ENV: KUMA_GENERAL_TLS_MAX_VERSION
  459.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  460.   tlsCipherSuites: [] # ENV: KUMA_GENERAL_TLS_CIPHER_SUITES
  461.   # WorkDir defines a path to the working directory
  462.   # Kuma stores in this directory autogenerated entities like certificates.
  463.   # If empty then the working directory is $HOME/.kuma
  464.   workDir: "" # ENV: KUMA_GENERAL_WORK_DIR
  466. # DNS Server configuration
  467. dnsServer:
  468.   # The domain that the server will resolve the services for
  469.   domain: "mesh" # ENV: KUMA_DNS_SERVER_DOMAIN
  470.   # The CIDR range used to allocate
  471.   CIDR: "240.0.0.0/4" # ENV: KUMA_DNS_SERVER_CIDR
  472.   # Will create a service "<kuma.io/service>.mesh" dns entry for every service.
  473.   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
  474.   # The port to use along with the `<kuma.io/service>.mesh` dns entry
  475.   serviceVipPort: 80 # ENV: KUMA_DNS_SERVICE_SERVICE_VIP_PORT
  477. # Multizone mode
  478. multizone:
  479.   global:
  480.     kds:
  481.       # Port of a gRPC server that serves Kuma Discovery Service (KDS).
  482.       grpcPort: 5685 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_GRPC_PORT
  483.       # Interval for refreshing state of the world
  484.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_REFRESH_INTERVAL
  485.       # Interval for flushing Zone Insights (stats of multi-zone communication)
  486.       zoneInsightFlushInterval: 10s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_ZONE_INSIGHT_FLUSH_INTERVAL
  487.       # TlsEnabled turns on TLS for KDS
  488.       tlsEnabled: true # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_ENABLED
  489.       # TlsCertFile defines a path to a file with PEM-encoded TLS cert.
  490.       tlsCertFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
  491.       # TlsKeyFile defines a path to a file with PEM-encoded TLS key.
  492.       tlsKeyFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
  493.       # TlsMinVersion the minimum version of TLS
  494.       tlsMinVersion: "TLSv1_2" # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MIN_VERSION
  495.       # TlsMaxVersion the maximum version of TLS
  496.       tlsMaxVersion: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MAX_VERSION
  497.       # TlsCipherSuites the list of cipher suites
  498.       tlsCipherSuites: [] # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CIPHER_SUITES
  499.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  500.       # In practice this means a limit on full list of one resource type.
  501.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MAX_MSG_SIZE
  502.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  503.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  504.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MSG_SEND_TIMEOUT
  505.       # Backoff that is executed when the global control plane is sending the response that was previously rejected by zone control plane
  506.       nackBackoff: 5s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_NACK_BACKOFF
  507.       # DisableSOTW if true doesn't expose SOTW version of KDS. Default: false
  508.       disableSOTW: false # ENV: KUMA_MULTIZONE_GLOBAL_KDS_DISABLE_SOTW
  509.       # Response backoff is a time Global CP waits before sending ACK/NACK.
  510.       # This is a way to slow down Zone CP from sending resources too often.
  511.       responseBackoff: 0s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_RESPONSE_BACKOFF
  512.   zone:
  513.     # Kuma Zone name used to mark the zone dataplane resources
  514.     name: "default" # ENV: KUMA_MULTIZONE_ZONE_NAME
  515.     # GlobalAddress URL of Global Kuma CP
  516.     globalAddress: # ENV KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
  517.     kds:
  518.       # Interval for refreshing state of the world
  519.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_KDS_REFRESH_INTERVAL
  520.       # RootCAFile defines a path to a file with PEM-encoded Root CA. Client will verify server by using it.
  521.       rootCaFile: # ENV: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
  522.       # If true, TLS connection to the server won't be verified.
  523.       tlsSkipVerify: false # ENV: KUMA_MULTIZONE_ZONE_KDS_TLS_SKIP_VERIFY
  524.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  525.       # In practice this means a limit on full list of one resource type.
  526.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_ZONE_KDS_MAX_MSG_SIZE
  527.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  528.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  529.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_ZONE_KDS_MSG_SEND_TIMEOUT
  530.       # Backoff that is executed when the zone control plane is sending the response that was previously rejected by global control plane
  531.       nackBackoff: 5s # ENV: KUMA_MULTIZONE_ZONE_KDS_NACK_BACKOFF
  532.       # Response backoff is a time Zone CP waits before sending ACK/NACK.
  533.       # This is a way to slow down Global CP from sending resources too often.
  534.       responseBackoff: 0s # ENV: KUMA_MULTIZONE_ZONE_KDS_RESPONSE_BACKOFF
  535.     # disableOriginLabelValidation disables validation of the origin label when applying resources on Zone CP
  536.     disableOriginLabelValidation: false # ENV: KUMA_MULTIZONE_ZONE_DISABLE_ORIGIN_LABEL_VALIDATION
  537.     # IngressUpdateInterval is the interval between the CP updating the list of
  538.     # available services on ZoneIngress.
