Inspect API

Starting with version 1.5.0, Kuma offers the Inspect API to improve the policy debugging experience. It’s made up of several HTTP endpoints and is fully supported by kumactl, but can be used directly, using the HTTP API.

Matched policies

Read how Kuma chooses the right policy to apply to understand how Kuma matches policies to data plane proxies. With so many policies, it’s hard to understand which policies are selected for a specific data plane proxy. That’s where the Inspect API can help:

  1. kumactl inspect dataplane backend-1 --mesh=default
  1. DATAPLANE:
  2.   MeshProxyPatch
  3.     pt-1
  4.   MeshTrace
  5.     backends-eu
  6. INBOUND 127.0.0.1:10010:10011(backend):
  7.   MeshTrafficPermission
  8.     allow-all
  10. OUTBOUND 127.0.0.1:10006(gateway):
  11.   MeshTimeout
  12.     timeout-all-default
  14. SERVICE gateway:
  15.   MeshCircuitBreaker
  16.     circuit-breaker-all-default
  17.   MeshHealthCheck
  18.     gateway-to-backend
  19.   MeshRetry
  20.     retry-all-default

Each data plane proxy has 4 policy attachment points:

  • Inbound – applied to envoy inbound listener
  • Outbound – applied to envoy outbound listener
  • Service – applied to envoy outbound cluster (upstream cluster)
  • Dataplane – non-specific policy attachment, could affect inbound/outbound listeners and clusters

The command in the example above shows what policies were matched for each type of attachment.

Affected data plane proxies

Sometimes it’s useful to see if it’s safe to delete or modify some policy. Before making any critical changes, it is worth checking which data plane proxies will be affected. This can be done using the Inspect API as well:

  1. kumactl inspect meshtrafficpermission tp1 --mesh=default
  1. Affected data plane proxies:
  3.   backend-1:
  4.     inbound 127.0.0.1:10010:10011(backend)
  5.     inbound 127.0.0.1:20010:20011(backend-admin)
  6.     inbound 127.0.0.1:30010:30011(backend-api)
  8.   web-1:
  9.     inbound 127.0.0.1:10020:10021(web)

This command works for all types of policies.

Envoy proxy configuration

Kuma has 3 components that build on top of envoy – kuma-dp, zone-ingress and zone-egress. To help with debugging these components, the Inspect API gives access to envoy config dumps:

Get config dump for data plane proxy:

  1. kumactl inspect dataplane backend-1 --type=config-dump

Get config dump for zone ingress:

  1. kumactl inspect zoneingress zi-1 --type=config-dump

Get config dump for zone egress:

  1. kumactl inspect zoneegress ze-1 --type=config-dump

To retrieve a config dump in a Multizone deployment, kumactl should be pointed to a zone CP Global CPs don’t have access to envoy config dumps. This is a limitation that will be resolved in an upcoming release.