kuma-cp configuration reference

Kuma CP configuration

  1. # Environment type. Available values are: "kubernetes" or "universal"
  2. environment: universal # ENV: KUMA_ENVIRONMENT
  3. # Mode in which Kuma CP is running. Available values are: "global", "zone", "standalone" (deprecated, use "zone")
  4. mode: zone # ENV: KUMA_MODE
  5. # Resource Store configuration
  6. store:
  7.   # Type of Store used in the Control Plane. Available values are: "kubernetes", "postgres" or "memory"
  8.   type: memory # ENV: KUMA_STORE_TYPE
  9.   # Kubernetes Store configuration (used when store.type=kubernetes)
  10.   kubernetes:
  11.     # Namespace where Control Plane is installed to.
  12.     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
  13.   # Postgres Store configuration (used when store.type=postgres)
  14.   postgres:
  15.     # Host of the Postgres DB
  16.     host: 127.0.0.1 # ENV: KUMA_STORE_POSTGRES_HOST
  17.     # Port of the Postgres DB
  18.     port: 15432 # ENV: KUMA_STORE_POSTGRES_PORT
  19.     # User of the Postgres DB
  20.     user: kuma # ENV: KUMA_STORE_POSTGRES_USER
  21.     # Password of the Postgres DB
  22.     password: kuma # ENV: KUMA_STORE_POSTGRES_PASSWORD
  23.     # Database name of the Postgres DB
  24.     dbName: kuma # ENV: KUMA_STORE_POSTGRES_DB_NAME
  25.     # Driver to use, one of: pgx, postgres
  26.     driverName: pgx # ENV: KUMA_STORE_POSTGRES_DRIVER_NAME
  27.     # Connection Timeout to the DB in seconds
  28.     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
  29.     # MaxConnectionIdleTime (applied only when driverName=pgx) is the duration after which an idle connection will be automatically closed by the health check.
  30.     maxConnectionIdleTime: "30m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_IDLE_TIME
  31.     # MaxConnectionLifetime (applied only when driverName=pgx) is the duration since creation after which a connection will be automatically closed
  32.     maxConnectionLifetime: "1h" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME
  33.     # MaxConnectionLifetimeJitter (applied only when driverName=pgx) is the duration after maxConnectionLifetime to randomly decide to close a connection.
  34.     # This helps prevent all connections from being closed at the exact same time, starving the pool.
  35.     maxConnectionLifetimeJitter: "1m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME_JITTER
  36.     # HealthCheckInterval (applied only when driverName=pgx) is the duration between checks of the health of idle connections.
  37.     healthCheckInterval: "30s" # ENV: KUMA_STORE_POSTGRES_HEALTH_CHECK_INTERVAL
  38.     # MinOpenConnections (applied only when driverName=pgx) is the minimum number of open connections to the database
  39.     minOpenConnections: 0 # ENV: KUMA_STORE_POSTGRES_MIN_OPEN_CONNECTIONS
  40.     # MaxOpenConnections is the maximum number of open connections to the database
  41.     # `0` value means number of open connections is unlimited
  42.     maxOpenConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS
  43.     # MaxIdleConnections is the maximum number of connections in the idle connection pool
  44.     # <0 value means no idle connections and 0 means default max idle connections.
  45.     # Deprecated: it's only used when driverName=postgres (lib/pq) which is deprecated, use driverName=pgx instead.
  46.     maxIdleConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
  47.     # MaxListQueryElements defines maximum number of changed elements before requesting full list of elements from the store.
  48.     maxListQueryElements: 0 # ENV: KUMA_STORE_POSTGRES_MAX_LIST_QUERY_ELEMENTS
  49.     # TLS settings
  50.     tls:
  51.       # Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  52.       mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  53.       # Path to TLS Certificate of the client. Required when server has METHOD=cert
  54.       certPath: # ENV: KUMA_STORE_POSTGRES_TLS_CERT_PATH
  55.       # Path to TLS Key of the client. Required when server has METHOD=cert
  56.       keyPath: # ENV: KUMA_STORE_POSTGRES_TLS_KEY_PATH
  57.       # Path to the root certificate. Used in verifyCa and verifyFull modes.
  58.       caPath: # ENV: KUMA_STORE_POSTGRES_TLS_ROOT_CERT_PATH
  59.     # MinReconnectInterval controls the duration to wait before trying to
  60.     # re-establish the database connection after connection loss. After each
  61.     # consecutive failure this interval is doubled, until MaxReconnectInterval
  62.     # is reached. Successfully completing the connection establishment procedure
  63.     # resets the interval back to MinReconnectInterval.
  64.     # Deprecated: it's only used when driverName=postgres (lib/pq) which is deprecated, use driverName=pgx instead.
  65.     minReconnectInterval: "10s" # ENV: KUMA_STORE_POSTGRES_MIN_RECONNECT_INTERVAL
  66.     # MaxReconnectInterval controls the maximum possible duration to wait before trying
  67.     # to re-establish the database connection after connection loss.
  68.     # Deprecated: it's only used when driverName=postgres (lib/pq) which is deprecated, use driverName=pgx instead.
  69.     maxReconnectInterval: "60s" # ENV: KUMA_STORE_POSTGRES_MAX_RECONNECT_INTERVAL
  70.     # ReadReplica is a setting for a DB replica used only for read queries
  71.     readReplica:
  72.       # Host of the Postgres DB read replica. If not set, read replica is not used.
  73.       host: "" # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_HOST
  74.       # Port of the Postgres DB read replica
  75.       port: 5432 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_PORT
  76.       # Ratio in [0-100] range. How many SELECT queries (out of 100) will use read replica.
  77.       ratio: 100 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_RATIO
  78.   # Cache for read only operations. This cache is local to the instance of the control plane.
  79.   cache:
  80.     # If true then cache is enabled
  81.     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
  82.     # Expiration time for elements in cache.
  83.     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
  84.   # Upsert (get and update) configuration
  85.   upsert:
  86.     # Base time for exponential backoff on upsert operations when retry is enabled
  87.     conflictRetryBaseBackoff: 200ms # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_BASE_BACKOFF
  88.     # Max retries on upsert (get and update) operation when retry is enabled
  89.     conflictRetryMaxTimes: 10 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
  90.     # Percentage of jitter. For example: if backoff is 20s, and this value 10, the backoff will be between 18s and 22s.
  91.     conflictRetryJitterPercent: 30 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_JITTER_PERCENT
  92.   # If true, skips validation of resource delete.
  93.   # For example you don't have to delete all Dataplane objects before you delete a Mesh
  94.   unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
  95. # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
  96. bootstrapServer:
  97.   # Parameters of bootstrap configuration
  98.   params:
  99.     # Address of Envoy Admin
  100.     adminAddress: 127.0.0.1 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ADDRESS
  101.     # Port of Envoy Admin
  102.     adminPort: 9901 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT
  103.     # Path to access log file of Envoy Admin
  104.     adminAccessLogPath: /dev/null # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ACCESS_LOG_PATH
  105.     # Host of XDS Server. By default it is the same host as the one used by kuma-dp to connect to the control plane
  106.     xdsHost: "" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST
  107.     # Port of XDS Server. By default it is autoconfigured from KUMA_DP_SERVER_PORT
  108.     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
  109.     # Connection timeout to the XDS Server
  110.     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
  111. #  Monitoring Assignment Discovery Service (MADS) server configuration
  112. monitoringAssignmentServer:
  113.   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
  114.   port: 5676 # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_PORT
  115.   # Which MADS API versions to serve
  116.   apiVersions: ["v1"] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_API_VERSIONS
  117.   # Interval for re-generating monitoring assignments for clients connected to the Control Plane.
  118.   assignmentRefreshInterval: 1s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL
  119.   # The default timeout for a single fetch-based discovery request, if not specified
  120.   defaultFetchTimeout: 30s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_DEFAULT_FETCH_TIMEOUT
  121.   # Path to TLS certificate file
  122.   tlsCertFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CERT_FILE
  123.   # Path to TLS key file
  124.   tlsKeyFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_KEY_FILE
  125.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  126.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MIN_VERSION
  127.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  128.   tlsMaxVersion: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MAX_VERSION
  129.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  130.   tlsCipherSuites: [] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CIPHER_SUITES
  131. # Envoy XDS server configuration
  132. xdsServer:
  133.   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
  134.   dataplaneConfigurationRefreshInterval: 1s # ENV: KUMA_XDS_SERVER_DATAPLANE_CONFIGURATION_REFRESH_INTERVAL
  135.   # Interval for flushing status of Dataplanes connected to the Control Plane
  136.   dataplaneStatusFlushInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_STATUS_FLUSH_INTERVAL
  137.   # Backoff that is executed when Control Plane is sending the response that was previously rejected by Dataplane
  138.   nackBackoff: 5s # ENV: KUMA_XDS_SERVER_NACK_BACKOFF
  139.   # A delay between proxy terminating a connection and the CP trying to deregister the proxy.
  140.   # It is used only in universal mode when you use direct lifecycle.
  141.   # Setting this setting to 0s disables the delay.
  142.   # Disabling this may cause race conditions that one instance of CP removes proxy object
  143.   # while proxy is connected to another instance of the CP.