  539.     ingressUpdateInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_INGRESS_UPDATE_INTERVAL
  541. # Diagnostics configuration
  542. diagnostics:
  543.   # Port of Diagnostic Server for checking health and readiness of the Control Plane
  544.   serverPort: 5680 # ENV: KUMA_DIAGNOSTICS_SERVER_PORT
  545.   # If true, enables https://golang.org/pkg/net/http/pprof/ debug endpoints
  546.   debugEndpoints: false # ENV: KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS
  547.   # Whether tls is enabled or not
  548.   tlsEnabled: false # ENV: KUMA_DIAGNOSTICS_TLS_ENABLED
  549.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  550.   tlsCertFile: # ENV: KUMA_DIAGNOSTICS_TLS_CERT_FILE
  551.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  552.   tlsKeyFile: # ENV: KUMA_DIAGNOSTICS_TLS_KEY_FILE
  553.   # TlsMinVersion the minimum version of TLS
  554.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_DIAGNOSTICS_TLS_MIN_VERSION
  555.   # TlsMaxVersion the maximum version of TLS
  556.   tlsMaxVersion: # ENV: KUMA_DIAGNOSTICS_TLS_MAX_VERSION
  557.   # TlsCipherSuites the list of cipher suites
  558.   tlsCipherSuites: [] # ENV: KUMA_DIAGNOSTICS_TLS_CIPHER_SUITES
  560. # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
  561. dpServer:
  562.   # Port of the DP Server
  563.   port: 5678 # ENV: KUMA_DP_SERVER_PORT
  564.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  565.   tlsCertFile: # ENV: KUMA_DP_SERVER_TLS_CERT_FILE
  566.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  567.   tlsKeyFile: # ENV: KUMA_DP_SERVER_TLS_KEY_FILE
  568.   # TlsMinVersion the minimum version of TLS
  569.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_DP_SERVER_TLS_MIN_VERSION
  570.   # TlsMaxVersion the maximum version of TLS
  571.   tlsMaxVersion: # ENV: KUMA_DP_SERVER_TLS_MAX_VERSION
  572.   # TlsCipherSuites the list of cipher suites
  573.   tlsCipherSuites: [] # ENV: KUMA_DP_SERVER_TLS_CIPHER_SUITES
  574.   # ReadHeaderTimeout defines the amount of time DP server will be allowed
  575.   # to read request headers. The connection's read deadline is reset
  576.   # after reading the headers and the Handler can decide what is considered
  577.   # too slow for the body. If ReadHeaderTimeout is zero there is no timeout.
  578.   # The timeout is configurable as in rare cases, when Kuma CP was restarting,
  579.   # 1s which is explicitly set in other servers was insufficient and DPs
  580.   # were failing to reconnect (we observed this in Projected Service Account
  581.   # Tokens e2e tests, which started flaking a lot after introducing explicit
  582.   # 1s timeout)
  583.   readHeaderTimeout: 5s # ENV: KUMA_DP_SERVER_READ_HEADER_TIMEOUT
  584.   # Auth defines an authentication configuration for the DP Server
  585.   # DEPRECATED: use "authn" section.
  586.   auth:
  587.     # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  588.     # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  589.     type: "" # ENV: KUMA_DP_SERVER_AUTH_TYPE
  590.   # Authn defines an authentication configuration for the DP Server
  591.   authn:
  592.     # Configuration for data plane proxy authentication.
  593.     dpProxy:
  594.       # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  595.       # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  596.       type: ""
  597.       # Configuration of dpToken authentication method
  598.       dpToken:
  599.         # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  600.         enableIssuer: true
  601.         # DP Token validator configuration.
  602.         validator:
  603.           # If true then Kuma secrets with prefix "dataplane-token-signing-key-{mesh}" are considered as signing keys.
  604.           useSecrets: true
  605.           # List of public keys used to validate the token. Example:
  606.           # - kid: 1
  607.           #   mesh: default
  608.           #   key: |
  609.           #     -----BEGIN RSA PUBLIC KEY-----
  610.           #     MIIBCgKCAQEAq....
  611.           #     -----END RSA PUBLIC KEY-----
  612.           # - kid: 2
  613.           #   mesh: demo
  614.           #   keyFile: /keys/public.pem
  615.           publicKeys: []
  616.     # Configuration for zone proxy authentication.
  617.     zoneProxy:
  618.       # Type of authentication. Available values: "serviceAccountToken", "zoneToken", "none".
  619.       # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "zoneToken" on Universal.
  620.       type: ""
  621.       # Configuration for zoneToken authentication method.
  622.       zoneToken:
  623.         # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  624.         enableIssuer: true
  625.         # Zone Token validator configuration.
  626.         validator:
  627.           # If true then Kuma secrets with prefix "zone-token-signing-key" are considered as signing keys.
  628.           useSecrets: true
  629.           # List of public keys used to validate the token. Example:
  630.           # - kid: 1
  631.           #   key: |
  632.           #     -----BEGIN RSA PUBLIC KEY-----
  633.           #     MIIBCgKCAQEAq....
  634.           #     -----END RSA PUBLIC KEY-----
  635.           # - kid: 2
  636.           #   keyFile: /keys/public.pem
  637.           publicKeys: []
  638.     # If true then Envoy uses Google gRPC instead of Envoy gRPC which lets a proxy reload the auth data (service account token, dp token etc.) stored in the file without proxy restart.
  639.     enableReloadableTokens: false # ENV: KUMA_DP_SERVER_AUTHN_ENABLE_RELOADABLE_TOKENS
  640.   # Hds defines a Health Discovery Service configuration
  641.   hds:
  642.     # Enabled if true then Envoy will actively check application's ports, but only on Universal.
  643.     # On Kubernetes this feature disabled for now regardless the flag value
  644.     enabled: true # ENV: KUMA_DP_SERVER_HDS_ENABLED
  645.     # Interval for Envoy to send statuses for HealthChecks
  646.     interval: 5s # ENV: KUMA_DP_SERVER_HDS_INTERVAL
  647.     # RefreshInterval is an interval for re-genarting configuration for Dataplanes connected to the Control Plane
  648.     refreshInterval: 10s # ENV: KUMA_DP_SERVER_HDS_REFRESH_INTERVAL
  649.     # Check defines a HealthCheck configuration
  650.     checkDefaults:
  651.       # Timeout is a time to wait for a health check response. If the timeout is reached the
  652.       # health check attempt will be considered a failure
  653.       timeout: 2s # ENV: KUMA_DP_SERVER_HDS_CHECK_TIMEOUT
  654.       # Interval between health checks
  655.       interval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_INTERVAL
  656.       # NoTrafficInterval is a special health check interval that is used when a cluster has
  657.       #    never had traffic routed to it
  658.       noTrafficInterval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_NO_TRAFFIC_INTERVAL
  659.       # HealthyThreshold is a number of healthy health checks required before a host is marked healthy
  660.       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
  661.       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
  662.       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
  664. # Intercommunication CP configuration
  665. interCp:
  666.   # Catalog configuration. Catalog keeps a record of all live CP instances in the zone.
