Kuma Star

MeshTLS

This policy enables Kuma to configure TLS mode, ciphers and version. Backends and default mode values are taken from the Mesh object.

TargetRef support matrix

targetRef Allowed kinds
targetRef.kind Mesh, Dataplane, MeshSubset(deprecated)

To learn more about the information in this table, see the matching docs.

Configuration

The following describes the default configuration settings of the MeshTLS policy:

  • tlsVersion: Defines TLS versions to be used by both client and server. Allowed values: TLSAuto, TLS10, TLS11, TLS12, TLS13.
  • tlsCiphers: Defines TLS ciphers to be used by both client and server. Allowed values: ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-CHACHA20-POLY1305, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-CHACHA20-POLY1305.
  • mode: Defines the mTLS mode - Permissive mode encrypts outbound connections the same way as Strict mode, but inbound connections on the server-side accept both TLS and plaintext. Allowed values: Strict, Permissive.

Setting the TLS version and ciphers on both the client and server makes it harder to misconfigure. If you want to try out a specific version/cipher combination, we recommend creating a temporary mesh, deploying two applications within it, and testing whether communication is working. If you have a use case for configuring a different set of allowed versions/ciphers on different workloads, we’d love to hear about it. In that case, please open an issue.

Examples

Set specific TLS version and ciphers

apiVersion: kuma.io/v1alpha1
kind: MeshTLS
metadata:
  name: set-version-and-ciphers
  namespace: kuma-system
  labels:
    kuma.io/mesh: default
spec:
  targetRef:
    kind: Mesh
  rules:
  - default:
      tlsVersion:
        min: TLS13
        max: TLS13
      tlsCiphers:
      - ECDHE-ECDSA-AES256-GCM-SHA384

Enable strict mode on specific subset

apiVersion: kuma.io/v1alpha1
kind: MeshTLS
metadata:
  name: strict-mode
  namespace: kuma-system
  labels:
    kuma.io/mesh: default
spec:
  targetRef:
    kind: Dataplane
    labels:
      app: redis
  rules:
  - default:
      mode: Strict

See also

All policy options

targetRef object
TargetRef is a reference to the resource the policy takes an effect on. The resource could be either...
kind enum required
Kind of the referenced resource
Values: Mesh | MeshSubset | MeshGateway | MeshService | MeshExternalService | MeshMultiZoneService | MeshServiceSubset | MeshHTTPRoute | Dataplane
name string
Name of the referenced resource. Can only be used with kinds: `MeshService`, `MeshServiceSubset` and...
namespace string
Namespace specifies the namespace of target resource. If empty only resources in policy namespace wi...
labels object
Labels are used to select group of MeshServices that match labels. Either Labels or Name and Namespa...
sectionName string
SectionName is used to target specific section of resource. For example, you can target port from Me...
mesh string
Mesh is reserved for future use to identify cross mesh resources.
proxyTypes array
ProxyTypes specifies the data plane types that are subject to the policy. When not specified, all da...
tags object
Tags used to select a subset of proxies by tags. Can only be used with kinds `MeshSubset` and `MeshS...
rules array
Rules defines inbound tls configurations. Currently limited to selecting all inbound traffic, as L7 ...
Default contains configuration of the inbound tls
mode enum
Mode defines the behavior of inbound listeners with regard to traffic encryption.
Values: Permissive | Strict
tlsCiphers array
TlsCiphers section for providing ciphers specification.
Version section for providing version specification.
max enum
Max defines maximum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
Values: TLSAuto | TLS10 | TLS11 | TLS12 | TLS13
Default: "TLSAuto"
min enum
Min defines minimum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
Values: TLSAuto | TLS10 | TLS11 | TLS12 | TLS13
Default: "TLSAuto"
from array
From list makes a match between clients and corresponding configurations
TargetRef is a reference to the resource that represents a group of clients.
kind enum required
Kind of the referenced resource
Values: Mesh | MeshSubset | MeshGateway | MeshService | MeshExternalService | MeshMultiZoneService | MeshServiceSubset | MeshHTTPRoute | Dataplane
name string
Name of the referenced resource. Can only be used with kinds: `MeshService`, `MeshServiceSubset` and...
namespace string
Namespace specifies the namespace of target resource. If empty only resources in policy namespace wi...
labels object
Labels are used to select group of MeshServices that match labels. Either Labels or Name and Namespa...
sectionName string
SectionName is used to target specific section of resource. For example, you can target port from Me...
mesh string
Mesh is reserved for future use to identify cross mesh resources.
proxyTypes array
ProxyTypes specifies the data plane types that are subject to the policy. When not specified, all da...
tags object
Tags used to select a subset of proxies by tags. Can only be used with kinds `MeshSubset` and `MeshS...
Default is a configuration specific to the group of clients referenced in 'targetRef'
mode enum
Mode defines the behavior of inbound listeners with regard to traffic encryption.
Values: Permissive | Strict
tlsCiphers array
TlsCiphers section for providing ciphers specification.
Version section for providing version specification.
max enum
Max defines maximum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
Values: TLSAuto | TLS10 | TLS11 | TLS12 | TLS13
Default: "TLSAuto"
min enum
Min defines minimum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
Values: TLSAuto | TLS10 | TLS11 | TLS12 | TLS13
Default: "TLSAuto"