  144.   dataplaneDeregistrationDelay: 10s # ENV: KUMA_XDS_DATAPLANE_DEREGISTRATION_DELAY
  145. # API Server configuration
  146. apiServer:
  147.   # HTTP configuration of the API Server
  148.   http:
  149.     # If true then API Server will be served on HTTP
  150.     enabled: true # ENV: KUMA_API_SERVER_HTTP_ENABLED
  151.     # Network interface on which HTTP API Server will be exposed
  152.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTP_INTERFACE
  153.     # Port of the API Server
  154.     port: 5681 # ENV: KUMA_API_SERVER_HTTP_PORT
  155.   # HTTPS configuration of the API Server
  156.   https:
  157.     # If true then API Server will be served on HTTPS
  158.     enabled: true # ENV: KUMA_API_SERVER_HTTPS_ENABLED
  159.     # Network interface on which HTTPS API Server will be exposed
  160.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTPS_INTERFACE
  161.     # Port of the HTTPS API Server
  162.     port: 5682 # ENV: KUMA_API_SERVER_HTTPS_PORT
  163.     # Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
  164.     tlsCertFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
  165.     # Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
  166.     tlsKeyFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
  167.     # Path to the CA certificate which is used to sign client certificates. It is used only for verifying client certificates.
  168.     tlsCaFile: "" # ENV: KUMA_API_SERVER_HTTPS_CLIENT_CERTS_CA_FILE
  169.     # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  170.     tlsMinVersion: "TLSv1_2" # ENV: KUMA_API_SERVER_HTTPS_TLS_MIN_VERSION
  171.     # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  172.     tlsMaxVersion: # ENV: KUMA_API_SERVER_HTTPS_TLS_MAX_VERSION
  173.     # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  174.     tlsCipherSuites: [] # ENV: KUMA_API_SERVER_HTTPS_TLS_CIPHER_SUITES
  175.     # If true, then HTTPS connection will require client cert.
  176.     requireClientCert: false # ENV: KUMA_API_SERVER_HTTPS_REQUIRE_CLIENT_CERT
  177.   # Authentication configuration for administrative endpoints like Dataplane Token or managing Secrets
  178.   auth:
  179.     # Directory of authorized client certificates (only validate in HTTPS)
  180.     clientCertsDir: "" # ENV: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
  181.   # Api Server Authentication configuration
  182.   authn:
  183.     # Type of authentication mechanism (available values: "adminClientCerts", "tokens")
  184.     type: tokens # ENV: KUMA_API_SERVER_AUTHN_TYPE
  185.     # Localhost is authenticated as a user admin of group admin
  186.     localhostIsAdmin: true # ENV: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
  187.     # Configuration for tokens authentication
  188.     tokens:
  189.       # If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma secret
  190.       bootstrapAdminToken: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_BOOTSTRAP_ADMIN_TOKEN
  191.       # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  192.       enableIssuer: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_ENABLE_ISSUER
  193.       # Token validator configuration
  194.       validator:
  195.         # If true then Kuma secrets with prefix "user-token-signing-key" are considered as signing keys.
  196.         useSecrets: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_VALIDATOR_USE_SECRETS
  197.         # List of public keys used to validate the token. Example:
  198.         # - kid: 1
  199.         #   key: |
  200.         #     -----BEGIN RSA PUBLIC KEY-----
  201.         #     MIIBCgKCAQEAq....
  202.         #     -----END RSA PUBLIC KEY-----
  203.         # - kid: 2
  204.         #   keyFile: /keys/public.pem
  205.         publicKeys: []
  206.   # If true, then API Server will operate in read only mode (serving GET requests)
  207.   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
  208.   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
  209.   corsAllowedDomains:
  210.     - ".*" # ENV: KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
  211.   # Can be used if you use a reverse proxy
  212.   rootUrl: "" # ENV: KUMA_API_SERVER_ROOT_URL
  213.   # The path to serve the API from
  214.   basePath: "/" # ENV: KUMA_API_SERVER_BASE_PATH
  215.   # configuration specific to the GUI
  216.   gui:
  217.     # Whether to serve the gui (if mode=zone this has no effect)
  218.     enabled: true # ENV: KUMA_API_SERVER_GUI_ENABLED
  219.     # Can be used if you use a reverse proxy or want to serve the gui from a different path
  220.     rootUrl: "" # ENV: KUMA_API_SERVER_GUI_ROOT_URL
  221.     # The path to serve the GUI from
  222.     basePath: "/gui" # ENV: KUMA_API_SERVER_GUI_BASE_PATH
  223. # Environment-specific configuration
  224. runtime:
  225.   # Kubernetes-specific configuration
  226.   kubernetes:
  227.     # Service name of the Kuma Control Plane. It is used to point Kuma DP to proper URL.
  228.     controlPlaneServiceName: kuma-control-plane # ENV: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
  229.     # Name of Service Account that is used to run the Control Plane
  230.     serviceAccountName: "system:serviceaccount:kuma-system:kuma-control-plane" # ENV: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
  231.     # Taint controller that prevents applications from scheduling until CNI is ready.
  232.     nodeTaintController:
  233.       # If true enables the taint controller.
  234.       enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_ENABLED
  235.       # Value of app label on CNI pod that indicates if node can be ready.
  236.       cniApp: "" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_APP
  237.       # Value of CNI namespace.
  238.       cniNamespace: "kube-system" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_NAMESPACE
  239.     # Admission WebHook Server configuration
  240.     admissionServer:
  241.       # Address the Admission WebHook Server should be listening on
  242.       address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
  243.       # Port the Admission WebHook Server should be listening on
  244.       port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
  245.       # Directory with a TLS cert and private key for the Admission WebHook Server.
  246.       # TLS certificate file must be named `tls.crt`.
  247.       # TLS key file must be named `tls.key`.
  248.       certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
  249.     # Injector defines configuration of a Kuma Sidecar Injector.
  250.     injector:
  251.       # if true runs kuma-cp in CNI compatible mode
  252.       cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
  253.       # list of exceptions for Kuma injection
  254.       exceptions:
  255.         # a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
  256.         labels:
  257.           openshift.io/build.name: "*"
  258.           openshift.io/deployer-pod-for.name: "*"
  259.       # VirtualProbesEnabled enables automatic converting HttpGet probes to virtual. Virtual probe
  260.       #    serves on sub-path of insecure port 'virtualProbesPort',
  261.       #    i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
  262.       virtualProbesEnabled: true # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
  263.       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
  264.       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
  265.       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
  266.       caCertFile: # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
  267.       # SidecarContainer defines configuration of the Kuma sidecar container.
  268.       sidecarContainer:
  269.         # Image name.
  270.         image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
  271.         # Redirect port for inbound traffic.
  272.         redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
  273.         # Redirect port for inbound traffic.
  274.         # Deprecated: Use redirectPortInbound or ipFamilyMode instead.
  275.         redirectPortInboundV6: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND_V6
  276.         # IP family mode enabled for traffic redirection, can be 'dualstack' or 'ipv4'
  277.         ipFamilyMode: dualstack # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IP_FAMILY_MODE
  278.         # Redirect port for outbound traffic.
  279.         redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
  280.         # User ID.
  281.         uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
  282.         # Group ID.
  283.         gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
  284.         # Drain time for listeners.
  285.         drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
  286.         # Readiness probe.
  287.         readinessProbe:
  288.           # Number of seconds after the container has started before readiness probes are initiated.
  289.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
  290.           # Number of seconds after which the probe times out.
  291.           timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
  292.           # Number of seconds after which the probe times out.
  293.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
  294.           # Minimum consecutive successes for the probe to be considered successful after having failed.
  295.           successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
  296.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  297.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
  298.         # Liveness probe.
  299.         livenessProbe:
  300.           # Number of seconds after the container has started before liveness probes are initiated.
  301.           initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
  302.           # Number of seconds after which the probe times out.
  303.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
  304.           # How often (in seconds) to perform the probe.
  305.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
  306.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  307.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
  308.         # Startup probe (if sidecar containers feature is enabled).
  309.         startupProbe:
  310.           # Number of seconds after the container has started before startup probes are initiated.
  311.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_INITIAL_DELAY_SECONDS
  312.           # Number of seconds after which the probe times out.
  313.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_TIMEOUT_SECONDS
  314.           # How often (in seconds) to perform the probe.
  315.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_PERIOD_SECONDS
  316.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  317.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_FAILURE_THRESHOLD
  318.         # Compute resource requirements.
  319.         resources:
  320.           # Minimum amount of compute resources required.
  321.           requests:
  322.             # CPU, in cores. (500m = .5 cores)
  323.             cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
  324.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  325.             memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
  326.           # Maximum amount of compute resources allowed.
  327.           limits:
  328.             # CPU, in cores. (500m = .5 cores)
  329.             cpu: 1000m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
  330.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  331.             memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
  332.         # Additional environment variables that can be placed on Kuma DP sidecar
  333.         envVars: {} # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ENV_VARS
  334.         # If true, it enables a postStart script that waits until Envoy is ready.
  335.         # With the current Kubernetes behavior, any other container in the Pod will wait until the script is complete.
  336.         waitForDataplaneReady: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_WAIT_FOR_DATAPLANE_READY
  337.       # InitContainer defines configuration of the Kuma init container
  338.       initContainer:
  339.         # Image name.
  340.         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
  341.       # ContainerPatches is an optional list of ContainerPatch names which will be applied
  342.       # to init and sidecar containers if workload is not annotated with a patch list.
  343.       containerPatches: [] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
  344.       # Configuration for a traffic that is intercepted by sidecar
  345.       sidecarTraffic:
  346.         # List of inbound ports that will be excluded from interception.
  347.         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
  348.         excludeInboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
  349.         # List of outbound ports that will be excluded from interception.
  350.         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
  351.         excludeOutboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
  352.       builtinDNS:
  353.         # Use the built-in DNS
  354.         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
  355.         # Redirect port for DNS
  356.         port: 15053 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_PORT
  357.         # Enable coredns query logging if true
  358.         logging: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_LOGGING
  359.       # EBPF defines configuration for the ebpf, when transparent proxy is marked to be
  360.       # installed using ebpf instead of iptables
  361.       ebpf:
  362.         # Install transparent proxy using ebpf
  363.         enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_ENABLED
  364.         # Name of the environmental variable which will include IP address of the pod
  365.         instanceIPEnvVarName: INSTANCE_IP # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_INSTANCE_IP_ENV_VAR_NAME
  366.         # Path where BPF file system will be mounted for pinning ebpf programs and maps
  367.         bpffsPath: /sys/fs/bpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
  368.         # Path of mounted cgroup2
  369.         cgroupPath: /sys/fs/cgroup # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH
  370.         # Name of the network interface which should be used to attach to it TC programs
  371.         # when not specified, we will try to automatically determine it
  372.         tcAttachIface: "" # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_TC_ATTACH_IFACE
  373.         # Path where compiled eBPF programs are placed
  374.         programsSourcePath: /tmp/kuma-ebpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_PROGRAMS_SOURCE_PATH
  375.       # IgnoredServiceSelectorLabels defines a list ignored labels in Service selector.
  376.       # If Pod matches a Service with ignored labels, but does not match it fully, it gets Ignored inbound.
  377.       # It is useful when you change Service selector and expect traffic to be sent immediately.
  378.       # An example of this is ArgoCD's BlueGreen deployment and "rollouts-pod-template-hash" selector.
  379.       ignoredServiceSelectorLabels: [] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_IGNORED_SERVICE_SELECTOR_LABELS
  380.       # nodeLabelsToCopy defines a list of node labels that should be copied to the Pod.
  381.       nodeLabelsToCopy: ["topology.kubernetes.io/zone", "topology.kubernetes.io/region"] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_NODE_LABELS_TO_COPY
  382.     marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
  383.     # Kubernetes's resources reconciliation concurrency configuration
  384.     controllersConcurrency:
  385.       # PodController defines maximum concurrent reconciliations of Pod resources
  386.       # Default value 10. If set to 0 kube controller-runtime default value of 1 will be used.
  387.       podController: 10 # ENV: KUMA_RUNTIME_KUBERNETES_CONTROLLERS_CONCURRENCY_POD_CONTROLLER
  388.     # Kubernetes client configuration
  389.     clientConfig:
  390.       # Qps defines maximum requests kubernetes client is allowed to make per second.
  391.       # Default value 100. If set to 0 kube-client default value of 5 will be used.
  392.       qps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_QPS
  393.       # BurstQps defines maximum burst requests kubernetes client is allowed to make per second
  394.       # Default value 100. If set to 0 kube-client default value of 10 will be used.
  395.       burstQps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_BURST_QPS
  396.     leaderElection:
  397.       # LeaseDuration is the duration that non-leader candidates will
  398.       # wait to force acquire leadership. This is measured against time of
  399.       # last observed ack. Default is 15 seconds.
  400.       leaseDuration: 15s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_LEASE_DURATION
  401.       # RenewDeadline is the duration that the acting controlplane will retry
  402.       # refreshing leadership before giving up. Default is 10 seconds.
  403.       renewDeadline: 10s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_RENEW_DEADLINE
  404.     # SkipMeshOwnerReference is a flag that allows to skip adding Mesh owner reference to resources.
  405.     # If this is set to true, deleting a Mesh will not delete resources that belong to that Mesh.
  406.     # This can be useful when resources are managed in Argo CD where creation/deletion is managed there.
  407.     skipMeshOwnerReference: false # ENV: KUMA_RUNTIME_KUBERNETES_SKIP_MESH_OWNER_REFERENCE
  408.     # If true, then control plane can support TLS secrets for builtin gateway outside of mesh system namespace.
  409.     # The downside is that control plane requires permission to read Secrets in all namespaces.
  410.     supportGatewaySecretsInAllNamespaces: false # ENV: KUMA_RUNTIME_KUBERNETES_SUPPORT_GATEWAY_SECRETS_IN_ALL_NAMESPACES
  411.   # Universal-specific configuration
  412.   universal:
  413.     # DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
  414.     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
  415.     # VIPRefreshInterval defines how often all meshes' VIPs should be recomputed
  416.     vipRefreshInterval: 500ms # ENV: KUMA_RUNTIME_UNIVERSAL_VIP_REFRESH_INTERVAL
  417. # Default Kuma entities configuration
  418. defaults:
  419.   # If true, it skips creating the default Mesh
  420.   skipMeshCreation: false # ENV: KUMA_DEFAULTS_SKIP_MESH_CREATION
  421.   # If true, it skips creating the default tenant resources
  422.   skipTenantResources: false # ENV: KUMA_DEFAULTS_SKIP_TENANT_RESOURCES
  423.   # If true, it creates the default routing (TrafficPermisson and TrafficRoute) resources for a new Mesh
  424.   createMeshRoutingResources: false # ENV: KUMA_DEFAULTS_CREATE_MESH_ROUTING_RESOURCES
  425. # Metrics configuration
  426. metrics:
  427.   dataplane:
  428.     # How many latest subscriptions will be stored in DataplaneInsight object, if equals 0 then unlimited
  429.     subscriptionLimit: 2 # ENV: KUMA_METRICS_DATAPLANE_SUBSCRIPTION_LIMIT
  430.     # How long data plane proxy can stay Online without active xDS connection
  431.     idleTimeout: 5m # ENV: KUMA_METRICS_DATAPLANE_IDLE_TIMEOUT
  432.   zone:
  433.     # How many latest subscriptions will be stored in ZoneInsights object, if equals 0 then unlimited
  434.     subscriptionLimit: 10 # ENV: KUMA_METRICS_ZONE_SUBSCRIPTION_LIMIT
  435.     # How long zone can stay Online without active KDS connection
  436.     idleTimeout: 5m # ENV: KUMA_METRICS_ZONE_IDLE_TIMEOUT
  437.     # Compact finished metrics (do not store config and details of KDS exchange).
  438.     compactFinishedSubscriptions: false # ENV: KUMA_METRICS_ZONE_COMPACT_FINISHED_SUBSCRIPTIONS
  439.   mesh:
  440.     # Minimum time between 2 refresh of insights
  441.     minResyncInterval: 1s # ENV: KUMA_METRICS_MESH_MIN_RESYNC_INTERVAL
  442.     # time between triggering a full refresh of all the insights
  443.     fullResyncInterval: 20s # ENV: KUMA_METRICS_MESH_FULL_RESYNC_INTERVAL
  444.     # the size of the buffer between event creation and processing
  445.     bufferSize: 1000 # ENV: KUMA_METRICS_MESH_BUFFER_SIZE
  446.     # the number of workers that process metrics events
  447.     eventProcessors: 1 # ENV: KUMA_METRICS_MESH_EVENT_PROCESSORS
  448.   controlPlane:
  449.     # If true metrics show number of resources in the system should be reported
  450.     reportResourcesCount: true # ENV: KUMA_METRICS_CONTROL_PLANE_REPORT_RESOURCES_COUNT
  451. # Reports configuration
  452. reports:
  453.   # If true then usage stats will be reported
  454.   enabled: false # ENV: KUMA_REPORTS_ENABLED
  455. # General configuration
  456. general:
  457.   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
  458.   dnsCacheTTL: 10s # ENV: KUMA_GENERAL_DNS_CACHE_TTL
  459.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert that will be used across all the Kuma Servers.
  460.   tlsCertFile: # ENV: KUMA_GENERAL_TLS_CERT_FILE
  461.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key that will be used across all the Kuma Servers.
  462.   tlsKeyFile: # ENV: KUMA_GENERAL_TLS_KEY_FILE
  463.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  464.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_GENERAL_TLS_MIN_VERSION
  465.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  466.   tlsMaxVersion: # ENV: KUMA_GENERAL_TLS_MAX_VERSION
  467.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  468.   tlsCipherSuites: [] # ENV: KUMA_GENERAL_TLS_CIPHER_SUITES
  469.   # WorkDir defines a path to the working directory
  470.   # Kuma stores in this directory autogenerated entities like certificates.
  471.   # If empty then the working directory is $HOME/.kuma
  472.   workDir: "" # ENV: KUMA_GENERAL_WORK_DIR
  473.   # ResilientComponentBaseBackoff configures base backoff for restarting resilient components:
  474.   # KDS sync, Insight resync, PostgresEventListener, etc.
  475.   resilientComponentBaseBackoff: 5s # ENV: KUMA_GENERAL_RESILIENT_COMPONENT_BASE_BACKOFF
  476.   # ResilientComponentMaxBackoff configures max backoff for restarting resilient component:
  477.   # KDS sync, Insight resync, PostgresEventListener, etc.
  478.   resilientComponentMaxBackoff: 1m # ENV: KUMA_GENERAL_RESILIENT_COMPONENT_MAX_BACKOFF
  479. # DNS Server configuration
  480. dnsServer:
  481.   # The domain that the server will resolve the services for
  482.   domain: "mesh" # ENV: KUMA_DNS_SERVER_DOMAIN
  483.   # The CIDR range used to allocate
  484.   CIDR: "240.0.0.0/4" # ENV: KUMA_DNS_SERVER_CIDR
  485.   # Will create a service "<kuma.io/service>.mesh" dns entry for every service.
  486.   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
  487.   # The port to use along with the `<kuma.io/service>.mesh` dns entry
  488.   serviceVipPort: 80 # ENV: KUMA_DNS_SERVICE_SERVICE_VIP_PORT
  489. # Multizone mode
  490. multizone:
  491.   global:
  492.     kds:
  493.       # Port of a gRPC server that serves Kuma Discovery Service (KDS).
  494.       grpcPort: 5685 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_GRPC_PORT
  495.       # Interval for refreshing state of the world
  496.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_REFRESH_INTERVAL
  497.       # Interval for flushing Zone Insights (stats of multi-zone communication)
  498.       zoneInsightFlushInterval: 10s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_ZONE_INSIGHT_FLUSH_INTERVAL
  499.       # TlsEnabled turns on TLS for KDS
  500.       tlsEnabled: true # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_ENABLED
  501.       # TlsCertFile defines a path to a file with PEM-encoded TLS cert.
  502.       tlsCertFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
  503.       # TlsKeyFile defines a path to a file with PEM-encoded TLS key.
  504.       tlsKeyFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
  505.       # TlsMinVersion the minimum version of TLS
  506.       tlsMinVersion: "TLSv1_2" # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MIN_VERSION
  507.       # TlsMaxVersion the maximum version of TLS
  508.       tlsMaxVersion: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MAX_VERSION
  509.       # TlsCipherSuites the list of cipher suites
  510.       tlsCipherSuites: [] # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CIPHER_SUITES
  511.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  512.       # In practice this means a limit on full list of one resource type.
  513.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MAX_MSG_SIZE
  514.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  515.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  516.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MSG_SEND_TIMEOUT
  517.       # Backoff that is executed when the global control plane is sending the response that was previously rejected by zone control plane
  518.       nackBackoff: 5s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_NACK_BACKOFF
  519.       # DisableSOTW if true doesn't expose SOTW version of KDS. Default: false
  520.       disableSOTW: false # ENV: KUMA_MULTIZONE_GLOBAL_KDS_DISABLE_SOTW
  521.       # Response backoff is a time Global CP waits before sending ACK/NACK.
  522.       # This is a way to slow down Zone CP from sending resources too often.
  523.       responseBackoff: 0s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_RESPONSE_BACKOFF
  524.   zone:
  525.     # Kuma Zone name used to mark the zone dataplane resources
  526.     name: "default" # ENV: KUMA_MULTIZONE_ZONE_NAME
  527.     # GlobalAddress URL of Global Kuma CP
  528.     globalAddress: # ENV KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
  529.     kds:
  530.       # Interval for refreshing state of the world
  531.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_KDS_REFRESH_INTERVAL
  532.       # RootCAFile defines a path to a file with PEM-encoded Root CA. Client will verify server by using it.
  533.       rootCaFile: # ENV: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
  534.       # If true, TLS connection to the server won't be verified.
  535.       tlsSkipVerify: false # ENV: KUMA_MULTIZONE_ZONE_KDS_TLS_SKIP_VERIFY
  536.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  537.       # In practice this means a limit on full list of one resource type.
  538.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_ZONE_KDS_MAX_MSG_SIZE
  539.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  540.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  541.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_ZONE_KDS_MSG_SEND_TIMEOUT
  542.       # Backoff that is executed when the zone control plane is sending the response that was previously rejected by global control plane
  543.       nackBackoff: 5s # ENV: KUMA_MULTIZONE_ZONE_KDS_NACK_BACKOFF
  544.       # Response backoff is a time Zone CP waits before sending ACK/NACK.
  545.       # This is a way to slow down Global CP from sending resources too often.
  546.       responseBackoff: 0s # ENV: KUMA_MULTIZONE_ZONE_KDS_RESPONSE_BACKOFF
  547.     # disableOriginLabelValidation disables validation of the origin label when applying resources on Zone CP
  548.     disableOriginLabelValidation: false # ENV: KUMA_MULTIZONE_ZONE_DISABLE_ORIGIN_LABEL_VALIDATION
  549.     # IngressUpdateInterval is the interval between the CP updating the list of
  550.     # available services on ZoneIngress.
  551.     ingressUpdateInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_INGRESS_UPDATE_INTERVAL
  552. # Diagnostics configuration
  553. diagnostics:
  554.   # Port of Diagnostic Server for checking health and readiness of the Control Plane
  555.   serverPort: 5680 # ENV: KUMA_DIAGNOSTICS_SERVER_PORT
  556.   # If true, enables https://golang.org/pkg/net/http/pprof/ debug endpoints
  557.   debugEndpoints: false # ENV: KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS
  558.   # Whether tls is enabled or not
  559.   tlsEnabled: false # ENV: KUMA_DIAGNOSTICS_TLS_ENABLED
  560.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  561.   tlsCertFile: # ENV: KUMA_DIAGNOSTICS_TLS_CERT_FILE
  562.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  563.   tlsKeyFile: # ENV: KUMA_DIAGNOSTICS_TLS_KEY_FILE
  564.   # TlsMinVersion the minimum version of TLS
  565.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_DIAGNOSTICS_TLS_MIN_VERSION
  566.   # TlsMaxVersion the maximum version of TLS
  567.   tlsMaxVersion: # ENV: KUMA_DIAGNOSTICS_TLS_MAX_VERSION
  568.   # TlsCipherSuites the list of cipher suites
  569.   tlsCipherSuites: [] # ENV: KUMA_DIAGNOSTICS_TLS_CIPHER_SUITES
  570. # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
  571. dpServer:
  572.   # Port of the DP Server
  573.   port: 5678 # ENV: KUMA_DP_SERVER_PORT
  574.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  575.   tlsCertFile: # ENV: KUMA_DP_SERVER_TLS_CERT_FILE
  576.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  577.   tlsKeyFile: # ENV: KUMA_DP_SERVER_TLS_KEY_FILE
  578.   # TlsMinVersion the minimum version of TLS
  579.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_DP_SERVER_TLS_MIN_VERSION
  580.   # TlsMaxVersion the maximum version of TLS
  581.   tlsMaxVersion: # ENV: KUMA_DP_SERVER_TLS_MAX_VERSION
  582.   # TlsCipherSuites the list of cipher suites
  583.   tlsCipherSuites: [] # ENV: KUMA_DP_SERVER_TLS_CIPHER_SUITES
  584.   # ReadHeaderTimeout defines the amount of time DP server will be allowed
  585.   # to read request headers. The connection's read deadline is reset
  586.   # after reading the headers and the Handler can decide what is considered
  587.   # too slow for the body. If ReadHeaderTimeout is zero there is no timeout.
  588.   # The timeout is configurable as in rare cases, when Kuma CP was restarting,
  589.   # 1s which is explicitly set in other servers was insufficient and DPs
  590.   # were failing to reconnect (we observed this in Projected Service Account
  591.   # Tokens e2e tests, which started flaking a lot after introducing explicit
  592.   # 1s timeout)
  593.   readHeaderTimeout: 5s # ENV: KUMA_DP_SERVER_READ_HEADER_TIMEOUT
  594.   # Authn defines an authentication configuration for the DP Server
  595.   authn:
  596.     # Configuration for data plane proxy authentication.
  597.     dpProxy:
  598.       # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  599.       # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  600.       type: ""
  601.       # Configuration of dpToken authentication method
  602.       dpToken:
  603.         # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  604.         enableIssuer: true
  605.         # DP Token validator configuration.
  606.         validator:
  607.           # If true then Kuma secrets with prefix "dataplane-token-signing-key-{mesh}" are considered as signing keys.
  608.           useSecrets: true
  609.           # List of public keys used to validate the token. Example:
  610.           # - kid: 1
  611.           #   mesh: default
  612.           #   key: |
  613.           #     -----BEGIN RSA PUBLIC KEY-----
  614.           #     MIIBCgKCAQEAq....
  615.           #     -----END RSA PUBLIC KEY-----
  616.           # - kid: 2
  617.           #   mesh: demo
  618.           #   keyFile: /keys/public.pem
  619.           publicKeys: []
  620.     # Configuration for zone proxy authentication.
  621.     zoneProxy:
  622.       # Type of authentication. Available values: "serviceAccountToken", "zoneToken", "none".
  623.       # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "zoneToken" on Universal.
  624.       type: ""
  625.       # Configuration for zoneToken authentication method.
  626.       zoneToken:
  627.         # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  628.         enableIssuer: true
  629.         # Zone Token validator configuration.
  630.         validator:
  631.           # If true then Kuma secrets with prefix "zone-token-signing-key" are considered as signing keys.
  632.           useSecrets: true
  633.           # List of public keys used to validate the token. Example:
  634.           # - kid: 1
  635.           #   key: |
  636.           #     -----BEGIN RSA PUBLIC KEY-----
  637.           #     MIIBCgKCAQEAq....
  638.           #     -----END RSA PUBLIC KEY-----
  639.           # - kid: 2
  640.           #   keyFile: /keys/public.pem
  641.           publicKeys: []
  642.     # If true then Envoy uses Google gRPC instead of Envoy gRPC which lets a proxy reload the auth data (service account token, dp token etc.) stored in the file without proxy restart.
  643.     enableReloadableTokens: false # ENV: KUMA_DP_SERVER_AUTHN_ENABLE_RELOADABLE_TOKENS
  644.   # Hds defines a Health Discovery Service configuration
  645.   hds:
  646.     # Enabled if true then Envoy will actively check application's ports, but only on Universal.
  647.     # On Kubernetes this feature disabled for now regardless the flag value
  648.     enabled: true # ENV: KUMA_DP_SERVER_HDS_ENABLED
  649.     # Interval for Envoy to send statuses for HealthChecks
  650.     interval: 5s # ENV: KUMA_DP_SERVER_HDS_INTERVAL
  651.     # RefreshInterval is an interval for re-genarting configuration for Dataplanes connected to the Control Plane
  652.     refreshInterval: 10s # ENV: KUMA_DP_SERVER_HDS_REFRESH_INTERVAL
  653.     # Check defines a HealthCheck configuration
  654.     checkDefaults:
  655.       # Timeout is a time to wait for a health check response. If the timeout is reached the
  656.       # health check attempt will be considered a failure
  657.       timeout: 2s # ENV: KUMA_DP_SERVER_HDS_CHECK_TIMEOUT
  658.       # Interval between health checks
  659.       interval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_INTERVAL
  660.       # NoTrafficInterval is a special health check interval that is used when a cluster has
  661.       #    never had traffic routed to it
  662.       noTrafficInterval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_NO_TRAFFIC_INTERVAL
  663.       # HealthyThreshold is a number of healthy health checks required before a host is marked healthy
  664.       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
  665.       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
  666.       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
  667. # Intercommunication CP configuration
  668. interCp:
  669.   # Catalog configuration. Catalog keeps a record of all live CP instances in the zone.
  670.   catalog:
  671.     # Indicates an address on which other control planes can communicate with this CP.
  672.     # If empty then it's autoconfigured by taking the first IP of the nonloopback network interface.
  673.     instanceAddress: "" # ENV: KUMA_INTER_CP_CATALOG_INSTANCE_ADDRESS
  674.     # Interval on which CP will send heartbeat to a leader.
  675.     heartbeatInterval: 5s # ENV: KUMA_INTER_CP_CATALOG_HEARTBEAT_INTERVAL
  676.     # Interval on which CP will write all instances to a catalog.
  677.     writerInterval: 15s # ENV: KUMA_INTER_CP_CATALOG_WRITER_INTERVAL
  678.   # Intercommunication CP server configuration
  679.   server:
  680.     # Port of the inter-cp server
  681.     port: 5683 # ENV: KUMA_INTER_CP_SERVER_PORT
  682.     # TlsMinVersion the minimum version of TLS
  683.     tlsMinVersion: "TLSv1_2" # ENV: KUMA_INTER_CP_SERVER_TLS_MIN_VERSION
  684.     # TlsMaxVersion the maximum version of TLS
  685.     tlsMaxVersion: # ENV: KUMA_INTER_CP_SERVER_TLS_MAX_VERSION
  686.     # TlsCipherSuites the list of cipher suites
  687.     tlsCipherSuites: [] # ENV: KUMA_INTER_CP_SERVER_TLS_CIPHER_SUITES
  688. # Access Control configuration
  689. access:
  690.   # Type of access strategy (available values: "static")
  691.   type: static
  692.   # Configuration of static access strategy
  693.   static:
  694.     # AdminResources defines an access to admin resources (Secret/GlobalSecret)
  695.     adminResources:
  696.       # List of users that are allowed to access admin resources
  697.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_USERS
  698.       # List of groups that are allowed to access admin resources
  699.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_GROUPS
  700.     # GenerateDPToken defines an access to generating dataplane token
  701.     generateDpToken:
  702.       # List of users that are allowed to generate dataplane token
  703.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_USERS
  704.       # List of groups that are allowed to generate dataplane token
  705.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_GROUPS
  706.     # GenerateUserToken defines an access to generating user token
  707.     generateUserToken:
  708.       # List of users that are allowed to generate user token
  709.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_USERS
  710.       # List of groups that are allowed to generate user token
  711.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_GROUPS
  712.     # GenerateZoneToken defines an access to generating zone token
  713.     generateZoneToken:
  714.       # List of users that are allowed to generate zone token
  715.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_USERS
  716.       # List of groups that are allowed to generate zone token
  717.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
  718.     viewConfigDump:
  719.       # List of users that are allowed to get envoy config dump
  720.       users: [] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
  721.       # List of groups that are allowed to get envoy config dump
  722.       groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
  723.     viewStats:
  724.       # List of users that are allowed to get envoy stats
  725.       users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
  726.       # List of groups that are allowed to get envoy stats
  727.       groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
  728.     viewClusters:
  729.       # List of users that are allowed to get envoy clusters
  730.       users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
  731.       # List of groups that are allowed to get envoy clusters
  732.       groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
  733.     controlPlaneMetadata:
  734.       # List of users that are allowed to get control plane metadata
  735.       users: [] # ENV: KUMA_ACCESS_STATIC_CONTROL_PLANE_METADATA_USERS
  736.       # List of groups that are allowed to get control plane metadata
  737.       groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_CONTROL_PLANE_METADATA_GROUPS
  738. # Configuration of experimental features of Kuma
  739. experimental:
  740.   # If true, instead of embedding kubernetes outbounds into Dataplane object, they are persisted next to VIPs in ConfigMap
  741.   # This can improve performance, but it should be enabled only after all instances are migrated to version that supports this config
  742.   kubeOutboundsAsVIPs: true # ENV: KUMA_EXPERIMENTAL_KUBE_OUTBOUNDS_AS_VIPS
  743.   # Tag first virtual outbound model is compressed version of default Virtual Outbound model
  744.   # It is recommended to use tag first model for deployments with more than 2k services
  745.   # You can enable this flag on existing deployment. In order to downgrade cp with this flag enabled
  746.   # you need to first disable this flag and redeploy cp, after config is rewritten to default
  747.   # format you can downgrade your cp
  748.   useTagFirstVirtualOutboundModel: false # ENV: KUMA_EXPERIMENTAL_USE_TAG_FIRST_VIRTUAL_OUTBOUND_MODEL
  749.   # If true, KDS will sync using incremental xDS updates
  750.   kdsDeltaEnabled: true # ENV: KUMA_EXPERIMENTAL_KDS_DELTA_ENABLED
  751.   # List of prefixes that will be used to filter out tags by keys from ingress' available services section.
  752.   # This can trim the size of the ZoneIngress object significantly.
  753.   # The drawback is that you cannot use filtered out tags for traffic routing.
  754.   # If empty, no filter is applied.
  755.   ingressTagFilters: [] # ENV: KUMA_EXPERIMENTAL_INGRESS_TAG_FILTERS
  756.   # KDS event based watchdog settings. It is a more optimal way to generate KDS snapshot config.
  757.   kdsEventBasedWatchdog:
  758.     # If true, then experimental event based watchdog to generate KDS snapshot is used.
  759.     enabled: false # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_ENABLED
  760.     # How often we flush changes when experimental event based watchdog is used.
  761.     flushInterval: 5s # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_FLUSH_INTERVAL
  762.     # How often we schedule full KDS resync when experimental event based watchdog is used.
  763.     fullResyncInterval: 60s # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_FULL_RESYNC_INTERVAL
  764.     # If true, then initial full resync is going to be delayed by 0 to FullResyncInterval.
  765.     delayFullResync: false # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_DELAY_FULL_RESYNC
  766.   # If true then control plane computes reachable services automatically based on MeshTrafficPermission.
  767.   # Lack of MeshTrafficPermission is treated as Deny the traffic.
  768.   autoReachableServices: false # ENV: KUMA_EXPERIMENTAL_AUTO_REACHABLE_SERVICES
  769.   # Enables sidecar containers in Kubernetes if supported by the Kubernetes
  770.   # environment.
  771.   sidecarContainers: false # ENV: KUMA_EXPERIMENTAL_SIDECAR_CONTAINERS
  772.   # If true then it generates MeshServices from Kubernetes Service.
  773.   generateMeshServices: false # ENV: KUMA_EXPERIMENTAL_GENERATE_MESH_SERVICES
  774.   # If true skips persisted VIPs. Change to true only if generateMeshServices is enabled.
  775.   # Do not enable on production.
  776.   skipPersistedVIPs: false # ENV: KUMA_EXPERIMENTAL_SKIP_PERSISTED_VIPS
  777. proxy:
  778.   gateway:
  779.     # Sets the envoy runtime value to limit maximum number of incoming
  780.     # connections to a builtin gateway data plane proxy
  781.     globalDownstreamMaxConnections: 50000 # ENV: KUMA_PROXY_GATEWAY_GLOBAL_DOWNSTREAM_MAX_CONNECTIONS
  782. tracing:
  783.   openTelemetry:
  784.     endpoint: "" # e.g. otel-collector:4317
  785. # Configuration of the event bus which is local to one instance of CP
  786. eventBus:
  787.   # BufferSize controls the buffer for every single event listener.
  788.   # If we go over buffer, additional delay may happen to various operation like insight recomputation or KDS.
  789.   bufferSize: 100 # ENV: KUMA_EVENT_BUS_BUFFER_SIZE
  790. policies:
  791.   # PluginPoliciesEnabled controls which policy plugins are enabled
  792.   pluginPoliciesEnabled: # ENV: KUMA_PLUGIN_POLICIES_ENABLED
  793.     - meshaccesslogs
  794.     - meshcircuitbreakers
  795.     - meshfaultinjections
  796.     - meshhealthchecks
  797.     - meshhttproutes
  798.     - meshloadbalancingstrategies
  799.     - meshmetrics
  800.     - meshproxypatches
  801.     - meshratelimits
  802.     - meshretries
  803.     - meshtcproutes
  804.     - meshtimeouts
  805.     - meshtraces
  806.     - meshtrafficpermissions
  807. coreResources:
  808.   enabled: # ENV: KUMA_CORE_RESOURCES_ENABLED
  809.     - meshservices

Helm values.yaml

  1. global:
  2.   image:
  3.     # -- Default registry for all Kuma Images
  4.     registry: "docker.io/kumahq"
  5.     # -- The default tag for all Kuma images, which itself defaults to .Chart.AppVersion
  6.     tag:
  7.   # -- Add `imagePullSecrets` to all the service accounts used for Kuma components
  8.   imagePullSecrets: []
  10. # -- Whether to patch the target namespace with the system label
  11. patchSystemNamespace: true
  13. installCrdsOnUpgrade:
  14.   # -- Whether install new CRDs before upgrade (if any were introduced with the new version of Kuma)
  15.   enabled: true
  16.   # -- The `imagePullSecrets` to attach to the Service Account running CRD installation.
  17.   # This field will be deprecated in a future release, please use .global.imagePullSecrets
  18.   imagePullSecrets: []
  20. # -- Whether to disable all helm hooks
  21. noHelmHooks: false
  23. # -- Whether to restart control-plane by calculating a new checksum for the secret
  24. restartOnSecretChange: true
  26. controlPlane:
  27.   # -- Environment that control plane is run in, useful when running universal global control plane on k8s
  28.   environment: "kubernetes"
  30.   # -- Labels to add to resources in addition to default labels
  31.   extraLabels: {}
  33.   # -- Kuma CP log level: one of off,info,debug
  34.   logLevel: "info"
  36.   # -- Kuma CP log output path: Defaults to /dev/stdout
  37.   logOutputPath: ""
  39.   # -- Kuma CP modes: one of zone,global
  40.   mode: "zone"
  42.   # -- (string) Kuma CP zone, if running multizone
  43.   zone:
  45.   # -- Only used in `zone` mode
  46.   kdsGlobalAddress: ""
  48.   # -- Number of replicas of the Kuma CP. Ignored when autoscaling is enabled
  49.   replicas: 1
  51.   # -- Minimum number of seconds for which a newly created pod should be ready for it to be considered available.
  52.   minReadySeconds: 0
  54.   # -- Annotations applied only to the `Deployment` resource
  55.   deploymentAnnotations: {}
  57.   # -- Annotations applied only to the `Pod` resource
  58.   podAnnotations: {}
  60.   # Horizontal Pod Autoscaling configuration
  61.   autoscaling:
  62.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  63.     enabled: false
  65.     # -- The minimum CP pods to allow
  66.     minReplicas: 2
  67.     # -- The max CP pods to scale to
  68.     maxReplicas: 5
  70.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  71.     targetCPUUtilizationPercentage: 80
  72.     # -- For clusters that do support autoscaling/v2, use metrics
  73.     metrics:
  74.       - type: Resource
  75.         resource:
  76.           name: cpu
  77.           target:
  78.             type: Utilization
  79.             averageUtilization: 80
  81.   # -- Node selector for the Kuma Control Plane pods
  82.   nodeSelector:
  83.     kubernetes.io/os: linux
  85.   # -- Tolerations for the Kuma Control Plane pods
  86.   tolerations: []
  88.   podDisruptionBudget:
  89.     # -- Whether to create a pod disruption budget
  90.     enabled: false
  91.     # -- The maximum number of unavailable pods allowed by the budget
  92.     maxUnavailable: 1
  94.   # -- Affinity placement rule for the Kuma Control Plane pods.
  95.   # This is rendered as a template, so you can reference other helm variables or includes.
  96.   affinity:
  97.     podAntiAffinity:
  98.       preferredDuringSchedulingIgnoredDuringExecution:
  99.       - weight: 100
  100.         podAffinityTerm:
  101.           labelSelector:
  102.             # These match the selector labels used on the deployment.
  103.             matchExpressions:
  104.               - key: app.kubernetes.io/name
  105.                 operator: In
  106.                 values:
  107.                   - '{{ include "kuma.name" . }}'
  108.               - key: app.kubernetes.io/instance
  109.                 operator: In
  110.                 values:
  111.                   - '{{ .Release.Name }}'
  112.               - key: app
  113.                 operator: In
  114.                 values:
  115.                   - '{{ include "kuma.name" . }}-control-plane'
  116.           topologyKey: kubernetes.io/hostname
  118.   # -- Topology spread constraints rule for the Kuma Control Plane pods.
  119.   # This is rendered as a template, so you can use variables to generate match labels.
  120.   topologySpreadConstraints:
  122.   # -- Failure policy of the mutating webhook implemented by the Kuma Injector component
  123.   injectorFailurePolicy: Fail
  125.   service:
  126.     apiServer:
  127.       http:
  128.         # -- Port on which Http api server Service is exposed on Node for service of type NodePort
  129.         nodePort: 30681
  130.       https:
  131.         # -- Port on which Https api server Service is exposed on Node for service of type NodePort
  132.         nodePort: 30682
  134.     # -- Whether to create a service resource.
  135.     enabled: true
  137.     # -- (string) Optionally override of the Kuma Control Plane Service's name
  138.     name:
  140.     # -- Service type of the Kuma Control Plane
  141.     type: ClusterIP
  143.     # -- Annotations to put on the Kuma Control Plane
  144.     annotations:
  145.       prometheus.io/scrape: "true"
  146.       prometheus.io/port: "5680"
  148.   # Kuma API and GUI ingress settings. Useful if you want to expose the
  149.   # API and GUI of Kuma outside the k8s cluster.
  150.   ingress:
  151.     # -- Install K8s Ingress resource that exposes GUI and API
  152.     enabled: false
  153.     # -- IngressClass defines which controller will implement the resource
  154.     ingressClassName:
  155.     # -- Ingress hostname
  156.     hostname:
  157.     # -- Map of ingress annotations.
  158.     annotations: {}
  159.     # -- Ingress path.
  160.     path: /
  161.     # -- Each path in an Ingress is required to have a corresponding path type. (ImplementationSpecific/Exact/Prefix)
  162.     pathType: ImplementationSpecific
  163.     # -- Port from kuma-cp to use to expose API and GUI. Switch to 5682 to expose TLS port
  164.     servicePort: 5681
  166.   globalZoneSyncService:
  167.     # -- Whether to create a k8s service for the global zone sync
  168.     # service. It will only be created when enabled and deploying the global
  169.     # control plane.
  170.     enabled: true
  171.     # -- Service type of the Global-zone sync
  172.     type: LoadBalancer
  173.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  174.     loadBalancerIP:
  175.     # -- Optionally specify allowed source ranges that can access the load balancer
  176.     loadBalancerSourceRanges: []
  177.     # -- Additional annotations to put on the Global Zone Sync Service
  178.     annotations: { }
  179.     # -- Port on which Global Zone Sync Service is exposed on Node for service of type NodePort
  180.     nodePort: 30685
  181.     # -- Port on which Global Zone Sync Service is exposed
  182.     port: 5685
  183.     # -- Protocol of the Global Zone Sync service port
  184.     protocol: grpc
  186.   defaults:
  187.     # -- Whether to skip creating the default Mesh
  188.     skipMeshCreation: false
  190.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  191.   automountServiceAccountToken: true
  193.   # -- Optionally override the resource spec
  194.   resources:
  195.     requests:
  196.        cpu: 500m
  197.        memory: 256Mi
  198.     limits:
  199.        memory: 256Mi
  201.   # -- Pod lifecycle settings (useful for adding a preStop hook, when
  202.   # using AWS ALB or NLB)
  203.   lifecycle: {}
  205.   # -- Number of seconds to wait before force killing the pod. Make sure to
  206.   # update this if you add a preStop hook.
  207.   terminationGracePeriodSeconds: 30
  209.   # TLS for various servers
  210.   tls:
  211.     general:
  212.       # -- Secret that contains tls.crt, tls.key [and ca.crt when no
  213.       # controlPlane.tls.general.caSecretName specified] for protecting
  214.       # Kuma in-cluster communication
  215.       secretName: ""
  216.       # -- Secret that contains ca.crt that was used to sign cert for protecting
  217.       # Kuma in-cluster communication (ca.crt present in this secret
  218.       # have precedence over the one provided in the controlPlane.tls.general.secretName)
  219.       caSecretName: ""
  220.       # -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
  221.       caBundle: ""
  222.     apiServer:
  223.       # -- Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS
  224.       secretName: ""
  225.       # -- Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS
  226.       clientCertsSecretName: ""
  227.     # - if not creating the global control plane, then do nothing
  228.     # - if secretName is empty and create is false, then do nothing
  229.     # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
  230.     # - if secretName is empty and create is true, then create a secret with a default name and use it
  231.     # - if secretName is non-empty and create is true, then create the secret using the provided name
  232.     kdsGlobalServer:
  233.       # -- Name of the K8s TLS Secret resource. If you set this and don't set
  234.       # create=true, you have to create the secret manually.
  235.       secretName: ""
  236.       # -- Whether to create the TLS secret in helm.
  237.       create: false
  238.       # -- The TLS certificate to offer.
  239.       cert: ""
  240.       # -- The TLS key to use.
  241.       key: ""
  242.     # - if not creating the zonal control plane, then do nothing
  243.     # - if secretName is empty and create is false, then do nothing
  244.     # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
  245.     # - if secretName is empty and create is true, then create a secret with a default name and use it
  246.     # - if secretName is non-empty and create is true, then create the secret using the provided name
  247.     kdsZoneClient:
  248.       # -- Name of the K8s Secret resource that contains ca.crt which was
  249.       # used to sign the certificate of KDS Global Server. If you set this
  250.       # and don't set create=true, you have to create the secret manually.
  251.       secretName: ""
  252.       # -- Whether to create the TLS secret in helm.
  253.       create: false
  254.       # -- CA bundle that was used to sign the certificate of KDS Global Server.
  255.       cert: ""
  256.       # -- If true, TLS cert of the server is not verified.
  257.       skipVerify: false
  259.   # -- Annotations to add for Control Plane's Service Account
  260.   serviceAccountAnnotations: { }
  262.   image:
  263.     # -- Kuma CP ImagePullPolicy
  264.     pullPolicy: IfNotPresent
  265.     # -- Kuma CP image repository
  266.     repository: "kuma-cp"
  267.     # -- Kuma CP Image tag. When not specified, the value is copied from global.tag
  268.     tag:
  270.   # -- (object with { Env: string, Secret: string, Key: string }) Secrets to add as environment variables,
  271.   # where `Env` is the name of the env variable,
  272.   # `Secret` is the name of the Secret,
  273.   # and `Key` is the key of the Secret value to use
  274.   secrets:
  275.   #  someSecret:
  276.   #    Secret: some-secret
  277.   #    Key: secret_key
  278.   #    Env: SOME_SECRET
  280.   # -- Additional environment variables that will be passed to the control plane
  281.   envVars: { }
  283.   # -- Additional config maps to mount into the control plane, with optional inline values
  284.   extraConfigMaps: [ ]
  285. #    - name: extra-config
  286. #      mountPath: /etc/extra-config
  287. #      readOnly: true
  288. #      values:
  289. #        extra-config-key: |
  290. #          extra-config-value
  292.   # -- (object with { name: string, mountPath: string, readOnly: string }) Additional secrets to mount into the control plane,
  293.   # where `Env` is the name of the env variable,
  294.   # `Secret` is the name of the Secret,
  295.   # and `Key` is the key of the Secret value to use
  296.   extraSecrets:
  297.   #  extraConfig:
  298.   #    name: extra-config
  299.   #    mountPath: /etc/extra-config
  300.   #    readOnly: true
  302.   webhooks:
  303.     validator:
  304.       # -- Additional rules to apply on Kuma validator webhook. Useful when building custom policy on top of Kuma.
  305.       additionalRules: ""
  306.     ownerReference:
  307.       # -- Additional rules to apply on Kuma owner reference webhook. Useful when building custom policy on top of Kuma.
  308.       additionalRules: ""
  310.   # -- Specifies if the deployment should be started in hostNetwork mode.
  311.   hostNetwork: false
  312.   # -- Define a new server port for the admission controller. Recommended to set in combination with
  313.   # hostNetwork to prevent multiple port bindings on the same port (like Calico in AWS EKS).
  314.   admissionServerPort: 5443
  316.   # -- Security context at the pod level for control plane.
  317.   podSecurityContext:
  318.     runAsNonRoot: true
  320.   # -- Security context at the container level for control plane.
  321.   containerSecurityContext:
  322.     readOnlyRootFilesystem: true
  324.   # -- If true, then control plane can support TLS secrets for builtin gateway outside of mesh system namespace.
  325.   # The downside is that control plane requires permission to read Secrets in all namespaces.
  326.   supportGatewaySecretsInAllNamespaces: false
  328. cni:
  329.   # -- Install Kuma with CNI instead of proxy init container
  330.   enabled: false
  331.   # -- Install CNI in chained mode
  332.   chained: false
  333.   # -- Set the CNI install directory
  334.   netDir: /etc/cni/multus/net.d
  335.   # -- Set the CNI bin directory
  336.   binDir: /var/lib/cni/bin
  337.   # -- Set the CNI configuration name
  338.   confName: kuma-cni.conf
  339.   # -- CNI log level: one of off,info,debug
  340.   logLevel: info
  341.   # -- Node Selector for the CNI pods
  342.   nodeSelector:
  343.     kubernetes.io/os: linux
  344.   # -- Tolerations for the CNI pods
  345.   tolerations: []
  346.   # -- Additional pod annotations
  347.   podAnnotations: { }
  348.   # -- Set the CNI namespace
  349.   namespace: kube-system
  351.   image:
  352.     # -- CNI image repository
  353.     repository: "kuma-cni"
  354.     # -- CNI image tag - defaults to .Chart.AppVersion
  355.     tag:
  356.     # -- CNI image pull policy
  357.     imagePullPolicy: IfNotPresent
  359.   # -- it's only useful in tests to trigger a possible race condition
  360.   delayStartupSeconds: 0
  362.   # -- use new CNI (experimental)
  363.   experimental:
  364.     imageEbpf:
  365.       # -- CNI experimental eBPF image registry
  366.       registry: "docker.io/kumahq"
  367.       # -- CNI experimental eBPF image repository
  368.       repository: "merbridge"
  369.       # -- CNI experimental eBPF image tag
  370.       tag: "0.8.5"
  372.   resources:
  373.     requests:
  374.       cpu: 100m
  375.       memory: 100Mi
  376.     limits:
  377.       memory: 100Mi
  379.   # -- Security context at the pod level for cni
  380.   podSecurityContext: {}
  382.   # -- Security context at the container level for cni
  383.   containerSecurityContext:
  384.     readOnlyRootFilesystem: true
  385.     runAsNonRoot: false
  386.     runAsUser: 0
  387.     runAsGroup: 0
  389. dataPlane:
  390.   # -- If true, then turn on CoreDNS query logging
  391.   dnsLogging: false
  392.   image:
  393.     # -- The Kuma DP image repository
  394.     repository: "kuma-dp"
  395.     # -- Kuma DP ImagePullPolicy
  396.     pullPolicy: IfNotPresent
  397.     # -- Kuma DP Image Tag. When not specified, the value is copied from global.tag
  398.     tag:
  400.   initImage:
  401.     # -- The Kuma DP init image repository
  402.     repository: "kuma-init"
  403.     # -- Kuma DP init image tag When not specified, the value is copied from global.tag
  404.     tag:
  406. ingress:
  407.   # -- If true, it deploys Ingress for cross cluster communication
  408.   enabled: false
  410.   # -- Labels to add to resources, in addition to default labels
  411.   extraLabels: {}
  413.   # -- Time for which old listener will still be active as draining
  414.   drainTime: 30s
  416.   # -- Number of replicas of the Ingress. Ignored when autoscaling is enabled.
  417.   replicas: 1
  419.   # -- Log level for ingress (available values: off|info|debug)
  420.   logLevel: info
  422.   # -- Define the resources to allocate to mesh ingress
  423.   resources:
  424.     requests:
  425.       cpu: 50m
  426.       memory: 64Mi
  427.     limits:
  428.       cpu: 1000m
  429.       memory: 512Mi
  431.   # -- Pod lifecycle settings (useful for adding a preStop hook, when
  432.   # using AWS ALB or NLB)
  433.   lifecycle: {}
  435.   # -- Number of seconds to wait before force killing the pod. Make sure to
  436.   # update this if you add a preStop hook.
  437.   terminationGracePeriodSeconds: 40
  439.   # Horizontal Pod Autoscaling configuration
  440.   autoscaling:
  441.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  442.     enabled: false
  444.     # -- The minimum CP pods to allow
  445.     minReplicas: 2
  446.     # -- The max CP pods to scale to
  447.     maxReplicas: 5
  449.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  450.     targetCPUUtilizationPercentage: 80
  451.     # -- For clusters that do support autoscaling/v2, use metrics
  452.     metrics:
  453.       - type: Resource
  454.         resource:
  455.           name: cpu
  456.           target:
  457.             type: Utilization
  458.             averageUtilization: 80
  460.   service:
  461.     # -- Whether to create a Service resource.
  462.     enabled: true
  463.     # -- Service type of the Ingress
  464.     type: LoadBalancer
  465.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  466.     loadBalancerIP:
  467.     # -- Additional annotations to put on the Ingress service
  468.     annotations: { }
  469.     # -- Port on which Ingress is exposed
  470.     port: 10001
  471.     # -- Port on which service is exposed on Node for service of type NodePort
  472.     nodePort:
  473.   # -- Additional pod annotations (deprecated favor `podAnnotations`)
  474.   annotations: { }
  475.   # -- Additional pod annotations
  476.   podAnnotations: { }
  477.   # -- Node Selector for the Ingress pods
  478.   nodeSelector:
  479.     kubernetes.io/os: linux
  480.   # -- Tolerations for the Ingress pods
  481.   tolerations: []
  482.   podDisruptionBudget:
  483.     # -- Whether to create a pod disruption budget
  484.     enabled: false
  485.     # -- The maximum number of unavailable pods allowed by the budget
  486.     maxUnavailable: 1
  488.   # -- Affinity placement rule for the Kuma Ingress pods
  489.   # This is rendered as a template, so you can reference other helm variables
  490.   # or includes.
  491.   affinity:
  492.     podAntiAffinity:
  493.       preferredDuringSchedulingIgnoredDuringExecution:
  494.       - weight: 100
  495.         podAffinityTerm:
  496.           labelSelector:
  497.             # These match the selector labels used on the deployment.
  498.             matchExpressions:
  499.               - key: app.kubernetes.io/name
  500.                 operator: In
  501.                 values:
  502.                   - '{{ include "kuma.name" . }}'
  503.               - key: app.kubernetes.io/instance
  504.                 operator: In
  505.                 values:
  506.                   - '{{ .Release.Name }}'
  507.               - key: app
  508.                 operator: In
  509.                 values:
  510.                   - kuma-ingress
  511.           topologyKey: kubernetes.io/hostname
  513.   # -- Topology spread constraints rule for the Kuma Mesh Ingress pods.
  514.   # This is rendered as a template, so you can use variables to generate match labels.
  515.   topologySpreadConstraints:
  517.   # -- Security context at the pod level for ingress
  518.   podSecurityContext:
  519.     runAsNonRoot: true
  520.     runAsUser: 5678
  521.     runAsGroup: 5678
  523.   # -- Security context at the container level for ingress
  524.   containerSecurityContext:
  525.     readOnlyRootFilesystem: true
  527.   # -- Annotations to add for Control Plane's Service Account
  528.   serviceAccountAnnotations: { }
  529.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  530.   automountServiceAccountToken: true
  532. egress:
  533.   # -- If true, it deploys Egress for cross cluster communication
  534.   enabled: false
  535.   # -- Labels to add to resources, in addition to the default labels.
  536.   extraLabels: {}
  537.   # -- Time for which old listener will still be active as draining
  538.   drainTime: 30s
  539.   # -- Number of replicas of the Egress. Ignored when autoscaling is enabled.
  540.   replicas: 1
  542.   # -- Log level for egress (available values: off|info|debug)
  543.   logLevel: info
  545.   # Horizontal Pod Autoscaling configuration
  546.   autoscaling:
  547.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  548.     enabled: false
  550.     # -- The minimum CP pods to allow
  551.     minReplicas: 2
  552.     # -- The max CP pods to scale to
  553.     maxReplicas: 5
  555.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  556.     targetCPUUtilizationPercentage: 80
  557.     # -- For clusters that do support autoscaling/v2, use metrics
  558.     metrics:
  559.       - type: Resource
  560.         resource:
  561.           name: cpu
  562.           target:
  563.             type: Utilization
  564.             averageUtilization: 80
  565.   resources:
  566.     requests:
  567.       cpu: 50m
  568.       memory: 64Mi
  569.     limits:
  570.       cpu: 1000m
  571.       memory: 512Mi
  573.   service:
  574.     # -- Whether to create the service object
  575.     enabled: true
  576.     # -- Service type of the Egress
  577.     type: ClusterIP
  578.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  579.     loadBalancerIP:
  580.     # -- Additional annotations to put on the Egress service
  581.     annotations: { }
  582.     # -- Port on which Egress is exposed
  583.     port: 10002
  584.     # -- Port on which service is exposed on Node for service of type NodePort
  585.     nodePort:
  586.   # -- Additional pod annotations (deprecated favor `podAnnotations`)
  587.   annotations: { }
  588.   # -- Additional pod annotations
  589.   podAnnotations: { }
  590.   # -- Node Selector for the Egress pods
  591.   nodeSelector:
  592.     kubernetes.io/os: linux
  593.   # -- Tolerations for the Egress pods
  594.   tolerations: []
  595.   podDisruptionBudget:
  596.     # -- Whether to create a pod disruption budget
  597.     enabled: false
  598.     # -- The maximum number of unavailable pods allowed by the budget
  599.     maxUnavailable: 1
  601.   # -- Affinity placement rule for the Kuma Egress pods.
  602.   # This is rendered as a template, so you can reference other helm variables or includes.
  603.   affinity:
  604.     podAntiAffinity:
  605.       preferredDuringSchedulingIgnoredDuringExecution:
  606.       - weight: 100
  607.         podAffinityTerm:
  608.           labelSelector:
  609.             # These match the selector labels used on the deployment.
  610.             matchExpressions:
  611.               - key: app.kubernetes.io/name
  612.                 operator: In
  613.                 values:
  614.                   - '{{ include "kuma.name" . }}'
  615.               - key: app.kubernetes.io/instance
  616.                 operator: In
  617.                 values:
  618.                   - '{{ .Release.Name }}'
  619.               - key: app
  620.                 operator: In
  621.                 values:
  622.                   - kuma-egress
  623.           topologyKey: kubernetes.io/hostname
  625.   # -- Topology spread constraints rule for the Kuma Egress pods.
  626.   # This is rendered as a template, so you can use variables to generate match labels.
  627.   topologySpreadConstraints:
  629.   # -- Security context at the pod level for egress
  630.   podSecurityContext:
  631.     runAsNonRoot: true
  632.     runAsUser: 5678
  633.     runAsGroup: 5678
  635.   # -- Security context at the container level for egress
  636.   containerSecurityContext:
  637.     readOnlyRootFilesystem: true
  639.   # -- Annotations to add for Control Plane's Service Account
  640.   serviceAccountAnnotations: { }
  641.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  642.   automountServiceAccountToken: true
  644. kumactl:
  645.   image:
  646.     # -- The kumactl image repository
  647.     repository: kumactl
  648.     # -- The kumactl image tag. When not specified, the value is copied from global.tag
  649.     tag:
  651. kubectl:
  652.   image:
  653.     # -- The kubectl image registry
  654.     registry: docker.io
  655.     # -- The kubectl image repository
  656.     repository: bitnami/kubectl
  657.     # -- The kubectl image tag
  658.     tag: "1.27.5"
  659. hooks:
  660.   # -- Node selector for the HELM hooks
  661.   nodeSelector:
  662.     kubernetes.io/os: linux
  663.   # -- Tolerations for the HELM hooks
  664.   tolerations: []
  665.   # -- Security context at the pod level for crd/webhook/ns
  666.   podSecurityContext:
  667.     runAsNonRoot: true
  669.   # -- Security context at the container level for crd/webhook/ns
  670.   containerSecurityContext:
  671.     readOnlyRootFilesystem: true
  673.   # -- ebpf-cleanup hook needs write access to the root filesystem to clean ebpf programs
  674.   # Changing below values will potentially break ebpf cleanup completely,
  675.   # so be cautious when doing so.
  676.   ebpfCleanup:
  677.     # -- Security context at the pod level for crd/webhook/cleanup-ebpf
  678.     podSecurityContext:
  679.       runAsNonRoot: false
  680.     # -- Security context at the container level for crd/webhook/cleanup-ebpf
  681.     containerSecurityContext:
  682.       readOnlyRootFilesystem: false
  684. experimental:
  685.   # Configuration for the experimental ebpf mode for transparent proxy
  686.   ebpf:
  687.     # -- If true, ebpf will be used instead of using iptables to install/configure transparent proxy
  688.     enabled: false
  689.     # -- Name of the environmental variable which will contain the IP address of a pod
  690.     instanceIPEnvVarName: INSTANCE_IP
  691.     # -- Path where BPF file system should be mounted
  692.     bpffsPath: /sys/fs/bpf
  693.     # -- Host's cgroup2 path
  694.     cgroupPath: /sys/fs/cgroup
  695.     # -- Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty
  696.     tcAttachIface: ""
  697.     # -- Path where compiled eBPF programs which will be installed can be found
  698.     programsSourcePath: /tmp/kuma-ebpf
  699.   # -- If false, it uses legacy API for resource synchronization
  700.   deltaKds: true
  701.   # -- If true, enable native Kubernetes sidecars. This requires at least
  702.   # Kubernetes v1.29
  703.   sidecarContainers: false
  705. # Postgres' settings for universal control plane on k8s
  706. postgres:
  707.   # -- Postgres port, password should be provided as a secret reference in "controlPlane.secrets"
  708.   # with the Env value "KUMA_STORE_POSTGRES_PASSWORD".
  709.   # Example:
  710.   # controlPlane:
  711.   #   secrets:
  712.   #     - Secret: postgres-postgresql
  713.   #       Key: postgresql-password
  714.   #       Env: KUMA_STORE_POSTGRES_PASSWORD
  715.   port: "5432"
  716.   # TLS settings
  717.   tls:
  718.     # -- Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  719.     mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  720.     # -- Whether to disable SNI the postgres `sslsni` option.
  721.     disableSSLSNI: false # ENV: KUMA_STORE_POSTGRES_TLS_DISABLE_SSLSNI
  722.     # -- Secret name that contains the ca.crt
  723.     caSecretName:
  724.     # -- Secret name that contains the client tls.crt, tls.key
  725.     secretName:
  727. # @ignored for helm-docs
  728. plugins:
  729.   resources:
  730.     meshservices: true
  731.   policies:
  732.     meshaccesslogs: true
  733.     meshcircuitbreakers: true
  734.     meshfaultinjections: true
  735.     meshhealthchecks: true
  736.     meshhttproutes: true
  737.     meshloadbalancingstrategies: true
  738.     meshmetrics: true
  739.     meshproxypatches: true
  740.     meshratelimits: true
  741.     meshretries: true
  742.     meshtcproutes: true
  743.     meshtimeouts: true
  744.     meshtraces: true
  745.     meshtrafficpermissions: true