  667.   catalog:
  668.     # Indicates an address on which other control planes can communicate with this CP.
  669.     # If empty then it's autoconfigured by taking the first IP of the nonloopback network interface.
  670.     instanceAddress: "" # ENV: KUMA_INTER_CP_CATALOG_INSTANCE_ADDRESS
  671.     # Interval on which CP will send heartbeat to a leader.
  672.     heartbeatInterval: 5s # ENV: KUMA_INTER_CP_CATALOG_HEARTBEAT_INTERVAL
  673.     # Interval on which CP will write all instances to a catalog.
  674.     writerInterval: 15s # ENV: KUMA_INTER_CP_CATALOG_WRITER_INTERVAL
  675.   # Intercommunication CP server configuration
  676.   server:
  677.     # Port of the inter-cp server
  678.     port: 5683 # ENV: KUMA_INTER_CP_SERVER_PORT
  679.     # TlsMinVersion the minimum version of TLS
  680.     tlsMinVersion: "TLSv1_2" # ENV: KUMA_INTER_CP_SERVER_TLS_MIN_VERSION
  681.     # TlsMaxVersion the maximum version of TLS
  682.     tlsMaxVersion: # ENV: KUMA_INTER_CP_SERVER_TLS_MAX_VERSION
  683.     # TlsCipherSuites the list of cipher suites
  684.     tlsCipherSuites: [ ] # ENV: KUMA_INTER_CP_SERVER_TLS_CIPHER_SUITES
  686. # Access Control configuration
  687. access:
  688.   # Type of access strategy (available values: "static")
  689.   type: static
  690.   # Configuration of static access strategy
  691.   static:
  692.     # AdminResources defines an access to admin resources (Secret/GlobalSecret)
  693.     adminResources:
  694.       # List of users that are allowed to access admin resources
  695.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_USERS
  696.       # List of groups that are allowed to access admin resources
  697.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_GROUPS
  698.     # GenerateDPToken defines an access to generating dataplane token
  699.     generateDpToken:
  700.       # List of users that are allowed to generate dataplane token
  701.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_USERS
  702.       # List of groups that are allowed to generate dataplane token
  703.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_GROUPS
  704.     # GenerateUserToken defines an access to generating user token
  705.     generateUserToken:
  706.       # List of users that are allowed to generate user token
  707.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_USERS
  708.       # List of groups that are allowed to generate user token
  709.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_GROUPS
  710.     # GenerateZoneToken defines an access to generating zone token
  711.     generateZoneToken:
  712.       # List of users that are allowed to generate zone token
  713.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_USERS
  714.       # List of groups that are allowed to generate zone token
  715.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
  716.     viewConfigDump:
  717.       # List of users that are allowed to get envoy config dump
  718.       users: [ ] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
  719.       # List of groups that are allowed to get envoy config dump
  720.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
  721.     viewStats:
  722.       # List of users that are allowed to get envoy stats
  723.       users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
  724.       # List of groups that are allowed to get envoy stats
  725.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
  726.     viewClusters:
  727.       # List of users that are allowed to get envoy clusters
  728.       users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
  729.       # List of groups that are allowed to get envoy clusters
  730.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
  732. # Configuration of experimental features of Kuma
  733. experimental:
  734.   # If true, experimental Gateway API is enabled
  735.   gatewayAPI: false # ENV: KUMA_EXPERIMENTAL_GATEWAY_API
  736.   # If true, instead of embedding kubernetes outbounds into Dataplane object, they are persisted next to VIPs in ConfigMap
  737.   # This can improve performance, but it should be enabled only after all instances are migrated to version that supports this config
  738.   kubeOutboundsAsVIPs: true # ENV: KUMA_EXPERIMENTAL_KUBE_OUTBOUNDS_AS_VIPS
  739.   # Tag first virtual outbound model is compressed version of default Virtual Outbound model
  740.   # It is recommended to use tag first model for deployments with more than 2k services
  741.   # You can enable this flag on existing deployment. In order to downgrade cp with this flag enabled
  742.   # you need to first disable this flag and redeploy cp, after config is rewritten to default
  743.   # format you can downgrade your cp
  744.   useTagFirstVirtualOutboundModel: false # ENV: KUMA_EXPERIMENTAL_USE_TAG_FIRST_VIRTUAL_OUTBOUND_MODEL
  745.   # If true, KDS will sync using incremental xDS updates
  746.   kdsDeltaEnabled: true # ENV: KUMA_EXPERIMENTAL_KDS_DELTA_ENABLED
  747.   # List of prefixes that will be used to filter out tags by keys from ingress' available services section.
  748.   # This can trim the size of the ZoneIngress object significantly.
  749.   # The drawback is that you cannot use filtered out tags for traffic routing.
  750.   # If empty, no filter is applied.
  751.   ingressTagFilters: [] # ENV: KUMA_EXPERIMENTAL_INGRESS_TAG_FILTERS
  752.   # KDS event based watchdog settings. It is a more optimal way to generate KDS snapshot config.
  753.   kdsEventBasedWatchdog:
  754.     # If true, then experimental event based watchdog to generate KDS snapshot is used.
  755.     enabled: false # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_ENABLED
  756.     # How often we flush changes when experimental event based watchdog is used.
  757.     flushInterval: 5s # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_FLUSH_INTERVAL
  758.     # How often we schedule full KDS resync when experimental event based watchdog is used.
