# Environment type. Available values are: "kubernetes" or "universal"
environment: universal # ENV: KUMA_ENVIRONMENT
# Mode in which Kuma CP is running. Available values are: "global", "zone"
mode: zone # ENV: KUMA_MODE
# Resource Store configuration
store:
# Type of Store used in the Control Plane. Available values are: "kubernetes", "postgres" or "memory"
type: memory # ENV: KUMA_STORE_TYPE
# Kubernetes Store configuration (used when store.type=kubernetes)
kubernetes:
# Namespace where Control Plane is installed to.
systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
# Postgres Store configuration (used when store.type=postgres)
postgres:
# Host of the Postgres DB
host: 127.0.0.1 # ENV: KUMA_STORE_POSTGRES_HOST
# Port of the Postgres DB
port: 15432 # ENV: KUMA_STORE_POSTGRES_PORT
# User of the Postgres DB
user: kuma # ENV: KUMA_STORE_POSTGRES_USER
# Password of the Postgres DB
password: kuma # ENV: KUMA_STORE_POSTGRES_PASSWORD
# Database name of the Postgres DB
dbName: kuma # ENV: KUMA_STORE_POSTGRES_DB_NAME
# Postgres driver. Only pgx is supported.
driverName: pgx # ENV: KUMA_STORE_POSTGRES_DRIVER_NAME
# Connection Timeout to the DB in seconds
connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
# MaxConnectionIdleTime is the duration after which an idle connection will be automatically closed by the health check.
maxConnectionIdleTime: "30m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_IDLE_TIME
# MaxConnectionLifetime is the duration since creation after which a connection will be automatically closed
maxConnectionLifetime: "1h" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME
# MaxConnectionLifetimeJitter is the duration after maxConnectionLifetime to randomly decide to close a connection.
# This helps prevent all connections from being closed at the exact same time, starving the pool.
maxConnectionLifetimeJitter: "1m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME_JITTER
# HealthCheckInterval is the duration between checks of the health of idle connections.
healthCheckInterval: "30s" # ENV: KUMA_STORE_POSTGRES_HEALTH_CHECK_INTERVAL
# MinOpenConnections is the minimum number of open connections to the database
minOpenConnections: 0 # ENV: KUMA_STORE_POSTGRES_MIN_OPEN_CONNECTIONS
# MaxOpenConnections is the maximum number of open connections to the database
# `0` value means number of open connections is unlimited
maxOpenConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS
# MaxIdleConnections is the maximum number of connections in the idle connection pool
# <0 value means no idle connections and 0 means default max idle connections.
maxIdleConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
# MaxListQueryElements defines maximum number of changed elements before requesting full list of elements from the store.
maxListQueryElements: 0 # ENV: KUMA_STORE_POSTGRES_MAX_LIST_QUERY_ELEMENTS
# TLS settings
tls:
# Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
# Path to TLS Certificate of the client. Required when server has METHOD=cert
certPath: # ENV: KUMA_STORE_POSTGRES_TLS_CERT_PATH
# Path to TLS Key of the client. Required when server has METHOD=cert
keyPath: # ENV: KUMA_STORE_POSTGRES_TLS_KEY_PATH
# Path to the root certificate. Used in verifyCa and verifyFull modes.
caPath: # ENV: KUMA_STORE_POSTGRES_TLS_CA_PATH
# If true, disables TLS Server Name Indication (SNI) for Postgres connections.
disableSSLSNI: false # ENV: KUMA_STORE_POSTGRES_TLS_DISABLE_SSLSNI
# TolerateNewerDBVersions makes `migrate up` a no-op when the DB is at a
# newer version than the binary, and relaxes the boot-time migration gate
# from strict equality (dbVer == fileVer) to dbVer >= fileVer. Intended
# for blue/green CP upgrades where a newer CP owns schema migrations.
tolerateNewerDBVersions: false # ENV: KUMA_STORE_POSTGRES_TOLERATE_NEWER_DB_VERSIONS
# ReadReplica is a setting for a DB replica used only for read queries
readReplica:
# Host of the Postgres DB read replica. If not set, read replica is not used.
host: "" # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_HOST
# Port of the Postgres DB read replica
port: 5432 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_PORT
# Ratio in [0-100] range. How many SELECT queries (out of 100) will use read replica.
ratio: 100 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_RATIO
# Cache for read only operations. This cache is local to the instance of the control plane.
cache:
# Expiration time for elements in cache.
expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
# Upsert (get and update) configuration
upsert:
# Base time for exponential backoff on upsert operations when retry is enabled
conflictRetryBaseBackoff: 200ms # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_BASE_BACKOFF
# Max retries on upsert (get and update) operation when retry is enabled
conflictRetryMaxTimes: 10 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
# Percentage of jitter. For example: if backoff is 20s, and this value 10, the backoff will be between 18s and 22s.
conflictRetryJitterPercent: 30 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_JITTER_PERCENT
# If true, skips validation of resource delete.
# For example you don't have to delete all Dataplane objects before you delete a Mesh
unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
# Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
bootstrapServer:
# Parameters of bootstrap configuration
params:
# Address of Envoy Admin
adminAddress: 127.0.0.1 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ADDRESS
# Port of Envoy Admin
adminPort: 9901 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT
# If true, Envoy admin API binds to a Unix domain socket instead of TCP
envoyAdminUnixSocket: true # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ENVOY_ADMIN_UNIX_SOCKET
# Port for the readiness reporter when admin uses Unix domain socket
readinessPort: 9902 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_READINESS_PORT
# Path to access log file of Envoy Admin
adminAccessLogPath: /dev/null # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ACCESS_LOG_PATH
# Host of XDS Server. By default it is the same host as the one used by kuma-dp to connect to the control plane
xdsHost: "" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST
# Port of XDS Server. By default it is autoconfigured from KUMA_DP_SERVER_PORT
xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
# Connection timeout to the XDS Server
xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
# Maximum size in bytes of received xDS messages when Envoy uses GoogleGrpc.
# Sets the channel argument `grpc.max_receive_message_length`.
# Increase this value when large xDS configurations exceed the limit.
# This setting does not apply when Envoy uses EnvoyGrpc.
xdsGrpcMaxReceiveMessageBytes: 4194304 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_GRPC_MAX_RECEIVE_MESSAGE_BYTES
# Monitoring Assignment Discovery Service (MADS) server configuration
monitoringAssignmentServer:
# Whether the MADS server is enabled. MADS is only supported in universal
# deployment mode; this setting is ignored on Kubernetes.
enabled: true # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ENABLED
# Port of the server that serves Monitoring Assignment Discovery Service (MADS) over gRPC and HTTP.
port: 5676 # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_PORT
# Which MADS API versions to serve
apiVersions: ["v1"] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_API_VERSIONS
# Interval for re-generating monitoring assignments for clients connected to the Control Plane.
assignmentRefreshInterval: 1s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL
# The default timeout for a single fetch-based discovery request, if not specified
defaultFetchTimeout: 30s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_DEFAULT_FETCH_TIMEOUT
# If true, enables TLS for the MADS server. Certificate paths alone do not enable TLS.
tlsEnabled: false # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_ENABLED
# Path to TLS certificate file
tlsCertFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CERT_FILE
# Path to TLS key file
tlsKeyFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_KEY_FILE
# Minimum TLS version for the MADS server, overridden by general.tlsMinVersion when non-empty.
tlsMinVersion: "TLSv1_2" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MIN_VERSION
# Maximum TLS version for the MADS server, overridden by general.tlsMaxVersion when non-empty.
tlsMaxVersion: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MAX_VERSION
# TLS cipher suites for the MADS server, overridden by general.tlsCipherSuites when non-empty.
tlsCipherSuites: [] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CIPHER_SUITES
# Envoy XDS server configuration
xdsServer:
# Interval for re-generating configuration for Dataplanes connected to the Control Plane
dataplaneConfigurationRefreshInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_CONFIGURATION_REFRESH_INTERVAL
# Interval for flushing status of Dataplanes connected to the Control Plane
dataplaneStatusFlushInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_STATUS_FLUSH_INTERVAL
# Maximum number of policy matching results kept in the shared Dataplane xDS reconciliation cache. Set to 0 to disable.
policyMatchingCacheSize: 10000 # ENV: KUMA_XDS_SERVER_POLICY_MATCHING_CACHE_SIZE
# Backoff that is executed when Control Plane is sending the response that was previously rejected by Dataplane
nackBackoff: 5s # ENV: KUMA_XDS_SERVER_NACK_BACKOFF
# A delay between proxy terminating a connection and the CP trying to deregister the proxy.
# It is used only in universal mode when you use direct lifecycle.
# Setting this setting to 0s disables the delay.
# Disabling this may cause race conditions that one instance of CP removes proxy object
# while proxy is connected to another instance of the CP.
dataplaneDeregistrationDelay: 10s # ENV: KUMA_XDS_DATAPLANE_DEREGISTRATION_DELAY
# API Server configuration
apiServer:
# HTTP configuration of the API Server
http:
# If true then API Server will be served on HTTP
enabled: true # ENV: KUMA_API_SERVER_HTTP_ENABLED
# Network interface on which HTTP API Server will be exposed
interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTP_INTERFACE
# Port of the API Server
port: 5681 # ENV: KUMA_API_SERVER_HTTP_PORT
# HTTPS configuration of the API Server
https:
# If true then API Server will be served on HTTPS
enabled: true # ENV: KUMA_API_SERVER_HTTPS_ENABLED
# Network interface on which HTTPS API Server will be exposed
interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTPS_INTERFACE
# Port of the HTTPS API Server
port: 5682 # ENV: KUMA_API_SERVER_HTTPS_PORT
# Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
tlsCertFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
# Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
tlsKeyFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
# Path to the CA certificate which is used to sign client certificates. It is used only for verifying client certificates.
tlsCaFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CA_FILE
# Minimum TLS version for the HTTPS API server, overridden by general.tlsMinVersion when non-empty.
tlsMinVersion: "TLSv1_2" # ENV: KUMA_API_SERVER_HTTPS_TLS_MIN_VERSION
# Maximum TLS version for the HTTPS API server, overridden by general.tlsMaxVersion when non-empty.
tlsMaxVersion: # ENV: KUMA_API_SERVER_HTTPS_TLS_MAX_VERSION
# TLS cipher suites for the HTTPS API server, overridden by general.tlsCipherSuites when non-empty.
tlsCipherSuites: [] # ENV: KUMA_API_SERVER_HTTPS_TLS_CIPHER_SUITES
# If true, then HTTPS connection will require client cert.
requireClientCert: false # ENV: KUMA_API_SERVER_HTTPS_REQUIRE_CLIENT_CERT
# Api Server Authentication configuration
authn:
# Type of authentication mechanism ("tokens" is the built-in/default value; plugin-provided authn types may also be available)
type: tokens # ENV: KUMA_API_SERVER_AUTHN_TYPE
# Localhost is authenticated as a user admin of group admin
localhostIsAdmin: true # ENV: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
# Configuration for tokens authentication
tokens:
# If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma secret
bootstrapAdminToken: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_BOOTSTRAP_ADMIN_TOKEN
# If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
enableIssuer: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_ENABLE_ISSUER
# Token validator configuration
validator:
# If true then Kuma secrets with prefix "user-token-signing-key" are considered as signing keys.
useSecrets: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_VALIDATOR_USE_SECRETS
# List of public keys used to validate the token. Example:
# - kid: 1
# key: |
# -----BEGIN RSA PUBLIC KEY-----
# MIIBCgKCAQEAq....
# -----END RSA PUBLIC KEY-----
# - kid: 2
# keyFile: /keys/public.pem
publicKeys: []
# If true, then API Server will operate in read only mode (serving GET requests)
readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
# Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
corsAllowedDomains: [] # ENV: KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
# Can be used if you use a reverse proxy
rootUrl: "" # ENV: KUMA_API_SERVER_ROOT_URL
# The path to serve the API from
basePath: "/" # ENV: KUMA_API_SERVER_BASE_PATH
# configuration specific to the GUI
gui:
# Whether to serve the gui (if mode=zone this has no effect)
enabled: true # ENV: KUMA_API_SERVER_GUI_ENABLED
# Can be used if you use a reverse proxy or want to serve the gui from a different path
rootUrl: "" # ENV: KUMA_API_SERVER_GUI_ROOT_URL
# The path to serve the GUI from
basePath: "/gui" # ENV: KUMA_API_SERVER_GUI_BASE_PATH
# The amount of time allowed to read request headers
readHeaderTimeout: 1s # ENV: KUMA_API_SERVER_READ_HEADER_TIMEOUT
# The maximum duration for reading the entire request
readTimeout: 10s # ENV: KUMA_API_SERVER_READ_TIMEOUT
# The maximum duration before timing out writes of the response
writeTimeout: 30s # ENV: KUMA_API_SERVER_WRITE_TIMEOUT
# The maximum amount of time to wait for the next request when keep-alives are enabled
idleTimeout: 2m0s # ENV: KUMA_API_SERVER_IDLE_TIMEOUT
# Environment-specific configuration
runtime:
# Kubernetes-specific configuration
kubernetes:
# Service name of the Kuma Control Plane. It is used to point Kuma DP to proper URL.
controlPlaneServiceName: kuma-control-plane # ENV: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
# Additional usernames allowed to bypass resource admission restrictions.
# generic-garbage-collector and storage-version-migrator-controller are always included.
# For ServiceAccounts, use the full username: system:serviceaccount:<namespace>:<name>.
allowedUsers: null # ENV: KUMA_RUNTIME_KUBERNETES_ALLOWED_USERS
# Taint controller that prevents applications from scheduling until CNI is ready.
nodeTaintController:
# If true enables the taint controller.
enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_ENABLED
# Value of app label on CNI pod that indicates if node can be ready.
cniApp: "" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_APP
# Value of CNI namespace.
cniNamespace: "kube-system" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_NAMESPACE
# Admission WebHook Server configuration
admissionServer:
# Address the Admission WebHook Server should be listening on
address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
# Port the Admission WebHook Server should be listening on
port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
# Directory with a TLS cert and private key for the Admission WebHook Server.
# TLS certificate file must be named `tls.crt`.
# TLS key file must be named `tls.key`.
certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
# Injector defines configuration of a Kuma Sidecar Injector.
injector:
# if true runs kuma-cp in CNI compatible mode
cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
# list of exceptions for Kuma injection
exceptions:
# a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
labels:
openshift.io/build.name: "*"
openshift.io/deployer-pod-for.name: "*"
# ApplicationProbeProxyPort is a port for proxying application probes, it is not secured by mTLS. By setting to 0, probe proxying will be disabled.
applicationProbeProxyPort: 9001 # ENV: KUMA_RUNTIME_KUBERNETES_APPLICATION_PROBE_PROXY_PORT
# CaCertFile is CA certificate which will be used to verify a connection to the control plane.
caCertFile: # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
# SidecarContainer defines configuration of the Kuma sidecar container.
sidecarContainer:
# Image name.
image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
# Image pull policy for the Kuma DP image; one of Always, IfNotPresent, Never.
imagePullPolicy: IfNotPresent # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE_PULL_POLICY
# Redirect port for inbound traffic.
redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
# IP family mode enabled for traffic redirection, can be 'dualstack' or 'ipv4'
ipFamilyMode: dualstack # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IP_FAMILY_MODE
# Redirect port for outbound traffic.
redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
# User ID.
uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
# Group ID.
gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
# Drain time for listeners.
drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
# Readiness probe.
readinessProbe:
# Number of seconds after the container has started before readiness probes are initiated.
initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
# Number of seconds after which the probe times out.
timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
# How often (in seconds) to perform the probe.
periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
# Minimum consecutive successes for the probe to be considered successful after having failed.
successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
# Minimum consecutive failures for the probe to be considered failed after having succeeded.
failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
# Liveness probe.
livenessProbe:
# Number of seconds after the container has started before liveness probes are initiated.
initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
# Number of seconds after which the probe times out.
timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
# How often (in seconds) to perform the probe.
periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
# Minimum consecutive failures for the probe to be considered failed after having succeeded.
failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
# Startup probe (if sidecar containers feature is enabled).
startupProbe:
# Number of seconds after the container has started before startup probes are initiated.
initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_INITIAL_DELAY_SECONDS
# Number of seconds after which the probe times out.
timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_TIMEOUT_SECONDS
# How often (in seconds) to perform the probe.
periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_PERIOD_SECONDS
# Minimum consecutive failures for the probe to be considered failed after having succeeded.
failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_STARTUP_PROBE_FAILURE_THRESHOLD
# Compute resource requirements.
resources:
# