kuma-cp configuration reference

Kuma CP configuration

  1. # Environment type. Available values are: "kubernetes" or "universal"
  2. environment: universal # ENV: KUMA_ENVIRONMENT
  3. # Mode in which Kuma CP is running. Available values are: "global", "zone", "standalone" (deprecated, use "zone")
  4. mode: zone # ENV: KUMA_MODE
  5. # Resource Store configuration
  6. store:
  7.   # Type of Store used in the Control Plane. Available values are: "kubernetes", "postgres" or "memory"
  8.   type: memory # ENV: KUMA_STORE_TYPE
  9.   # Kubernetes Store configuration (used when store.type=kubernetes)
  10.   kubernetes:
  11.     # Namespace where Control Plane is installed to.
  12.     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
  13.   # Postgres Store configuration (used when store.type=postgres)
  14.   postgres:
  15.     # Host of the Postgres DB
  16.     host: 127.0.0.1 # ENV: KUMA_STORE_POSTGRES_HOST
  17.     # Port of the Postgres DB
  18.     port: 15432 # ENV: KUMA_STORE_POSTGRES_PORT
  19.     # User of the Postgres DB
  20.     user: kuma # ENV: KUMA_STORE_POSTGRES_USER
  21.     # Password of the Postgres DB
  22.     password: kuma # ENV: KUMA_STORE_POSTGRES_PASSWORD
  23.     # Database name of the Postgres DB
  24.     dbName: kuma # ENV: KUMA_STORE_POSTGRES_DB_NAME
  25.     # Driver to use, one of: pgx, postgres
  26.     driverName: pgx # ENV: KUMA_STORE_POSTGRES_DRIVER_NAME
  27.     # Connection Timeout to the DB in seconds
  28.     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
  29.     # MaxConnectionIdleTime (applied only when driverName=pgx) is the duration after which an idle connection will be automatically closed by the health check.
  30.     maxConnectionIdleTime: "30m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_IDLE_TIME
  31.     # MaxConnectionLifetime (applied only when driverName=pgx) is the duration since creation after which a connection will be automatically closed
  32.     maxConnectionLifetime: "1h" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME
  33.     # MaxConnectionLifetimeJitter (applied only when driverName=pgx) is the duration after maxConnectionLifetime to randomly decide to close a connection.
  34.     # This helps prevent all connections from being closed at the exact same time, starving the pool.
  35.     maxConnectionLifetimeJitter: "1m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME_JITTER
  36.     # HealthCheckInterval (applied only when driverName=pgx) is the duration between checks of the health of idle connections.
  37.     healthCheckInterval: "30s" # ENV: KUMA_STORE_POSTGRES_HEALTH_CHECK_INTERVAL
  38.     # MinOpenConnections (applied only when driverName=pgx) is the minimum number of open connections to the database
  39.     minOpenConnections: 0 # ENV: KUMA_STORE_POSTGRES_MIN_OPEN_CONNECTIONS
  40.     # MaxOpenConnections is the maximum number of open connections to the database
  41.     # `0` value means number of open connections is unlimited
  42.     maxOpenConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS
  43.     # MaxIdleConnections is the maximum number of connections in the idle connection pool
  44.     # <0 value means no idle connections and 0 means default max idle connections.
  45.     maxIdleConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
  46.     # MaxListQueryElements defines maximum number of changed elements before requesting full list of elements from the store.
  47.     maxListQueryElements: 0 # ENV: KUMA_STORE_POSTGRES_MAX_LIST_QUERY_ELEMENTS
  48.     # TLS settings
  49.     tls:
  50.       # Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  51.       mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  52.       # Path to TLS Certificate of the client. Required when server has METHOD=cert
  53.       certPath: # ENV: KUMA_STORE_POSTGRES_TLS_CERT_PATH
  54.       # Path to TLS Key of the client. Required when server has METHOD=cert
  55.       keyPath: # ENV: KUMA_STORE_POSTGRES_TLS_KEY_PATH
  56.       # Path to the root certificate. Used in verifyCa and verifyFull modes.
  57.       caPath: # ENV: KUMA_STORE_POSTGRES_TLS_ROOT_CERT_PATH
  58.     # ReadReplica is a setting for a DB replica used only for read queries
  59.     readReplica:
  60.       # Host of the Postgres DB read replica. If not set, read replica is not used.
  61.       host: "" # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_HOST
  62.       # Port of the Postgres DB read replica
  63.       port: 5432 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_PORT
  64.       # Ratio in [0-100] range. How many SELECT queries (out of 100) will use read replica.
  65.       ratio: 100 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_RATIO
  66.   # Cache for read only operations. This cache is local to the instance of the control plane.
  67.   cache:
  68.     # If true then cache is enabled
  69.     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
  70.     # Expiration time for elements in cache.
  71.     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
  72.   # Upsert (get and update) configuration
  73.   upsert:
  74.     # Base time for exponential backoff on upsert operations when retry is enabled
  75.     conflictRetryBaseBackoff: 200ms # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_BASE_BACKOFF
  76.     # Max retries on upsert (get and update) operation when retry is enabled
  77.     conflictRetryMaxTimes: 10 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
  78.     # Percentage of jitter. For example: if backoff is 20s, and this value 10, the backoff will be between 18s and 22s.
  79.     conflictRetryJitterPercent: 30 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_JITTER_PERCENT
  80.   # If true, skips validation of resource delete.
  81.   # For example you don't have to delete all Dataplane objects before you delete a Mesh
  82.   unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
  83. # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
  84. bootstrapServer:
  85.   # Parameters of bootstrap configuration
  86.   params:
  87.     # Address of Envoy Admin
  88.     adminAddress: 127.0.0.1 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ADDRESS
  89.     # Port of Envoy Admin
  90.     adminPort: 9901 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT
  91.     # Path to access log file of Envoy Admin
  92.     adminAccessLogPath: /dev/null # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ACCESS_LOG_PATH
  93.     # Host of XDS Server. By default it is the same host as the one used by kuma-dp to connect to the control plane
  94.     xdsHost: "" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST
  95.     # Port of XDS Server. By default it is autoconfigured from KUMA_DP_SERVER_PORT
  96.     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
  97.     # Connection timeout to the XDS Server
  98.     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
  99. #  Monitoring Assignment Discovery Service (MADS) server configuration
  100. monitoringAssignmentServer:
  101.   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
  102.   port: 5676 # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_PORT
  103.   # Which MADS API versions to serve
  104.   apiVersions: ["v1"] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_API_VERSIONS
  105.   # Interval for re-generating monitoring assignments for clients connected to the Control Plane.
  106.   assignmentRefreshInterval: 1s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL
  107.   # The default timeout for a single fetch-based discovery request, if not specified
  108.   defaultFetchTimeout: 30s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_DEFAULT_FETCH_TIMEOUT
  109.   # Path to TLS certificate file
  110.   tlsCertFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CERT_FILE
  111.   # Path to TLS key file
  112.   tlsKeyFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_KEY_FILE
  113.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  114.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MIN_VERSION
  115.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  116.   tlsMaxVersion: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MAX_VERSION
  117.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  118.   tlsCipherSuites: [] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CIPHER_SUITES
  119. # Envoy XDS server configuration
  120. xdsServer:
  121.   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
  122.   dataplaneConfigurationRefreshInterval: 1s # ENV: KUMA_XDS_SERVER_DATAPLANE_CONFIGURATION_REFRESH_INTERVAL
  123.   # Interval for flushing status of Dataplanes connected to the Control Plane
  124.   dataplaneStatusFlushInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_STATUS_FLUSH_INTERVAL
  125.   # Backoff that is executed when Control Plane is sending the response that was previously rejected by Dataplane
  126.   nackBackoff: 5s # ENV: KUMA_XDS_SERVER_NACK_BACKOFF
  127.   # A delay between proxy terminating a connection and the CP trying to deregister the proxy.
  128.   # It is used only in universal mode when you use direct lifecycle.
  129.   # Setting this setting to 0s disables the delay.
  130.   # Disabling this may cause race conditions that one instance of CP removes proxy object
  131.   # while proxy is connected to another instance of the CP.
  132.   dataplaneDeregistrationDelay: 10s # ENV: KUMA_XDS_DATAPLANE_DEREGISTRATION_DELAY
  133. # API Server configuration
  134. apiServer:
  135.   # HTTP configuration of the API Server
  136.   http:
  137.     # If true then API Server will be served on HTTP
  138.     enabled: true # ENV: KUMA_API_SERVER_HTTP_ENABLED
  139.     # Network interface on which HTTP API Server will be exposed
  140.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTP_INTERFACE
  141.     # Port of the API Server
  142.     port: 5681 # ENV: KUMA_API_SERVER_HTTP_PORT
  143.   # HTTPS configuration of the API Server
  144.   https:
  145.     # If true then API Server will be served on HTTPS
  146.     enabled: true # ENV: KUMA_API_SERVER_HTTPS_ENABLED
  147.     # Network interface on which HTTPS API Server will be exposed
  148.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTPS_INTERFACE
  149.     # Port of the HTTPS API Server
  150.     port: 5682 # ENV: KUMA_API_SERVER_HTTPS_PORT
  151.     # Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
  152.     tlsCertFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
  153.     # Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
  154.     tlsKeyFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
  155.     # Path to the CA certificate which is used to sign client certificates. It is used only for verifying client certificates.
  156.     tlsCaFile: "" # ENV: KUMA_API_SERVER_HTTPS_CLIENT_CERTS_CA_FILE
  157.     # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  158.     tlsMinVersion: "TLSv1_2" # ENV: KUMA_API_SERVER_HTTPS_TLS_MIN_VERSION
  159.     # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  160.     tlsMaxVersion: # ENV: KUMA_API_SERVER_HTTPS_TLS_MAX_VERSION
  161.     # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  162.     tlsCipherSuites: [] # ENV: KUMA_API_SERVER_HTTPS_TLS_CIPHER_SUITES
  163.     # If true, then HTTPS connection will require client cert.
  164.     requireClientCert: false # ENV: KUMA_API_SERVER_HTTPS_REQUIRE_CLIENT_CERT
  165.   # Authentication configuration for administrative endpoints like Dataplane Token or managing Secrets
  166.   auth:
  167.     # Directory of authorized client certificates (only validate in HTTPS)
  168.     clientCertsDir: "" # ENV: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
  169.   # Api Server Authentication configuration
  170.   authn:
  171.     # Type of authentication mechanism (available values: "adminClientCerts", "tokens")
  172.     type: tokens # ENV: KUMA_API_SERVER_AUTHN_TYPE
  173.     # Localhost is authenticated as a user admin of group admin
  174.     localhostIsAdmin: true # ENV: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
  175.     # Configuration for tokens authentication
  176.     tokens:
  177.       # If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma secret
  178.       bootstrapAdminToken: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_BOOTSTRAP_ADMIN_TOKEN
  179.       # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  180.       enableIssuer: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_ENABLE_ISSUER
  181.       # Token validator configuration
  182.       validator:
  183.         # If true then Kuma secrets with prefix "user-token-signing-key" are considered as signing keys.
  184.         useSecrets: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_VALIDATOR_USE_SECRETS
  185.         # List of public keys used to validate the token. Example:
  186.         # - kid: 1
  187.         #   key: |
  188.         #     -----BEGIN RSA PUBLIC KEY-----
  189.         #     MIIBCgKCAQEAq....
  190.         #     -----END RSA PUBLIC KEY-----
  191.         # - kid: 2
  192.         #   keyFile: /keys/public.pem
  193.         publicKeys: []
  194.   # If true, then API Server will operate in read only mode (serving GET requests)
  195.   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
  196.   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
  197.   corsAllowedDomains:
  198.     - ".*" # ENV: KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
  199.   # Can be used if you use a reverse proxy
  200.   rootUrl: "" # ENV: KUMA_API_SERVER_ROOT_URL
  201.   # The path to serve the API from
  202.   basePath: "/" # ENV: KUMA_API_SERVER_BASE_PATH
  203.   # configuration specific to the GUI
  204.   gui:
  205.     # Whether to serve the gui (if mode=zone this has no effect)
  206.     enabled: true # ENV: KUMA_API_SERVER_GUI_ENABLED
  207.     # Can be used if you use a reverse proxy or want to serve the gui from a different path
  208.     rootUrl: "" # ENV: KUMA_API_SERVER_GUI_ROOT_URL
  209.     # The path to serve the GUI from
  210.     basePath: "/gui" # ENV: KUMA_API_SERVER_GUI_BASE_PATH
  211. # Environment-specific configuration
  212. runtime:
  213.   # Kubernetes-specific configuration
  214.   kubernetes:
  215.     # Service name of the Kuma Control Plane. It is used to point Kuma DP to proper URL.
  216.     controlPlaneServiceName: kuma-control-plane # ENV: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
  217.     # Name of Service Account that is used to run the Control Plane
  218.     serviceAccountName: "system:serviceaccount:kuma-system:kuma-control-plane" # ENV: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
  219.     # Taint controller that prevents applications from scheduling until CNI is ready.
  220.     nodeTaintController:
  221.       # If true enables the taint controller.
  222.       enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_ENABLED
  223.       # Value of app label on CNI pod that indicates if node can be ready.
  224.       cniApp: "" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_APP
  225.       # Value of CNI namespace.
  226.       cniNamespace: "kube-system" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_NAMESPACE
  227.     # Admission WebHook Server configuration
  228.     admissionServer:
  229.       # Address the Admission WebHook Server should be listening on
  230.       address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
  231.       # Port the Admission WebHook Server should be listening on
  232.       port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
  233.       # Directory with a TLS cert and private key for the Admission WebHook Server.
  234.       # TLS certificate file must be named `tls.crt`.
  235.       # TLS key file must be named `tls.key`.
  236.       certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
  237.     # Injector defines configuration of a Kuma Sidecar Injector.
  238.     injector:
  239.       # if true runs kuma-cp in CNI compatible mode
  240.       cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
  241.       # list of exceptions for Kuma injection
  242.       exceptions:
  243.         # a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
  244.         labels:
  245.           openshift.io/build.name: "*"
  246.           openshift.io/deployer-pod-for.name: "*"
  247.       # VirtualProbesEnabled enables automatic converting HttpGet probes to virtual. Virtual probe
  248.       #    serves on sub-path of insecure port 'virtualProbesPort',
  249.       #    i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
  250.       virtualProbesEnabled: true # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
  251.       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
  252.       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
  253.       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
  254.       caCertFile: # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
  255.       # SidecarContainer defines configuration of the Kuma sidecar container.
  256.       sidecarContainer:
  257.         # Image name.
  258.         image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
  259.         # Redirect port for inbound traffic.
  260.         redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
  261.         # Redirect port for inbound traffic.
  262.         # Deprecated: Use redirectPortInbound or ipFamilyMode instead.
  263.         redirectPortInboundV6: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND_V6
  264.         # IP family mode enabled for traffic redirection, can be 'dualstack' or 'ipv4'
  265.         ipFamilyMode: dualstack # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IP_FAMILY_MODE
  266.         # Redirect port for outbound traffic.
  267.         redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
  268.         # User ID.
  269.         uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
  270.         # Group ID.
  271.         gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
  272.         # Drain time for listeners.
  273.         drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
  274.         # Readiness probe.
  275.         readinessProbe:
  276.           # Number of seconds after the container has started before readiness probes are initiated.
  277.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
  278.           # Number of seconds after which the probe times out.
  279.           timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
  280.           # Number of seconds after which the probe times out.
  281.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
  282.           # Minimum consecutive successes for the probe to be considered successful after having failed.
  283.           successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
  284.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  285.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
  286.         # Liveness probe.
  287.         livenessProbe:
  288.           # Number of seconds after the container has started before liveness probes are initiated.
  289.           initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
  290.           # Number of seconds after which the probe times out.
  291.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
  292.           # How often (in seconds) to perform the probe.
  293.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
  294.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  295.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
  296.         # Startup probe (if sidecar containers feature is enabled).
  297.         startupProbe:
  298.           # Number of seconds after the container has started before startup probes are initiated.
  299.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_INITIAL_DELAY_SECONDS
  300.           # Number of seconds after which the probe times out.
  301.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_TIMEOUT_SECONDS
  302.           # How often (in seconds) to perform the probe.
  303.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_PERIOD_SECONDS
  304.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  305.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_FAILURE_THRESHOLD
  306.         # Compute resource requirements.
  307.         resources:
  308.           # Minimum amount of compute resources required.
  309.           requests:
  310.             # CPU, in cores. (500m = .5 cores)
  311.             cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
  312.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  313.             memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
  314.           # Maximum amount of compute resources allowed.
  315.           limits:
  316.             # CPU, in cores. (500m = .5 cores)
  317.             cpu: 1000m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
  318.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  319.             memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
  320.         # Additional environment variables that can be placed on Kuma DP sidecar
  321.         envVars: {} # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ENV_VARS
  322.         # If true, it enables a postStart script that waits until Envoy is ready.
  323.         # With the current Kubernetes behavior, any other container in the Pod will wait until the script is complete.
  324.         waitForDataplaneReady: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_WAIT_FOR_DATAPLANE_READY
  325.       # InitContainer defines configuration of the Kuma init container
  326.       initContainer:
  327.         # Image name.
  328.         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
  329.       # ContainerPatches is an optional list of ContainerPatch names which will be applied
  330.       # to init and sidecar containers if workload is not annotated with a patch list.
  331.       containerPatches: [] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
  332.       # Configuration for a traffic that is intercepted by sidecar
  333.       sidecarTraffic:
  334.         # List of inbound ports that will be excluded from interception.
  335.         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
  336.         excludeInboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
  337.         # List of outbound ports that will be excluded from interception.
  338.         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
  339.         excludeOutboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
  340.       builtinDNS:
  341.         # Use the built-in DNS
  342.         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
  343.         # Redirect port for DNS
  344.         port: 15053 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_PORT
  345.         # Enable coredns query logging if true
  346.         logging: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_LOGGING
  347.       # EBPF defines configuration for the ebpf, when transparent proxy is marked to be
  348.       # installed using ebpf instead of iptables
  349.       ebpf:
  350.         # Install transparent proxy using ebpf
  351.         enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_ENABLED
  352.         # Name of the environmental variable which will include IP address of the pod
  353.         instanceIPEnvVarName: INSTANCE_IP # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_INSTANCE_IP_ENV_VAR_NAME
  354.         # Path where BPF file system will be mounted for pinning ebpf programs and maps
  355.         bpffsPath: /sys/fs/bpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
  356.         # Path of mounted cgroup2
  357.         cgroupPath: /sys/fs/cgroup # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH
  358.         # Name of the network interface which should be used to attach to it TC programs
  359.         # when not specified, we will try to automatically determine it
  360.         tcAttachIface: "" # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_TC_ATTACH_IFACE
  361.         # Path where compiled eBPF programs are placed
  362.         programsSourcePath: /tmp/kuma-ebpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_PROGRAMS_SOURCE_PATH
  363.       # IgnoredServiceSelectorLabels defines a list ignored labels in Service selector.
  364.       # If Pod matches a Service with ignored labels, but does not match it fully, it gets Ignored inbound.
  365.       # It is useful when you change Service selector and expect traffic to be sent immediately.
  366.       # An example of this is ArgoCD's BlueGreen deployment and "rollouts-pod-template-hash" selector.
  367.       ignoredServiceSelectorLabels: [] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_IGNORED_SERVICE_SELECTOR_LABELS
  368.       # nodeLabelsToCopy defines a list of node labels that should be copied to the Pod.
  369.       nodeLabelsToCopy: ["topology.kubernetes.io/zone", "topology.kubernetes.io/region", "kubernetes.io/hostname"] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_NODE_LABELS_TO_COPY
  370.     marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
  371.     # Kubernetes's resources reconciliation concurrency configuration
  372.     controllersConcurrency:
  373.       # PodController defines maximum concurrent reconciliations of Pod resources
  374.       # Default value 10. If set to 0 kube controller-runtime default value of 1 will be used.
  375.       podController: 10 # ENV: KUMA_RUNTIME_KUBERNETES_CONTROLLERS_CONCURRENCY_POD_CONTROLLER
  376.     # Kubernetes client configuration
  377.     clientConfig:
  378.       # Qps defines maximum requests kubernetes client is allowed to make per second.
  379.       # Default value 100. If set to 0 kube-client default value of 5 will be used.
  380.       qps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_QPS
  381.       # BurstQps defines maximum burst requests kubernetes client is allowed to make per second
  382.       # Default value 100. If set to 0 kube-client default value of 10 will be used.
  383.       burstQps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_BURST_QPS
  384.     leaderElection:
  385.       # LeaseDuration is the duration that non-leader candidates will
  386.       # wait to force acquire leadership. This is measured against time of
  387.       # last observed ack. Default is 15 seconds.
  388.       leaseDuration: 15s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_LEASE_DURATION
  389.       # RenewDeadline is the duration that the acting controlplane will retry
  390.       # refreshing leadership before giving up. Default is 10 seconds.
  391.       renewDeadline: 10s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_RENEW_DEADLINE
  392.     # SkipMeshOwnerReference is a flag that allows to skip adding Mesh owner reference to resources.
  393.     # If this is set to true, deleting a Mesh will not delete resources that belong to that Mesh.
  394.     # This can be useful when resources are managed in Argo CD where creation/deletion is managed there.
  395.     skipMeshOwnerReference: false # ENV: KUMA_RUNTIME_KUBERNETES_SKIP_MESH_OWNER_REFERENCE
  396.     # If true, then control plane can support TLS secrets for builtin gateway outside of mesh system namespace.
  397.     # The downside is that control plane requires permission to read Secrets in all namespaces.
  398.     supportGatewaySecretsInAllNamespaces: false # ENV: KUMA_RUNTIME_KUBERNETES_SUPPORT_GATEWAY_SECRETS_IN_ALL_NAMESPACES
  399.   # Universal-specific configuration
  400.   universal:
  401.     # DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
  402.     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
  403.     # VIPRefreshInterval defines how often all meshes' VIPs should be recomputed
  404.     vipRefreshInterval: 500ms # ENV: KUMA_RUNTIME_UNIVERSAL_VIP_REFRESH_INTERVAL
  405. # Default Kuma entities configuration
  406. defaults:
  407.   # If true, it skips creating the default Mesh
  408.   skipMeshCreation: false # ENV: KUMA_DEFAULTS_SKIP_MESH_CREATION
  409.   # If true, it skips creating the default tenant resources
  410.   skipTenantResources: false # ENV: KUMA_DEFAULTS_SKIP_TENANT_RESOURCES
  411.   # If true, it creates the default routing (TrafficPermission and TrafficRoute) resources for a new Mesh
  412.   createMeshRoutingResources: false # ENV: KUMA_DEFAULTS_CREATE_MESH_ROUTING_RESOURCES
  413. # Metrics configuration
  414. metrics:
  415.   dataplane:
  416.     # How many latest subscriptions will be stored in DataplaneInsight object, if equals 0 then unlimited
  417.     subscriptionLimit: 2 # ENV: KUMA_METRICS_DATAPLANE_SUBSCRIPTION_LIMIT
  418.     # How long data plane proxy can stay Online without active xDS connection
  419.     idleTimeout: 5m # ENV: KUMA_METRICS_DATAPLANE_IDLE_TIMEOUT
  420.   zone:
  421.     # How many latest subscriptions will be stored in ZoneInsights object, if equals 0 then unlimited
  422.     subscriptionLimit: 10 # ENV: KUMA_METRICS_ZONE_SUBSCRIPTION_LIMIT
  423.     # How long zone can stay Online without active KDS connection
  424.     idleTimeout: 5m # ENV: KUMA_METRICS_ZONE_IDLE_TIMEOUT
  425.     # Compact finished metrics (do not store config and details of KDS exchange).
  426.     compactFinishedSubscriptions: false # ENV: KUMA_METRICS_ZONE_COMPACT_FINISHED_SUBSCRIPTIONS
  427.   mesh:
  428.     # Minimum time between 2 refresh of insights
  429.     minResyncInterval: 1s # ENV: KUMA_METRICS_MESH_MIN_RESYNC_INTERVAL
  430.     # time between triggering a full refresh of all the insights
  431.     fullResyncInterval: 20s # ENV: KUMA_METRICS_MESH_FULL_RESYNC_INTERVAL
  432.     # the size of the buffer between event creation and processing
  433.     bufferSize: 1000 # ENV: KUMA_METRICS_MESH_BUFFER_SIZE
  434.     # the number of workers that process metrics events
  435.     eventProcessors: 1 # ENV: KUMA_METRICS_MESH_EVENT_PROCESSORS
  436.   controlPlane:
  437.     # If true metrics show number of resources in the system should be reported
  438.     reportResourcesCount: true # ENV: KUMA_METRICS_CONTROL_PLANE_REPORT_RESOURCES_COUNT
  439. # Reports configuration
  440. reports:
  441.   # If true then usage stats will be reported
  442.   enabled: false # ENV: KUMA_REPORTS_ENABLED
  443. # General configuration
  444. general:
  445.   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
  446.   dnsCacheTTL: 10s # ENV: KUMA_GENERAL_DNS_CACHE_TTL
  447.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert that will be used across all the Kuma Servers.
  448.   tlsCertFile: # ENV: KUMA_GENERAL_TLS_CERT_FILE
  449.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key that will be used across all the Kuma Servers.
  450.   tlsKeyFile: # ENV: KUMA_GENERAL_TLS_KEY_FILE
  451.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  452.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_GENERAL_TLS_MIN_VERSION
  453.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  454.   tlsMaxVersion: # ENV: KUMA_GENERAL_TLS_MAX_VERSION
  455.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  456.   tlsCipherSuites: [] # ENV: KUMA_GENERAL_TLS_CIPHER_SUITES
  457.   # WorkDir defines a path to the working directory
  458.   # Kuma stores in this directory autogenerated entities like certificates.
  459.   # If empty then the working directory is $HOME/.kuma
  460.   workDir: "" # ENV: KUMA_GENERAL_WORK_DIR
  461.   # ResilientComponentBaseBackoff configures base backoff for restarting resilient components:
  462.   # KDS sync, Insight resync, PostgresEventListener, etc.
  463.   resilientComponentBaseBackoff: 5s # ENV: KUMA_GENERAL_RESILIENT_COMPONENT_BASE_BACKOFF
  464.   # ResilientComponentMaxBackoff configures max backoff for restarting resilient component:
  465.   # KDS sync, Insight resync, PostgresEventListener, etc.
  466.   resilientComponentMaxBackoff: 1m # ENV: KUMA_GENERAL_RESILIENT_COMPONENT_MAX_BACKOFF
  467. # DNS Server configuration
  468. dnsServer:
  469.   # The domain that the server will resolve the services for
  470.   domain: "mesh" # ENV: KUMA_DNS_SERVER_DOMAIN
  471.   # The CIDR range used to allocate
  472.   CIDR: "240.0.0.0/4" # ENV: KUMA_DNS_SERVER_CIDR
  473.   # Will create a service "<kuma.io/service>.mesh" dns entry for every service.
  474.   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
  475.   # The port to use along with the `<kuma.io/service>.mesh` dns entry
  476.   serviceVipPort: 80 # ENV: KUMA_DNS_SERVICE_SERVICE_VIP_PORT
  477. # Multizone mode
  478. multizone:
  479.   global:
  480.     kds:
  481.       # Port of a gRPC server that serves Kuma Discovery Service (KDS).
  482.       grpcPort: 5685 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_GRPC_PORT
  483.       # Interval for refreshing state of the world
  484.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_REFRESH_INTERVAL
  485.       # Interval for flushing Zone Insights (stats of multi-zone communication)
  486.       zoneInsightFlushInterval: 10s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_ZONE_INSIGHT_FLUSH_INTERVAL
  487.       # TlsEnabled turns on TLS for KDS
  488.       tlsEnabled: true # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_ENABLED
  489.       # TlsCertFile defines a path to a file with PEM-encoded TLS cert.
  490.       tlsCertFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
  491.       # TlsKeyFile defines a path to a file with PEM-encoded TLS key.
  492.       tlsKeyFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
  493.       # TlsMinVersion the minimum version of TLS
  494.       tlsMinVersion: "TLSv1_2" # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MIN_VERSION
  495.       # TlsMaxVersion the maximum version of TLS
  496.       tlsMaxVersion: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MAX_VERSION
  497.       # TlsCipherSuites the list of cipher suites
  498.       tlsCipherSuites: [] # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CIPHER_SUITES
  499.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  500.       # In practice this means a limit on full list of one resource type.
  501.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MAX_MSG_SIZE
  502.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  503.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  504.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MSG_SEND_TIMEOUT
  505.       # Backoff that is executed when the global control plane is sending the response that was previously rejected by zone control plane
  506.       nackBackoff: 5s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_NACK_BACKOFF
  507.       # DisableSOTW if true doesn't expose SOTW version of KDS. Default: false
  508.       disableSOTW: false # ENV: KUMA_MULTIZONE_GLOBAL_KDS_DISABLE_SOTW
  509.       # Response backoff is a time Global CP waits before sending ACK/NACK.
  510.       # This is a way to slow down Zone CP from sending resources too often.
  511.       responseBackoff: 0s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_RESPONSE_BACKOFF
  512.   zone:
  513.     # Kuma Zone name used to mark the zone dataplane resources
  514.     name: "default" # ENV: KUMA_MULTIZONE_ZONE_NAME
  515.     # GlobalAddress URL of Global Kuma CP
  516.     globalAddress: # ENV KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
  517.     kds:
  518.       # Interval for refreshing state of the world
  519.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_KDS_REFRESH_INTERVAL
  520.       # RootCAFile defines a path to a file with PEM-encoded Root CA. Client will verify server by using it.
  521.       rootCaFile: # ENV: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
  522.       # If true, TLS connection to the server won't be verified.
  523.       tlsSkipVerify: false # ENV: KUMA_MULTIZONE_ZONE_KDS_TLS_SKIP_VERIFY
  524.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  525.       # In practice this means a limit on full list of one resource type.
  526.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_ZONE_KDS_MAX_MSG_SIZE
  527.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  528.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  529.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_ZONE_KDS_MSG_SEND_TIMEOUT
  530.       # Backoff that is executed when the zone control plane is sending the response that was previously rejected by global control plane
  531.       nackBackoff: 5s # ENV: KUMA_MULTIZONE_ZONE_KDS_NACK_BACKOFF
  532.       # Response backoff is a time Zone CP waits before sending ACK/NACK.
  533.       # This is a way to slow down Global CP from sending resources too often.
  534.       responseBackoff: 0s # ENV: KUMA_MULTIZONE_ZONE_KDS_RESPONSE_BACKOFF
  535.     # disableOriginLabelValidation disables validation of the origin label when applying resources on Zone CP
  536.     disableOriginLabelValidation: false # ENV: KUMA_MULTIZONE_ZONE_DISABLE_ORIGIN_LABEL_VALIDATION
  537.     # IngressUpdateInterval is the interval between the CP updating the list of
  538.     # available services on ZoneIngress.
  539.     ingressUpdateInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_INGRESS_UPDATE_INTERVAL
  540. # Diagnostics configuration
  541. diagnostics:
  542.   # Port of Diagnostic Server for checking health and readiness of the Control Plane
  543.   serverPort: 5680 # ENV: KUMA_DIAGNOSTICS_SERVER_PORT
  544.   # If true, enables https://golang.org/pkg/net/http/pprof/ debug endpoints
  545.   debugEndpoints: false # ENV: KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS
  546.   # Whether tls is enabled or not
  547.   tlsEnabled: false # ENV: KUMA_DIAGNOSTICS_TLS_ENABLED
  548.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  549.   tlsCertFile: # ENV: KUMA_DIAGNOSTICS_TLS_CERT_FILE
  550.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  551.   tlsKeyFile: # ENV: KUMA_DIAGNOSTICS_TLS_KEY_FILE
  552.   # TlsMinVersion the minimum version of TLS
  553.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_DIAGNOSTICS_TLS_MIN_VERSION
  554.   # TlsMaxVersion the maximum version of TLS
  555.   tlsMaxVersion: # ENV: KUMA_DIAGNOSTICS_TLS_MAX_VERSION
  556.   # TlsCipherSuites the list of cipher suites
  557.   tlsCipherSuites: [] # ENV: KUMA_DIAGNOSTICS_TLS_CIPHER_SUITES
  558. # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
  559. dpServer:
  560.   # Port of the DP Server
  561.   port: 5678 # ENV: KUMA_DP_SERVER_PORT
  562.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  563.   tlsCertFile: # ENV: KUMA_DP_SERVER_TLS_CERT_FILE
  564.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  565.   tlsKeyFile: # ENV: KUMA_DP_SERVER_TLS_KEY_FILE
  566.   # TlsMinVersion the minimum version of TLS
  567.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_DP_SERVER_TLS_MIN_VERSION
  568.   # TlsMaxVersion the maximum version of TLS
  569.   tlsMaxVersion: # ENV: KUMA_DP_SERVER_TLS_MAX_VERSION
  570.   # TlsCipherSuites the list of cipher suites
  571.   tlsCipherSuites: [] # ENV: KUMA_DP_SERVER_TLS_CIPHER_SUITES
  572.   # ReadHeaderTimeout defines the amount of time DP server will be allowed
  573.   # to read request headers. The connection's read deadline is reset
  574.   # after reading the headers and the Handler can decide what is considered
  575.   # too slow for the body. If ReadHeaderTimeout is zero there is no timeout.
  576.   # The timeout is configurable as in rare cases, when Kuma CP was restarting,
  577.   # 1s which is explicitly set in other servers was insufficient and DPs
  578.   # were failing to reconnect (we observed this in Projected Service Account
  579.   # Tokens e2e tests, which started flaking a lot after introducing explicit
  580.   # 1s timeout)
  581.   readHeaderTimeout: 5s # ENV: KUMA_DP_SERVER_READ_HEADER_TIMEOUT
  582.   # Authn defines an authentication configuration for the DP Server
  583.   authn:
  584.     # Configuration for data plane proxy authentication.
  585.     dpProxy:
  586.       # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  587.       # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  588.       type: ""
  589.       # Configuration of dpToken authentication method
  590.       dpToken:
  591.         # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  592.         enableIssuer: true
  593.         # DP Token validator configuration.
  594.         validator:
  595.           # If true then Kuma secrets with prefix "dataplane-token-signing-key-{mesh}" are considered as signing keys.
  596.           useSecrets: true
  597.           # List of public keys used to validate the token. Example:
  598.           # - kid: 1
  599.           #   mesh: default
  600.           #   key: |
  601.           #     -----BEGIN RSA PUBLIC KEY-----
  602.           #     MIIBCgKCAQEAq....
  603.           #     -----END RSA PUBLIC KEY-----
  604.           # - kid: 2
  605.           #   mesh: demo
  606.           #   keyFile: /keys/public.pem
  607.           publicKeys: []
  608.     # Configuration for zone proxy authentication.
  609.     zoneProxy:
  610.       # Type of authentication. Available values: "serviceAccountToken", "zoneToken", "none".
  611.       # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "zoneToken" on Universal.
  612.       type: ""
  613.       # Configuration for zoneToken authentication method.
  614.       zoneToken:
  615.         # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  616.         enableIssuer: true
  617.         # Zone Token validator configuration.
  618.         validator:
  619.           # If true then Kuma secrets with prefix "zone-token-signing-key" are considered as signing keys.
  620.           useSecrets: true
  621.           # List of public keys used to validate the token. Example:
  622.           # - kid: 1
  623.           #   key: |
  624.           #     -----BEGIN RSA PUBLIC KEY-----
  625.           #     MIIBCgKCAQEAq....
  626.           #     -----END RSA PUBLIC KEY-----
  627.           # - kid: 2
  628.           #   keyFile: /keys/public.pem
  629.           publicKeys: []
  630.     # If true then Envoy uses Google gRPC instead of Envoy gRPC which lets a proxy reload the auth data (service account token, dp token etc.) stored in the file without proxy restart.
  631.     enableReloadableTokens: false # ENV: KUMA_DP_SERVER_AUTHN_ENABLE_RELOADABLE_TOKENS
  632.   # Hds defines a Health Discovery Service configuration
  633.   hds:
  634.     # Enabled if true then Envoy will actively check application's ports, but only on Universal.
  635.     # On Kubernetes this feature disabled for now regardless the flag value
  636.     enabled: true # ENV: KUMA_DP_SERVER_HDS_ENABLED
  637.     # Interval for Envoy to send statuses for HealthChecks
  638.     interval: 5s # ENV: KUMA_DP_SERVER_HDS_INTERVAL
  639.     # RefreshInterval is an interval for re-genarting configuration for Dataplanes connected to the Control Plane
  640.     refreshInterval: 10s # ENV: KUMA_DP_SERVER_HDS_REFRESH_INTERVAL
  641.     # Check defines a HealthCheck configuration
  642.     checkDefaults:
  643.       # Timeout is a time to wait for a health check response. If the timeout is reached the
  644.       # health check attempt will be considered a failure
  645.       timeout: 2s # ENV: KUMA_DP_SERVER_HDS_CHECK_TIMEOUT
  646.       # Interval between health checks
  647.       interval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_INTERVAL
  648.       # NoTrafficInterval is a special health check interval that is used when a cluster has
  649.       #    never had traffic routed to it
  650.       noTrafficInterval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_NO_TRAFFIC_INTERVAL
  651.       # HealthyThreshold is a number of healthy health checks required before a host is marked healthy
  652.       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
  653.       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
  654.       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
  655. # Intercommunication CP configuration
  656. interCp:
  657.   # Catalog configuration. Catalog keeps a record of all live CP instances in the zone.
  658.   catalog:
  659.     # Indicates an address on which other control planes can communicate with this CP.
  660.     # If empty then it's autoconfigured by taking the first IP of the nonloopback network interface.
  661.     instanceAddress: "" # ENV: KUMA_INTER_CP_CATALOG_INSTANCE_ADDRESS
  662.     # Interval on which CP will send heartbeat to a leader.
  663.     heartbeatInterval: 5s # ENV: KUMA_INTER_CP_CATALOG_HEARTBEAT_INTERVAL
  664.     # Interval on which CP will write all instances to a catalog.
  665.     writerInterval: 15s # ENV: KUMA_INTER_CP_CATALOG_WRITER_INTERVAL
  666.   # Intercommunication CP server configuration
  667.   server:
  668.     # Port of the inter-cp server
  669.     port: 5683 # ENV: KUMA_INTER_CP_SERVER_PORT
  670.     # TlsMinVersion the minimum version of TLS
  671.     tlsMinVersion: "TLSv1_2" # ENV: KUMA_INTER_CP_SERVER_TLS_MIN_VERSION
  672.     # TlsMaxVersion the maximum version of TLS
  673.     tlsMaxVersion: # ENV: KUMA_INTER_CP_SERVER_TLS_MAX_VERSION
  674.     # TlsCipherSuites the list of cipher suites
  675.     tlsCipherSuites: [] # ENV: KUMA_INTER_CP_SERVER_TLS_CIPHER_SUITES
  676. # Access Control configuration
  677. access:
  678.   # Type of access strategy (available values: "static")
  679.   type: static
  680.   # Configuration of static access strategy
  681.   static:
  682.     # AdminResources defines an access to admin resources (Secret/GlobalSecret)
  683.     adminResources:
  684.       # List of users that are allowed to access admin resources
  685.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_USERS
  686.       # List of groups that are allowed to access admin resources
  687.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_GROUPS
  688.     # GenerateDPToken defines an access to generating dataplane token
  689.     generateDpToken:
  690.       # List of users that are allowed to generate dataplane token
  691.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_USERS
  692.       # List of groups that are allowed to generate dataplane token
  693.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_GROUPS
  694.     # GenerateUserToken defines an access to generating user token
  695.     generateUserToken:
  696.       # List of users that are allowed to generate user token
  697.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_USERS
  698.       # List of groups that are allowed to generate user token
  699.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_GROUPS
  700.     # GenerateZoneToken defines an access to generating zone token
  701.     generateZoneToken:
  702.       # List of users that are allowed to generate zone token
  703.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_USERS
  704.       # List of groups that are allowed to generate zone token
  705.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
  706.     viewConfigDump:
  707.       # List of users that are allowed to get envoy config dump
  708.       users: [] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
  709.       # List of groups that are allowed to get envoy config dump
  710.       groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
  711.     viewStats:
  712.       # List of users that are allowed to get envoy stats
  713.       users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
  714.       # List of groups that are allowed to get envoy stats
  715.       groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
  716.     viewClusters:
  717.       # List of users that are allowed to get envoy clusters
  718.       users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
  719.       # List of groups that are allowed to get envoy clusters
  720.       groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
  721.     controlPlaneMetadata:
  722.       # List of users that are allowed to get control plane metadata
  723.       users: [] # ENV: KUMA_ACCESS_STATIC_CONTROL_PLANE_METADATA_USERS
  724.       # List of groups that are allowed to get control plane metadata
  725.       groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_CONTROL_PLANE_METADATA_GROUPS
  726. # Configuration of experimental features of Kuma
  727. experimental:
  728.   # If true, instead of embedding kubernetes outbounds into Dataplane object, they are persisted next to VIPs in ConfigMap
  729.   # This can improve performance, but it should be enabled only after all instances are migrated to version that supports this config
  730.   kubeOutboundsAsVIPs: true # ENV: KUMA_EXPERIMENTAL_KUBE_OUTBOUNDS_AS_VIPS
  731.   # Tag first virtual outbound model is compressed version of default Virtual Outbound model
  732.   # It is recommended to use tag first model for deployments with more than 2k services
  733.   # You can enable this flag on existing deployment. In order to downgrade cp with this flag enabled
  734.   # you need to first disable this flag and redeploy cp, after config is rewritten to default
  735.   # format you can downgrade your cp
  736.   useTagFirstVirtualOutboundModel: false # ENV: KUMA_EXPERIMENTAL_USE_TAG_FIRST_VIRTUAL_OUTBOUND_MODEL
  737.   # If true, KDS will sync using incremental xDS updates
  738.   kdsDeltaEnabled: true # ENV: KUMA_EXPERIMENTAL_KDS_DELTA_ENABLED
  739.   # List of prefixes that will be used to filter out tags by keys from ingress' available services section.
  740.   # This can trim the size of the ZoneIngress object significantly.
  741.   # The drawback is that you cannot use filtered out tags for traffic routing.
  742.   # If empty, no filter is applied.
  743.   ingressTagFilters: [] # ENV: KUMA_EXPERIMENTAL_INGRESS_TAG_FILTERS
  744.   # KDS event based watchdog settings. It is a more optimal way to generate KDS snapshot config.
  745.   kdsEventBasedWatchdog:
  746.     # If true, then experimental event based watchdog to generate KDS snapshot is used.
  747.     enabled: false # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_ENABLED
  748.     # How often we flush changes when experimental event based watchdog is used.
  749.     flushInterval: 5s # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_FLUSH_INTERVAL
  750.     # How often we schedule full KDS resync when experimental event based watchdog is used.
  751.     fullResyncInterval: 60s # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_FULL_RESYNC_INTERVAL
  752.     # If true, then initial full resync is going to be delayed by 0 to FullResyncInterval.
  753.     delayFullResync: false # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_DELAY_FULL_RESYNC
  754.   # If true then control plane computes reachable services automatically based on MeshTrafficPermission.
  755.   # Lack of MeshTrafficPermission is treated as Deny the traffic.
  756.   autoReachableServices: false # ENV: KUMA_EXPERIMENTAL_AUTO_REACHABLE_SERVICES
  757.   # Enables sidecar containers in Kubernetes if supported by the Kubernetes
  758.   # environment.
  759.   sidecarContainers: false # ENV: KUMA_EXPERIMENTAL_SIDECAR_CONTAINERS
  760.   # If true then it generates MeshServices from Kubernetes Service.
  761.   generateMeshServices: false # ENV: KUMA_EXPERIMENTAL_GENERATE_MESH_SERVICES
  762.   # If true skips persisted VIPs. Change to true only if generateMeshServices is enabled.
  763.   # Do not enable on production.
  764.   skipPersistedVIPs: false # ENV: KUMA_EXPERIMENTAL_SKIP_PERSISTED_VIPS
  765. proxy:
  766.   gateway:
  767.     # Sets the envoy runtime value to limit maximum number of incoming
  768.     # connections to a builtin gateway data plane proxy
  769.     globalDownstreamMaxConnections: 50000 # ENV: KUMA_PROXY_GATEWAY_GLOBAL_DOWNSTREAM_MAX_CONNECTIONS
  770. tracing:
  771.   openTelemetry:
  772.     endpoint: "" # e.g. otel-collector:4317
  773. # Configuration of the event bus which is local to one instance of CP
  774. eventBus:
  775.   # BufferSize controls the buffer for every single event listener.
  776.   # If we go over buffer, additional delay may happen to various operation like insight recomputation or KDS.
  777.   bufferSize: 100 # ENV: KUMA_EVENT_BUS_BUFFER_SIZE
  778. policies:
  779.   # PluginPoliciesEnabled controls which policy plugins are enabled
  780.   pluginPoliciesEnabled: # ENV: KUMA_PLUGIN_POLICIES_ENABLED
  781.     - meshaccesslogs
  782.     - meshcircuitbreakers
  783.     - meshfaultinjections
  784.     - meshhealthchecks
  785.     - meshhttproutes
  786.     - meshloadbalancingstrategies
  787.     - meshmetrics
  788.     - meshpassthroughs
  789.     - meshproxypatches
  790.     - meshratelimits
  791.     - meshretries
  792.     - meshtcproutes
  793.     - meshtimeouts
  794.     - meshtraces
  795.     - meshtrafficpermissions
  796. coreResources:
  797.   enabled: # ENV: KUMA_CORE_RESOURCES_ENABLED
  798.     - hostnamegenerators
  799.     - meshexternalservices
  800.     - meshservices
  801. # IP address management configuration
  802. ipam:
  803.   # MeshService address management
  804.   meshService:
  805.     # CIDR for MeshService IPs
  806.     cidr: 241.0.0.0/8 # ENV: KUMA_IPAM_MESH_SERVICE_CIDR
  807.   meshExternalService:
  808.     # CIDR for MeshExternalService IPs
  809.     cidr: 242.0.0.0/8 # ENV: KUMA_IPAM_MESH_EXTERNAL_SERVICE_CIDR
  810.   # Interval on which Kuma will allocate new IPs for MeshServices and MeshExternalServices
  811.   allocationInterval: 5s # ENV: KUMA_IPAM_ALLOCATION_INTERVAL

Helm values.yaml

  1. global:
  2.   image:
  3.     # -- Default registry for all Kuma Images
  4.     registry: "docker.io/kumahq"
  5.     # -- The default tag for all Kuma images, which itself defaults to .Chart.AppVersion
  6.     tag:
  7.   # -- Add `imagePullSecrets` to all the service accounts used for Kuma components
  8.   imagePullSecrets: []
  10. # -- Whether to patch the target namespace with the system label
  11. patchSystemNamespace: true
  13. installCrdsOnUpgrade:
  14.   # -- Whether install new CRDs before upgrade (if any were introduced with the new version of Kuma)
  15.   enabled: true
  16.   # -- The `imagePullSecrets` to attach to the Service Account running CRD installation.
  17.   # This field will be deprecated in a future release, please use .global.imagePullSecrets
  18.   imagePullSecrets: []
  20. # -- Whether to disable all helm hooks
  21. noHelmHooks: false
  23. # -- Whether to restart control-plane by calculating a new checksum for the secret
  24. restartOnSecretChange: true
  26. controlPlane:
  27.   # -- Environment that control plane is run in, useful when running universal global control plane on k8s
  28.   environment: "kubernetes"
  30.   # -- Labels to add to resources in addition to default labels
  31.   extraLabels: {}
  33.   # -- Kuma CP log level: one of off,info,debug
  34.   logLevel: "info"
  36.   # -- Kuma CP log output path: Defaults to /dev/stdout
  37.   logOutputPath: ""
  39.   # -- Kuma CP modes: one of zone,global
  40.   mode: "zone"
  42.   # -- (string) Kuma CP zone, if running multizone
  43.   zone:
  45.   # -- Only used in `zone` mode
  46.   kdsGlobalAddress: ""
  48.   # -- Number of replicas of the Kuma CP. Ignored when autoscaling is enabled
  49.   replicas: 1
  51.   # -- Minimum number of seconds for which a newly created pod should be ready for it to be considered available.
  52.   minReadySeconds: 0
  54.   # -- Annotations applied only to the `Deployment` resource
  55.   deploymentAnnotations: {}
  57.   # -- Annotations applied only to the `Pod` resource
  58.   podAnnotations: {}
  60.   # Horizontal Pod Autoscaling configuration
  61.   autoscaling:
  62.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  63.     enabled: false
  65.     # -- The minimum CP pods to allow
  66.     minReplicas: 2
  67.     # -- The max CP pods to scale to
  68.     maxReplicas: 5
  70.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  71.     targetCPUUtilizationPercentage: 80
  72.     # -- For clusters that do support autoscaling/v2, use metrics
  73.     metrics:
  74.       - type: Resource
  75.         resource:
  76.           name: cpu
  77.           target:
  78.             type: Utilization
  79.             averageUtilization: 80
  81.   # -- Node selector for the Kuma Control Plane pods
  82.   nodeSelector:
  83.     kubernetes.io/os: linux
  85.   # -- Tolerations for the Kuma Control Plane pods
  86.   tolerations: []
  88.   podDisruptionBudget:
  89.     # -- Whether to create a pod disruption budget
  90.     enabled: false
  91.     # -- The maximum number of unavailable pods allowed by the budget
  92.     maxUnavailable: 1
  94.   # -- Affinity placement rule for the Kuma Control Plane pods.
  95.   # This is rendered as a template, so you can reference other helm variables or includes.
  96.   affinity:
  97.     podAntiAffinity:
  98.       preferredDuringSchedulingIgnoredDuringExecution:
  99.       - weight: 100
  100.         podAffinityTerm:
  101.           labelSelector:
  102.             # These match the selector labels used on the deployment.
  103.             matchExpressions:
  104.               - key: app.kubernetes.io/name
  105.                 operator: In
  106.                 values:
  107.                   - '{{ include "kuma.name" . }}'
  108.               - key: app.kubernetes.io/instance
  109.                 operator: In
  110.                 values:
  111.                   - '{{ .Release.Name }}'
  112.               - key: app
  113.                 operator: In
  114.                 values:
  115.                   - '{{ include "kuma.name" . }}-control-plane'
  116.           topologyKey: kubernetes.io/hostname
  118.   # -- Topology spread constraints rule for the Kuma Control Plane pods.
  119.   # This is rendered as a template, so you can use variables to generate match labels.
  120.   topologySpreadConstraints:
  122.   # -- Failure policy of the mutating webhook implemented by the Kuma Injector component
  123.   injectorFailurePolicy: Fail
  125.   service:
  126.     apiServer:
  127.       http:
  128.         # -- Port on which Http api server Service is exposed on Node for service of type NodePort
  129.         nodePort: 30681
  130.       https:
  131.         # -- Port on which Https api server Service is exposed on Node for service of type NodePort
  132.         nodePort: 30682
  134.     # -- Whether to create a service resource.
  135.     enabled: true
  137.     # -- (string) Optionally override of the Kuma Control Plane Service's name
  138.     name:
  140.     # -- Service type of the Kuma Control Plane
  141.     type: ClusterIP
  143.     # -- Annotations to put on the Kuma Control Plane
  144.     annotations:
  145.       prometheus.io/scrape: "true"
  146.       prometheus.io/port: "5680"
  148.   # Kuma API and GUI ingress settings. Useful if you want to expose the
  149.   # API and GUI of Kuma outside the k8s cluster.
  150.   ingress:
  151.     # -- Install K8s Ingress resource that exposes GUI and API
  152.     enabled: false
  153.     # -- IngressClass defines which controller will implement the resource
  154.     ingressClassName:
  155.     # -- Ingress hostname
  156.     hostname:
  157.     # -- Map of ingress annotations.
  158.     annotations: {}
  159.     # -- Ingress path.
  160.     path: /
  161.     # -- Each path in an Ingress is required to have a corresponding path type. (ImplementationSpecific/Exact/Prefix)
  162.     pathType: ImplementationSpecific
  163.     # -- Port from kuma-cp to use to expose API and GUI. Switch to 5682 to expose TLS port
  164.     servicePort: 5681
  166.   globalZoneSyncService:
  167.     # -- Whether to create a k8s service for the global zone sync
  168.     # service. It will only be created when enabled and deploying the global
  169.     # control plane.
  170.     enabled: true
  171.     # -- Service type of the Global-zone sync
  172.     type: LoadBalancer
  173.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  174.     loadBalancerIP:
  175.     # -- Optionally specify allowed source ranges that can access the load balancer
  176.     loadBalancerSourceRanges: []
  177.     # -- Additional annotations to put on the Global Zone Sync Service
  178.     annotations: { }
  179.     # -- Port on which Global Zone Sync Service is exposed on Node for service of type NodePort
  180.     nodePort: 30685
  181.     # -- Port on which Global Zone Sync Service is exposed
  182.     port: 5685
  183.     # -- Protocol of the Global Zone Sync service port
  184.     protocol: grpc
  186.   defaults:
  187.     # -- Whether to skip creating the default Mesh
  188.     skipMeshCreation: false
  190.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  191.   automountServiceAccountToken: true
  193.   # -- Optionally override the resource spec
  194.   resources:
  195.     requests:
  196.        cpu: 500m
  197.        memory: 256Mi
  198.     limits:
  199.        memory: 256Mi
  201.   # -- Pod lifecycle settings (useful for adding a preStop hook, when
  202.   # using AWS ALB or NLB)
  203.   lifecycle: {}
  205.   # -- Number of seconds to wait before force killing the pod. Make sure to
  206.   # update this if you add a preStop hook.
  207.   terminationGracePeriodSeconds: 30
  209.   # TLS for various servers
  210.   tls:
  211.     general:
  212.       # -- Secret that contains tls.crt, tls.key [and ca.crt when no
  213.       # controlPlane.tls.general.caSecretName specified] for protecting
  214.       # Kuma in-cluster communication
  215.       secretName: ""
  216.       # -- Secret that contains ca.crt that was used to sign cert for protecting
  217.       # Kuma in-cluster communication (ca.crt present in this secret
  218.       # have precedence over the one provided in the controlPlane.tls.general.secretName)
  219.       caSecretName: ""
  220.       # -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
  221.       caBundle: ""
  222.     apiServer:
  223.       # -- Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS
  224.       secretName: ""
  225.       # -- Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS
  226.       clientCertsSecretName: ""
  227.     # - if not creating the global control plane, then do nothing
  228.     # - if secretName is empty and create is false, then do nothing
  229.     # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
  230.     # - if secretName is empty and create is true, then create a secret with a default name and use it
  231.     # - if secretName is non-empty and create is true, then create the secret using the provided name
  232.     kdsGlobalServer:
  233.       # -- Name of the K8s TLS Secret resource. If you set this and don't set
  234.       # create=true, you have to create the secret manually.
  235.       secretName: ""
  236.       # -- Whether to create the TLS secret in helm.
  237.       create: false
  238.       # -- The TLS certificate to offer.
  239.       cert: ""
  240.       # -- The TLS key to use.
  241.       key: ""
  242.     # - if not creating the zonal control plane, then do nothing
  243.     # - if secretName is empty and create is false, then do nothing
  244.     # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
  245.     # - if secretName is empty and create is true, then create a secret with a default name and use it
  246.     # - if secretName is non-empty and create is true, then create the secret using the provided name
  247.     kdsZoneClient:
  248.       # -- Name of the K8s Secret resource that contains ca.crt which was
  249.       # used to sign the certificate of KDS Global Server. If you set this
  250.       # and don't set create=true, you have to create the secret manually.
  251.       secretName: ""
  252.       # -- Whether to create the TLS secret in helm.
  253.       create: false
  254.       # -- CA bundle that was used to sign the certificate of KDS Global Server.
  255.       cert: ""
  256.       # -- If true, TLS cert of the server is not verified.
  257.       skipVerify: false
  259.   # -- Annotations to add for Control Plane's Service Account
  260.   serviceAccountAnnotations: { }
  262.   image:
  263.     # -- Kuma CP ImagePullPolicy
  264.     pullPolicy: IfNotPresent
  265.     # -- Kuma CP image repository
  266.     repository: "kuma-cp"
  267.     # -- Kuma CP Image tag. When not specified, the value is copied from global.tag
  268.     tag:
  270.   # -- (object with { Env: string, Secret: string, Key: string }) Secrets to add as environment variables,
  271.   # where `Env` is the name of the env variable,
  272.   # `Secret` is the name of the Secret,
  273.   # and `Key` is the key of the Secret value to use
  274.   secrets:
  275.   #  someSecret:
  276.   #    Secret: some-secret
  277.   #    Key: secret_key
  278.   #    Env: SOME_SECRET
  280.   # -- Additional environment variables that will be passed to the control plane
  281.   envVars: { }
  283.   # -- Additional config maps to mount into the control plane, with optional inline values
  284.   extraConfigMaps: [ ]
  285. #    - name: extra-config
  286. #      mountPath: /etc/extra-config
  287. #      readOnly: true
  288. #      values:
  289. #        extra-config-key: |
  290. #          extra-config-value
  292.   # -- (object with { name: string, mountPath: string, readOnly: string }) Additional secrets to mount into the control plane,
  293.   # where `Env` is the name of the env variable,
  294.   # `Secret` is the name of the Secret,
  295.   # and `Key` is the key of the Secret value to use
  296.   extraSecrets:
  297.   #  extraConfig:
  298.   #    name: extra-config
  299.   #    mountPath: /etc/extra-config
  300.   #    readOnly: true
  302.   webhooks:
  303.     validator:
  304.       # -- Additional rules to apply on Kuma validator webhook. Useful when building custom policy on top of Kuma.
  305.       additionalRules: ""
  306.     ownerReference:
  307.       # -- Additional rules to apply on Kuma owner reference webhook. Useful when building custom policy on top of Kuma.
  308.       additionalRules: ""
  310.   # -- Specifies if the deployment should be started in hostNetwork mode.
  311.   hostNetwork: false
  312.   # -- Define a new server port for the admission controller. Recommended to set in combination with
  313.   # hostNetwork to prevent multiple port bindings on the same port (like Calico in AWS EKS).
  314.   admissionServerPort: 5443
  316.   # -- Security context at the pod level for control plane.
  317.   podSecurityContext:
  318.     runAsNonRoot: true
  320.   # -- Security context at the container level for control plane.
  321.   containerSecurityContext:
  322.     readOnlyRootFilesystem: true
  324.   # -- If true, then control plane can support TLS secrets for builtin gateway outside of mesh system namespace.
  325.   # The downside is that control plane requires permission to read Secrets in all namespaces.
  326.   supportGatewaySecretsInAllNamespaces: false
  328. cni:
  329.   # -- Install Kuma with CNI instead of proxy init container
  330.   enabled: false
  331.   # -- Install CNI in chained mode
  332.   chained: false
  333.   # -- Set the CNI install directory
  334.   netDir: /etc/cni/multus/net.d
  335.   # -- Set the CNI bin directory
  336.   binDir: /var/lib/cni/bin
  337.   # -- Set the CNI configuration name
  338.   confName: kuma-cni.conf
  339.   # -- CNI log level: one of off,info,debug
  340.   logLevel: info
  341.   # -- Node Selector for the CNI pods
  342.   nodeSelector:
  343.     kubernetes.io/os: linux
  344.   # -- Tolerations for the CNI pods
  345.   tolerations: []
  346.   # -- Additional pod annotations
  347.   podAnnotations: { }
  348.   # -- Set the CNI namespace
  349.   namespace: kube-system
  351.   image:
  352.     # -- CNI image repository
  353.     repository: "kuma-cni"
  354.     # -- CNI image tag - defaults to .Chart.AppVersion
  355.     tag:
  356.     # -- CNI image pull policy
  357.     imagePullPolicy: IfNotPresent
  359.   # -- it's only useful in tests to trigger a possible race condition
  360.   delayStartupSeconds: 0
  362.   # -- use new CNI (experimental)
  363.   experimental:
  364.     imageEbpf:
  365.       # -- CNI experimental eBPF image registry
  366.       registry: "docker.io/kumahq"
  367.       # -- CNI experimental eBPF image repository
  368.       repository: "merbridge"
  369.       # -- CNI experimental eBPF image tag
  370.       tag: "0.8.5"
  372.   resources:
  373.     requests:
  374.       cpu: 100m
  375.       memory: 100Mi
  376.     limits:
  377.       memory: 100Mi
  379.   # -- Security context at the pod level for cni
  380.   podSecurityContext: {}
  382.   # -- Security context at the container level for cni
  383.   containerSecurityContext:
  384.     readOnlyRootFilesystem: true
  385.     runAsNonRoot: false
  386.     runAsUser: 0
  387.     runAsGroup: 0
  389. dataPlane:
  390.   # -- If true, then turn on CoreDNS query logging
  391.   dnsLogging: false
  392.   image:
  393.     # -- The Kuma DP image repository
  394.     repository: "kuma-dp"
  395.     # -- Kuma DP ImagePullPolicy
  396.     pullPolicy: IfNotPresent
  397.     # -- Kuma DP Image Tag. When not specified, the value is copied from global.tag
  398.     tag:
  400.   initImage:
  401.     # -- The Kuma DP init image repository
  402.     repository: "kuma-init"
  403.     # -- Kuma DP init image tag When not specified, the value is copied from global.tag
  404.     tag:
  406. ingress:
  407.   # -- If true, it deploys Ingress for cross cluster communication
  408.   enabled: false
  410.   # -- Labels to add to resources, in addition to default labels
  411.   extraLabels: {}
  413.   # -- Time for which old listener will still be active as draining
  414.   drainTime: 30s
  416.   # -- Number of replicas of the Ingress. Ignored when autoscaling is enabled.
  417.   replicas: 1
  419.   # -- Log level for ingress (available values: off|info|debug)
  420.   logLevel: info
  422.   # -- Define the resources to allocate to mesh ingress
  423.   resources:
  424.     requests:
  425.       cpu: 50m
  426.       memory: 64Mi
  427.     limits:
  428.       cpu: 1000m
  429.       memory: 512Mi
  431.   # -- Pod lifecycle settings (useful for adding a preStop hook, when
  432.   # using AWS ALB or NLB)
  433.   lifecycle: {}
  435.   # -- Number of seconds to wait before force killing the pod. Make sure to
  436.   # update this if you add a preStop hook.
  437.   terminationGracePeriodSeconds: 40
  439.   # Horizontal Pod Autoscaling configuration
  440.   autoscaling:
  441.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  442.     enabled: false
  444.     # -- The minimum CP pods to allow
  445.     minReplicas: 2
  446.     # -- The max CP pods to scale to
  447.     maxReplicas: 5
  449.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  450.     targetCPUUtilizationPercentage: 80
  451.     # -- For clusters that do support autoscaling/v2, use metrics
  452.     metrics:
  453.       - type: Resource
  454.         resource:
  455.           name: cpu
  456.           target:
  457.             type: Utilization
  458.             averageUtilization: 80
  460.   service:
  461.     # -- Whether to create a Service resource.
  462.     enabled: true
  463.     # -- Service type of the Ingress
  464.     type: LoadBalancer
  465.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  466.     loadBalancerIP:
  467.     # -- Additional annotations to put on the Ingress service
  468.     annotations: { }
  469.     # -- Port on which Ingress is exposed
  470.     port: 10001
  471.     # -- Port on which service is exposed on Node for service of type NodePort
  472.     nodePort:
  473.   # -- Additional pod annotations (deprecated favor `podAnnotations`)
  474.   annotations: { }
  475.   # -- Additional pod annotations
  476.   podAnnotations: { }
  477.   # -- Node Selector for the Ingress pods
  478.   nodeSelector:
  479.     kubernetes.io/os: linux
  480.   # -- Tolerations for the Ingress pods
  481.   tolerations: []
  482.   podDisruptionBudget:
  483.     # -- Whether to create a pod disruption budget
  484.     enabled: false
  485.     # -- The maximum number of unavailable pods allowed by the budget
  486.     maxUnavailable: 1
  488.   # -- Affinity placement rule for the Kuma Ingress pods
  489.   # This is rendered as a template, so you can reference other helm variables
  490.   # or includes.
  491.   affinity:
  492.     podAntiAffinity:
  493.       preferredDuringSchedulingIgnoredDuringExecution:
  494.       - weight: 100
  495.         podAffinityTerm:
  496.           labelSelector:
  497.             # These match the selector labels used on the deployment.
  498.             matchExpressions:
  499.               - key: app.kubernetes.io/name
  500.                 operator: In
  501.                 values:
  502.                   - '{{ include "kuma.name" . }}'
  503.               - key: app.kubernetes.io/instance
  504.                 operator: In
  505.                 values:
  506.                   - '{{ .Release.Name }}'
  507.               - key: app
  508.                 operator: In
  509.                 values:
  510.                   - kuma-ingress
  511.           topologyKey: kubernetes.io/hostname
  513.   # -- Topology spread constraints rule for the Kuma Mesh Ingress pods.
  514.   # This is rendered as a template, so you can use variables to generate match labels.
  515.   topologySpreadConstraints:
  517.   # -- Security context at the pod level for ingress
  518.   podSecurityContext:
  519.     runAsNonRoot: true
  520.     runAsUser: 5678
  521.     runAsGroup: 5678
  523.   # -- Security context at the container level for ingress
  524.   containerSecurityContext:
  525.     readOnlyRootFilesystem: true
  527.   # -- Annotations to add for Control Plane's Service Account
  528.   serviceAccountAnnotations: { }
  529.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  530.   automountServiceAccountToken: true
  532. egress:
  533.   # -- If true, it deploys Egress for cross cluster communication
  534.   enabled: false
  535.   # -- Labels to add to resources, in addition to the default labels.
  536.   extraLabels: {}
  537.   # -- Time for which old listener will still be active as draining
  538.   drainTime: 30s
  539.   # -- Number of replicas of the Egress. Ignored when autoscaling is enabled.
  540.   replicas: 1
  542.   # -- Log level for egress (available values: off|info|debug)
  543.   logLevel: info
  545.   # Horizontal Pod Autoscaling configuration
  546.   autoscaling:
  547.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  548.     enabled: false
  550.     # -- The minimum CP pods to allow
  551.     minReplicas: 2
  552.     # -- The max CP pods to scale to
  553.     maxReplicas: 5
  555.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  556.     targetCPUUtilizationPercentage: 80
  557.     # -- For clusters that do support autoscaling/v2, use metrics
  558.     metrics:
  559.       - type: Resource
  560.         resource:
  561.           name: cpu
  562.           target:
  563.             type: Utilization
  564.             averageUtilization: 80
  565.   resources:
  566.     requests:
  567.       cpu: 50m
  568.       memory: 64Mi
  569.     limits:
  570.       cpu: 1000m
  571.       memory: 512Mi
  573.   service:
  574.     # -- Whether to create the service object
  575.     enabled: true
  576.     # -- Service type of the Egress
  577.     type: ClusterIP
  578.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  579.     loadBalancerIP:
  580.     # -- Additional annotations to put on the Egress service
  581.     annotations: { }
  582.     # -- Port on which Egress is exposed
  583.     port: 10002
  584.     # -- Port on which service is exposed on Node for service of type NodePort
  585.     nodePort:
  586.   # -- Additional pod annotations (deprecated favor `podAnnotations`)
  587.   annotations: { }
  588.   # -- Additional pod annotations
  589.   podAnnotations: { }
  590.   # -- Node Selector for the Egress pods
  591.   nodeSelector:
  592.     kubernetes.io/os: linux
  593.   # -- Tolerations for the Egress pods
  594.   tolerations: []
  595.   podDisruptionBudget:
  596.     # -- Whether to create a pod disruption budget
  597.     enabled: false
  598.     # -- The maximum number of unavailable pods allowed by the budget
  599.     maxUnavailable: 1
  601.   # -- Affinity placement rule for the Kuma Egress pods.
  602.   # This is rendered as a template, so you can reference other helm variables or includes.
  603.   affinity:
  604.     podAntiAffinity:
  605.       preferredDuringSchedulingIgnoredDuringExecution:
  606.       - weight: 100
  607.         podAffinityTerm:
  608.           labelSelector:
  609.             # These match the selector labels used on the deployment.
  610.             matchExpressions:
  611.               - key: app.kubernetes.io/name
  612.                 operator: In
  613.                 values:
  614.                   - '{{ include "kuma.name" . }}'
  615.               - key: app.kubernetes.io/instance
  616.                 operator: In
  617.                 values:
  618.                   - '{{ .Release.Name }}'
  619.               - key: app
  620.                 operator: In
  621.                 values:
  622.                   - kuma-egress
  623.           topologyKey: kubernetes.io/hostname
  625.   # -- Topology spread constraints rule for the Kuma Egress pods.
  626.   # This is rendered as a template, so you can use variables to generate match labels.
  627.   topologySpreadConstraints:
  629.   # -- Security context at the pod level for egress
  630.   podSecurityContext:
  631.     runAsNonRoot: true
  632.     runAsUser: 5678
  633.     runAsGroup: 5678
  635.   # -- Security context at the container level for egress
  636.   containerSecurityContext:
  637.     readOnlyRootFilesystem: true
  639.   # -- Annotations to add for Control Plane's Service Account
  640.   serviceAccountAnnotations: { }
  641.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  642.   automountServiceAccountToken: true
  644. kumactl:
  645.   image:
  646.     # -- The kumactl image repository
  647.     repository: kumactl
  648.     # -- The kumactl image tag. When not specified, the value is copied from global.tag
  649.     tag:
  651. kubectl:
  652.   image:
  653.     # -- The kubectl image registry
  654.     registry: docker.io
  655.     # -- The kubectl image repository
  656.     repository: bitnami/kubectl
  657.     # -- The kubectl image tag
  658.     tag: "1.27.5"
  659. hooks:
  660.   # -- Node selector for the HELM hooks
  661.   nodeSelector:
  662.     kubernetes.io/os: linux
  663.   # -- Tolerations for the HELM hooks
  664.   tolerations: []
  665.   # -- Security context at the pod level for crd/webhook/ns
  666.   podSecurityContext:
  667.     runAsNonRoot: true
  669.   # -- Security context at the container level for crd/webhook/ns
  670.   containerSecurityContext:
  671.     readOnlyRootFilesystem: true
  673.   # -- ebpf-cleanup hook needs write access to the root filesystem to clean ebpf programs
  674.   # Changing below values will potentially break ebpf cleanup completely,
  675.   # so be cautious when doing so.
  676.   ebpfCleanup:
  677.     # -- Security context at the pod level for crd/webhook/cleanup-ebpf
  678.     podSecurityContext:
  679.       runAsNonRoot: false
  680.     # -- Security context at the container level for crd/webhook/cleanup-ebpf
  681.     containerSecurityContext:
  682.       readOnlyRootFilesystem: false
  684. experimental:
  685.   # Configuration for the experimental ebpf mode for transparent proxy
  686.   ebpf:
  687.     # -- If true, ebpf will be used instead of using iptables to install/configure transparent proxy
  688.     enabled: false
  689.     # -- Name of the environmental variable which will contain the IP address of a pod
  690.     instanceIPEnvVarName: INSTANCE_IP
  691.     # -- Path where BPF file system should be mounted
  692.     bpffsPath: /sys/fs/bpf
  693.     # -- Host's cgroup2 path
  694.     cgroupPath: /sys/fs/cgroup
  695.     # -- Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty
  696.     tcAttachIface: ""
  697.     # -- Path where compiled eBPF programs which will be installed can be found
  698.     programsSourcePath: /tmp/kuma-ebpf
  699.   # -- If false, it uses legacy API for resource synchronization
  700.   deltaKds: true
  701.   # -- If true, enable native Kubernetes sidecars. This requires at least
  702.   # Kubernetes v1.29
  703.   sidecarContainers: false
  705. # Postgres' settings for universal control plane on k8s
  706. postgres:
  707.   # -- Postgres port, password should be provided as a secret reference in "controlPlane.secrets"
  708.   # with the Env value "KUMA_STORE_POSTGRES_PASSWORD".
  709.   # Example:
  710.   # controlPlane:
  711.   #   secrets:
  712.   #     - Secret: postgres-postgresql
  713.   #       Key: postgresql-password
  714.   #       Env: KUMA_STORE_POSTGRES_PASSWORD
  715.   port: "5432"
  716.   # TLS settings
  717.   tls:
  718.     # -- Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  719.     mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  720.     # -- Whether to disable SNI the postgres `sslsni` option.
  721.     disableSSLSNI: false # ENV: KUMA_STORE_POSTGRES_TLS_DISABLE_SSLSNI
  722.     # -- Secret name that contains the ca.crt
  723.     caSecretName:
  724.     # -- Secret name that contains the client tls.crt, tls.key
  725.     secretName:
  727. # @ignored for helm-docs
  728. plugins:
  729.   resources:
  730.     hostnamegenerators: true
  731.     meshexternalservices: true
  732.     meshservices: true
  733.   policies:
  734.     meshaccesslogs: true
  735.     meshcircuitbreakers: true
  736.     meshfaultinjections: true
  737.     meshhealthchecks: true
  738.     meshhttproutes: true
  739.     meshloadbalancingstrategies: true
  740.     meshmetrics: true
  741.     meshpassthroughs: true
  742.     meshproxypatches: true
  743.     meshratelimits: true
  744.     meshretries: true
  745.     meshtcproutes: true
  746.     meshtimeouts: true
  747.     meshtraces: true
  748.     meshtrafficpermissions: true