  759.     fullResyncInterval: 60s # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_FULL_RESYNC_INTERVAL
  760.     # If true, then initial full resync is going to be delayed by 0 to FullResyncInterval.
  761.     delayFullResync: false # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_DELAY_FULL_RESYNC
  762.   # If true then control plane computes reachable services automatically based on MeshTrafficPermission.
  763.   # Lack of MeshTrafficPermission is treated as Deny the traffic.
  764.   autoReachableServices: false # ENV: KUMA_EXPERIMENTAL_AUTO_REACHABLE_SERVICES
  766. proxy:
  767.   gateway:
  768.     # Sets the envoy runtime value to limit maximum number of incoming
  769.     # connections to a builtin gateway data plane proxy
  770.     globalDownstreamMaxConnections: 50000 # ENV: KUMA_PROXY_GATEWAY_GLOBAL_DOWNSTREAM_MAX_CONNECTIONS
  772. tracing:
  773.   openTelemetry:
  774.     endpoint: "" # e.g. otel-collector:4317
  776. # Configuration of the event bus which is local to one instance of CP
  777. eventBus:
  778.   # BufferSize controls the buffer for every single event listener.
  779.   # If we go over buffer, additional delay may happen to various operation like insight recomputation or KDS.
  780.   bufferSize: 100 # ENV: KUMA_EVENT_BUS_BUFFER_SIZE

Helm values.yaml

  1. global:
  2.   image:
  3.     # -- Default registry for all Kuma Images
  4.     registry: "docker.io/kumahq"
  5.     # -- The default tag for all Kuma images, which itself defaults to .Chart.AppVersion
  6.     tag:
  7.   # -- Add `imagePullSecrets` to all the service accounts used for Kuma components
  8.   imagePullSecrets: []
  10. # -- Whether to patch the target namespace with the system label
  11. patchSystemNamespace: true
  13. installCrdsOnUpgrade:
  14.   # -- Whether install new CRDs before upgrade (if any were introduced with the new version of Kuma)
  15.   enabled: true
  16.   # -- The `imagePullSecrets` to attach to the Service Account running CRD installation.
  17.   # This field will be deprecated in a future release, please use .global.imagePullSecrets
  18.   imagePullSecrets: []
  20. # -- Whether to disable all helm hooks
  21. noHelmHooks: false
  23. # -- Whether to restart control-plane by calculating a new checksum for the secret
  24. restartOnSecretChange: true
  26. controlPlane:
  27.   # -- Environment that control plane is run in, useful when running universal global control plane on k8s
  28.   environment: "kubernetes"
  30.   # -- Labels to add to resources in addition to default labels
  31.   extraLabels: {}
  33.   # -- Kuma CP log level: one of off,info,debug
  34.   logLevel: "info"
  36.   # -- Kuma CP log output path: Defaults to /dev/stdout
  37.   logOutputPath: ""
  39.   # -- Kuma CP modes: one of zone,global
  40.   mode: "zone"
  42.   # -- (string) Kuma CP zone, if running multizone
  43.   zone:
  45.   # -- Only used in `zone` mode
  46.   kdsGlobalAddress: ""
  48.   # -- Number of replicas of the Kuma CP. Ignored when autoscaling is enabled
  49.   replicas: 1
  51.   # -- Minimum number of seconds for which a newly created pod should be ready for it to be considered available.
  52.   minReadySeconds: 0
  54.   # -- Annotations applied only to the `Deployment` resource
  55.   deploymentAnnotations: {}
  57.   # -- Annotations applied only to the `Pod` resource
  58.   podAnnotations: {}
  60.   # Horizontal Pod Autoscaling configuration
  61.   autoscaling:
  62.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  63.     enabled: false
  65.     # -- The minimum CP pods to allow
  66.     minReplicas: 2
  67.     # -- The max CP pods to scale to
  68.     maxReplicas: 5
  70.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  71.     targetCPUUtilizationPercentage: 80
  72.     # -- For clusters that do support autoscaling/v2, use metrics
  73.     metrics:
  74.       - type: Resource
  75.         resource:
  76.           name: cpu
  77.           target:
  78.             type: Utilization
  79.             averageUtilization: 80
  81.   # -- Node selector for the Kuma Control Plane pods
  82.   nodeSelector:
  83.     kubernetes.io/os: linux
  85.   # -- Tolerations for the Kuma Control Plane pods
  86.   tolerations: []
  88.   podDisruptionBudget:
  89.     # -- Whether to create a pod disruption budget
  90.     enabled: false
  91.     # -- The maximum number of unavailable pods allowed by the budget
  92.     maxUnavailable: 1
  94.   # -- Affinity placement rule for the Kuma Control Plane pods.
  95.   # This is rendered as a template, so you can reference other helm variables or includes.
  96.   affinity:
  97.     podAntiAffinity:
  98.       preferredDuringSchedulingIgnoredDuringExecution:
  99.       - weight: 100
  100.         podAffinityTerm:
  101.           labelSelector:
  102.             # These match the selector labels used on the deployment.
  103.             matchExpressions:
  104.               - key: app.kubernetes.io/name
  105.                 operator: In
  106.                 values:
  107.                   - '{{ include "kuma.name" . }}'
  108.               - key: app.kubernetes.io/instance
  109.                 operator: In
  110.                 values:
  111.                   - '{{ .Release.Name }}'
  112.               - key: app
  113.                 operator: In
  114.                 values:
  115.                   - '{{ include "kuma.name" . }}-control-plane'
  116.           topologyKey: kubernetes.io/hostname
  118.   # -- Topology spread constraints rule for the Kuma Control Plane pods.
  119.   # This is rendered as a template, so you can use variables to generate match labels.
  120.   topologySpreadConstraints:
  122.   # -- Failure policy of the mutating webhook implemented by the Kuma Injector component
  123.   injectorFailurePolicy: Fail
  125.   service:
  126.     apiServer:
  127.       http:
  128.         # -- Port on which Http api server Service is exposed on Node for service of type NodePort
  129.         nodePort: 30681
  130.       https:
  131.         # -- Port on which Https api server Service is exposed on Node for service of type NodePort
  132.         nodePort: 30682
  134.     # -- Whether to create a service resource.
  135.     enabled: true
  137.     # -- (string) Optionally override of the Kuma Control Plane Service's name
  138.     name:
  140.     # -- Service type of the Kuma Control Plane
  141.     type: ClusterIP
  143.     # -- Annotations to put on the Kuma Control Plane
  144.     annotations:
  145.       prometheus.io/scrape: "true"
  146.       prometheus.io/port: "5680"
  148.   # Kuma API and GUI ingress settings. Useful if you want to expose the
  149.   # API and GUI of Kuma outside the k8s cluster.
  150.   ingress:
  151.     # -- Install K8s Ingress resource that exposes GUI and API
  152.     enabled: false
  153.     # -- IngressClass defines which controller will implement the resource
  154.     ingressClassName:
  155.     # -- Ingress hostname
  156.     hostname:
  157.     # -- Map of ingress annotations.
  158.     annotations: {}
  159.     # -- Ingress path.
  160.     path: /
  161.     # -- Each path in an Ingress is required to have a corresponding path type. (ImplementationSpecific/Exact/Prefix)
  162.     pathType: ImplementationSpecific
  163.     # -- Port from kuma-cp to use to expose API and GUI. Switch to 5682 to expose TLS port
  164.     servicePort: 5681
  166.   globalZoneSyncService:
  167.     # -- Whether to create a k8s service for the global zone sync
  168.     # service. It will only be created when enabled and deploying the global
  169.     # control plane.
  170.     enabled: true
  171.     # -- Service type of the Global-zone sync
  172.     type: LoadBalancer
  173.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  174.     loadBalancerIP:
  175.     # -- Optionally specify allowed source ranges that can access the load balancer
  176.     loadBalancerSourceRanges: []
  177.     # -- Additional annotations to put on the Global Zone Sync Service
  178.     annotations: { }
  179.     # -- Port on which Global Zone Sync Service is exposed on Node for service of type NodePort
  180.     nodePort: 30685
  181.     # -- Port on which Global Zone Sync Service is exposed
  182.     port: 5685
  183.     # -- Protocol of the Global Zone Sync service port
  184.     protocol: grpc
  186.   defaults:
  187.     # -- Whether to skip creating the default Mesh
  188.     skipMeshCreation: false
  190.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  191.   automountServiceAccountToken: true
  193.   # -- Optionally override the resource spec
  194.   resources:
  195.     requests:
  196.        cpu: 500m
  197.        memory: 256Mi
  198.     limits:
  199.        memory: 256Mi
  201.   # -- Pod lifecycle settings (useful for adding a preStop hook, when
  202.   # using AWS ALB or NLB)
  203.   lifecycle: {}
  205.   # -- Number of seconds to wait before force killing the pod. Make sure to
  206.   # update this if you add a preStop hook.
  207.   terminationGracePeriodSeconds: 30
  209.   # TLS for various servers
  210.   tls:
  211.     general:
  212.       # -- Secret that contains tls.crt, tls.key [and ca.crt when no
  213.       # controlPlane.tls.general.caSecretName specified] for protecting
  214.       # Kuma in-cluster communication
  215.       secretName: ""
  216.       # -- Secret that contains ca.crt that was used to sign cert for protecting
  217.       # Kuma in-cluster communication (ca.crt present in this secret
  218.       # have precedence over the one provided in the controlPlane.tls.general.secretName)
  219.       caSecretName: ""
  220.       # -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
  221.       caBundle: ""
  222.     apiServer:
  223.       # -- Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS
  224.       secretName: ""
  225.       # -- Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS
  226.       clientCertsSecretName: ""
  227.     # - if not creating the global control plane, then do nothing
  228.     # - if secretName is empty and create is false, then do nothing
  229.     # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
  230.     # - if secretName is empty and create is true, then create a secret with a default name and use it
  231.     # - if secretName is non-empty and create is true, then create the secret using the provided name
  232.     kdsGlobalServer:
  233.       # -- Name of the K8s TLS Secret resource. If you set this and don't set
  234.       # create=true, you have to create the secret manually.
  235.       secretName: ""
  236.       # -- Whether to create the TLS secret in helm.
  237.       create: false
  238.       # -- The TLS certificate to offer.
  239.       cert: ""
  240.       # -- The TLS key to use.
  241.       key: ""
  242.     # - if not creating the zonal control plane, then do nothing
  243.     # - if secretName is empty and create is false, then do nothing
  244.     # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
  245.     # - if secretName is empty and create is true, then create a secret with a default name and use it
  246.     # - if secretName is non-empty and create is true, then create the secret using the provided name
  247.     kdsZoneClient:
  248.       # -- Name of the K8s Secret resource that contains ca.crt which was
  249.       # used to sign the certificate of KDS Global Server. If you set this
  250.       # and don't set create=true, you have to create the secret manually.
  251.       secretName: ""
  252.       # -- Whether to create the TLS secret in helm.
  253.       create: false
  254.       # -- CA bundle that was used to sign the certificate of KDS Global Server.
  255.       cert: ""
  256.       # -- If true, TLS cert of the server is not verified.
  257.       skipVerify: false
  259.   # -- Annotations to add for Control Plane's Service Account
  260.   serviceAccountAnnotations: { }
  262.   image:
  263.     # -- Kuma CP ImagePullPolicy
  264.     pullPolicy: IfNotPresent
  265.     # -- Kuma CP image repository
  266.     repository: "kuma-cp"
  267.     # -- Kuma CP Image tag. When not specified, the value is copied from global.tag
  268.     tag:
  270.   # -- (object with { Env: string, Secret: string, Key: string }) Secrets to add as environment variables,
  271.   # where `Env` is the name of the env variable,
  272.   # `Secret` is the name of the Secret,
  273.   # and `Key` is the key of the Secret value to use
  274.   secrets:
  275.   #  someSecret:
  276.   #    Secret: some-secret
  277.   #    Key: secret_key
  278.   #    Env: SOME_SECRET
  280.   # -- Additional environment variables that will be passed to the control plane
  281.   envVars: { }
  283.   # -- Additional config maps to mount into the control plane, with optional inline values
  284.   extraConfigMaps: [ ]
  285. #    - name: extra-config
  286. #      mountPath: /etc/extra-config
  287. #      readOnly: true
  288. #      values:
  289. #        extra-config-key: |
  290. #          extra-config-value
  292.   # -- (object with { name: string, mountPath: string, readOnly: string }) Additional secrets to mount into the control plane,
  293.   # where `Env` is the name of the env variable,
  294.   # `Secret` is the name of the Secret,
  295.   # and `Key` is the key of the Secret value to use
  296.   extraSecrets:
  297.   #  extraConfig:
  298.   #    name: extra-config
  299.   #    mountPath: /etc/extra-config
  300.   #    readOnly: true
  302.   webhooks:
  303.     validator:
  304.       # -- Additional rules to apply on Kuma validator webhook. Useful when building custom policy on top of Kuma.
  305.       additionalRules: ""
  306.     ownerReference:
  307.       # -- Additional rules to apply on Kuma owner reference webhook. Useful when building custom policy on top of Kuma.
  308.       additionalRules: ""
  310.   # -- Specifies if the deployment should be started in hostNetwork mode.
  311.   hostNetwork: false
  312.   # -- Define a new server port for the admission controller. Recommended to set in combination with
  313.   # hostNetwork to prevent multiple port bindings on the same port (like Calico in AWS EKS).
  314.   admissionServerPort: 5443
  316.   # -- Security context at the pod level for control plane.
  317.   podSecurityContext:
  318.     runAsNonRoot: true
  320.   # -- Security context at the container level for control plane.
  321.   containerSecurityContext:
  322.     readOnlyRootFilesystem: true
  324. cni:
  325.   # -- Install Kuma with CNI instead of proxy init container
  326.   enabled: false
  327.   # -- Install CNI in chained mode
  328.   chained: false
  329.   # -- Set the CNI install directory
  330.   netDir: /etc/cni/multus/net.d
  331.   # -- Set the CNI bin directory
  332.   binDir: /var/lib/cni/bin
  333.   # -- Set the CNI configuration name
  334.   confName: kuma-cni.conf
  335.   # -- CNI log level: one of off,info,debug
  336.   logLevel: info
  337.   # -- Node Selector for the CNI pods
  338.   nodeSelector:
  339.     kubernetes.io/os: linux
  340.   # -- Tolerations for the CNI pods
  341.   tolerations: []
  342.   # -- Additional pod annotations
  343.   podAnnotations: { }
  344.   # -- Set the CNI namespace
  345.   namespace: kube-system
  347.   image:
  348.     # -- CNI image repository
  349.     repository: "kuma-cni"
  350.     # -- CNI image tag - defaults to .Chart.AppVersion
  351.     tag:
  352.     # -- CNI image pull policy
  353.     imagePullPolicy: IfNotPresent
  355.   # -- it's only useful in tests to trigger a possible race condition
  356.   delayStartupSeconds: 0
  358.   # -- use new CNI (experimental)
  359.   experimental:
  360.     imageEbpf:
  361.       # -- CNI experimental eBPF image registry
  362.       registry: "docker.io/kumahq"
  363.       # -- CNI experimental eBPF image repository
  364.       repository: "merbridge"
  365.       # -- CNI experimental eBPF image tag
  366.       tag: "0.8.5"
  368.   resources:
  369.     requests:
  370.       cpu: 100m
  371.       memory: 100Mi
  372.     limits:
  373.       memory: 100Mi
  375.   # -- Security context at the pod level for cni
  376.   podSecurityContext: {}
  378.   # -- Security context at the container level for cni
  379.   containerSecurityContext:
  380.     readOnlyRootFilesystem: true
  381.     runAsNonRoot: false
  382.     runAsUser: 0
  383.     runAsGroup: 0
  385. dataPlane:
  386.   # -- If true, then turn on CoreDNS query logging
  387.   dnsLogging: false
  388.   image:
  389.     # -- The Kuma DP image repository
  390.     repository: "kuma-dp"
  391.     # -- Kuma DP ImagePullPolicy
  392.     pullPolicy: IfNotPresent
  393.     # -- Kuma DP Image Tag. When not specified, the value is copied from global.tag
  394.     tag:
  396.   initImage:
  397.     # -- The Kuma DP init image repository
  398.     repository: "kuma-init"
  399.     # -- Kuma DP init image tag When not specified, the value is copied from global.tag
  400.     tag:
  402. ingress:
  403.   # -- If true, it deploys Ingress for cross cluster communication
  404.   enabled: false
  406.   # -- Labels to add to resources, in addition to default labels
  407.   extraLabels: {}
  409.   # -- Time for which old listener will still be active as draining
  410.   drainTime: 30s
  412.   # -- Number of replicas of the Ingress. Ignored when autoscaling is enabled.
  413.   replicas: 1
  415.   # -- Log level for ingress (available values: off|info|debug)
  416.   logLevel: info
  418.   # -- Define the resources to allocate to mesh ingress
  419.   resources:
  420.     requests:
  421.       cpu: 50m
  422.       memory: 64Mi
  423.     limits:
  424.       cpu: 1000m
  425.       memory: 512Mi
  427.   # -- Pod lifecycle settings (useful for adding a preStop hook, when
  428.   # using AWS ALB or NLB)
  429.   lifecycle: {}
  431.   # -- Number of seconds to wait before force killing the pod. Make sure to
  432.   # update this if you add a preStop hook.
  433.   terminationGracePeriodSeconds: 40
  435.   # Horizontal Pod Autoscaling configuration
  436.   autoscaling:
  437.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  438.     enabled: false
  440.     # -- The minimum CP pods to allow
  441.     minReplicas: 2
  442.     # -- The max CP pods to scale to
  443.     maxReplicas: 5
  445.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  446.     targetCPUUtilizationPercentage: 80
  447.     # -- For clusters that do support autoscaling/v2, use metrics
  448.     metrics:
  449.       - type: Resource
  450.         resource:
  451.           name: cpu
  452.           target:
  453.             type: Utilization
  454.             averageUtilization: 80
  456.   service:
  457.     # -- Whether to create a Service resource.
  458.     enabled: true
  459.     # -- Service type of the Ingress
  460.     type: LoadBalancer
  461.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  462.     loadBalancerIP:
  463.     # -- Additional annotations to put on the Ingress service
  464.     annotations: { }
  465.     # -- Port on which Ingress is exposed
  466.     port: 10001
  467.     # -- Port on which service is exposed on Node for service of type NodePort
  468.     nodePort:
  469.   # -- Additional pod annotations (deprecated favor `podAnnotations`)
  470.   annotations: { }
  471.   # -- Additional pod annotations
  472.   podAnnotations: { }
  473.   # -- Node Selector for the Ingress pods
  474.   nodeSelector:
  475.     kubernetes.io/os: linux
  476.   # -- Tolerations for the Ingress pods
  477.   tolerations: []
  478.   podDisruptionBudget:
  479.     # -- Whether to create a pod disruption budget
  480.     enabled: false
  481.     # -- The maximum number of unavailable pods allowed by the budget
  482.     maxUnavailable: 1
  484.   # -- Affinity placement rule for the Kuma Ingress pods
  485.   # This is rendered as a template, so you can reference other helm variables
  486.   # or includes.
  487.   affinity:
  488.     podAntiAffinity:
  489.       preferredDuringSchedulingIgnoredDuringExecution:
  490.       - weight: 100
  491.         podAffinityTerm:
  492.           labelSelector:
  493.             # These match the selector labels used on the deployment.
  494.             matchExpressions:
  495.               - key: app.kubernetes.io/name
  496.                 operator: In
  497.                 values:
  498.                   - '{{ include "kuma.name" . }}'
  499.               - key: app.kubernetes.io/instance
  500.                 operator: In
  501.                 values:
  502.                   - '{{ .Release.Name }}'
  503.               - key: app
  504.                 operator: In
  505.                 values:
  506.                   - kuma-ingress
  507.           topologyKey: kubernetes.io/hostname
  509.   # -- Topology spread constraints rule for the Kuma Mesh Ingress pods.
  510.   # This is rendered as a template, so you can use variables to generate match labels.
  511.   topologySpreadConstraints:
  513.   # -- Security context at the pod level for ingress
  514.   podSecurityContext:
  515.     runAsNonRoot: true
  516.     runAsUser: 5678
  517.     runAsGroup: 5678
  519.   # -- Security context at the container level for ingress
  520.   containerSecurityContext:
  521.     readOnlyRootFilesystem: true
  523.   # -- Annotations to add for Control Plane's Service Account
  524.   serviceAccountAnnotations: { }
  525.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  526.   automountServiceAccountToken: true
  528. egress:
  529.   # -- If true, it deploys Egress for cross cluster communication
  530.   enabled: false
  531.   # -- Labels to add to resources, in addition to the default labels.
  532.   extraLabels: {}
  533.   # -- Time for which old listener will still be active as draining
  534.   drainTime: 30s
  535.   # -- Number of replicas of the Egress. Ignored when autoscaling is enabled.
  536.   replicas: 1
  538.   # -- Log level for egress (available values: off|info|debug)
  539.   logLevel: info
  541.   # Horizontal Pod Autoscaling configuration
  542.   autoscaling:
  543.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  544.     enabled: false
  546.     # -- The minimum CP pods to allow
  547.     minReplicas: 2
  548.     # -- The max CP pods to scale to
  549.     maxReplicas: 5
  551.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  552.     targetCPUUtilizationPercentage: 80
  553.     # -- For clusters that do support autoscaling/v2, use metrics
  554.     metrics:
  555.       - type: Resource
  556.         resource:
  557.           name: cpu
  558.           target:
  559.             type: Utilization
  560.             averageUtilization: 80
  561.   resources:
  562.     requests:
  563.       cpu: 50m
  564.       memory: 64Mi
  565.     limits:
  566.       cpu: 1000m
  567.       memory: 512Mi
  569.   service:
  570.     # -- Whether to create the service object
  571.     enabled: true
  572.     # -- Service type of the Egress
  573.     type: ClusterIP
  574.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  575.     loadBalancerIP:
  576.     # -- Additional annotations to put on the Egress service
  577.     annotations: { }
  578.     # -- Port on which Egress is exposed
  579.     port: 10002
  580.     # -- Port on which service is exposed on Node for service of type NodePort
  581.     nodePort:
  582.   # -- Additional pod annotations (deprecated favor `podAnnotations`)
  583.   annotations: { }
  584.   # -- Additional pod annotations
  585.   podAnnotations: { }
  586.   # -- Node Selector for the Egress pods
  587.   nodeSelector:
  588.     kubernetes.io/os: linux
  589.   # -- Tolerations for the Egress pods
  590.   tolerations: []
  591.   podDisruptionBudget:
  592.     # -- Whether to create a pod disruption budget
  593.     enabled: false
  594.     # -- The maximum number of unavailable pods allowed by the budget
  595.     maxUnavailable: 1
  597.   # -- Affinity placement rule for the Kuma Egress pods.
  598.   # This is rendered as a template, so you can reference other helm variables or includes.
  599.   affinity:
  600.     podAntiAffinity:
  601.       preferredDuringSchedulingIgnoredDuringExecution:
  602.       - weight: 100
  603.         podAffinityTerm:
  604.           labelSelector:
  605.             # These match the selector labels used on the deployment.
  606.             matchExpressions:
  607.               - key: app.kubernetes.io/name
  608.                 operator: In
  609.                 values:
  610.                   - '{{ include "kuma.name" . }}'
  611.               - key: app.kubernetes.io/instance
  612.                 operator: In
  613.                 values:
  614.                   - '{{ .Release.Name }}'
  615.               - key: app
  616.                 operator: In
  617.                 values:
  618.                   - kuma-egress
  619.           topologyKey: kubernetes.io/hostname
  621.   # -- Topology spread constraints rule for the Kuma Egress pods.
  622.   # This is rendered as a template, so you can use variables to generate match labels.
  623.   topologySpreadConstraints:
  625.   # -- Security context at the pod level for egress
  626.   podSecurityContext:
  627.     runAsNonRoot: true
  628.     runAsUser: 5678
  629.     runAsGroup: 5678
  631.   # -- Security context at the container level for egress
  632.   containerSecurityContext:
  633.     readOnlyRootFilesystem: true
  635.   # -- Annotations to add for Control Plane's Service Account
  636.   serviceAccountAnnotations: { }
  637.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  638.   automountServiceAccountToken: true
  640. kumactl:
  641.   image:
  642.     # -- The kumactl image repository
  643.     repository: kumactl
  644.     # -- The kumactl image tag. When not specified, the value is copied from global.tag
  645.     tag:
  647. kubectl:
  648.   image:
  649.     # -- The kubectl image registry
  650.     registry: docker.io
  651.     # -- The kubectl image repository
  652.     repository: bitnami/kubectl
  653.     # -- The kubectl image tag
  654.     tag: "1.27.5"
  655. hooks:
  656.   # -- Node selector for the HELM hooks
  657.   nodeSelector:
  658.     kubernetes.io/os: linux
  659.   # -- Tolerations for the HELM hooks
  660.   tolerations: []
  661.   # -- Security context at the pod level for crd/webhook/ns
  662.   podSecurityContext:
  663.     runAsNonRoot: true
  665.   # -- Security context at the container level for crd/webhook/ns
  666.   containerSecurityContext:
  667.     readOnlyRootFilesystem: true
  669.   # -- ebpf-cleanup hook needs write access to the root filesystem to clean ebpf programs
  670.   # Changing below values will potentially break ebpf cleanup completely,
  671.   # so be cautious when doing so.
  672.   ebpfCleanup:
  673.     # -- Security context at the pod level for crd/webhook/cleanup-ebpf
  674.     podSecurityContext:
  675.       runAsNonRoot: false
  676.     # -- Security context at the container level for crd/webhook/cleanup-ebpf
  677.     containerSecurityContext:
  678.       readOnlyRootFilesystem: false
  680. experimental:
  681.   # -- If true, it installs experimental Gateway API support
  682.   gatewayAPI: false
  683.   # Configuration for the experimental ebpf mode for transparent proxy
  684.   ebpf:
  685.     # -- If true, ebpf will be used instead of using iptables to install/configure transparent proxy
  686.     enabled: false
  687.     # -- Name of the environmental variable which will contain the IP address of a pod
  688.     instanceIPEnvVarName: INSTANCE_IP
  689.     # -- Path where BPF file system should be mounted
  690.     bpffsPath: /sys/fs/bpf
  691.     # -- Host's cgroup2 path
  692.     cgroupPath: /sys/fs/cgroup
  693.     # -- Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty
  694.     tcAttachIface: ""
  695.     # -- Path where compiled eBPF programs which will be installed can be found
  696.     programsSourcePath: /kuma/ebpf
  697.   # -- If false, it uses legacy API for resource synchronization
  698.   deltaKds: true
  700. # Postgres' settings for universal control plane on k8s
  701. postgres:
  702.   # -- Postgres port, password should be provided as a secret reference in "controlPlane.secrets"
  703.   # with the Env value "KUMA_STORE_POSTGRES_PASSWORD".
  704.   # Example:
  705.   # controlPlane:
  706.   #   secrets:
  707.   #     - Secret: postgres-postgresql
  708.   #       Key: postgresql-password
  709.   #       Env: KUMA_STORE_POSTGRES_PASSWORD
  710.   port: "5432"
  711.   # TLS settings
  712.   tls:
  713.     # -- Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  714.     mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  715.     # -- Whether to disable SNI the postgres `sslsni` option.
  716.     disableSSLSNI: false # ENV: KUMA_STORE_POSTGRES_TLS_DISABLE_SSLSNI
  717.     # -- Secret name that contains the ca.crt
  718.     caSecretName:
  719.     # -- Secret name that contains the client tls.crt, tls.key
  720.     secretName:
  722. # @ignored for helm-docs
  723. plugins:
  724.   policies:
  725.     meshaccesslogs: {}
  726.     meshcircuitbreakers: {}
  727.     meshfaultinjections: {}
  728.     meshhealthchecks: {}
  729.     meshhttproutes: {}
  730.     meshloadbalancingstrategies: {}
  731.     meshmetrics: {}
  732.     meshproxypatches: {}
  733.     meshratelimits: {}
  734.     meshretries: {}
  735.     meshtcproutes: {}
  736.     meshtimeouts: {}
  737.     meshtraces: {}
  738.     meshtrafficpermissions: {}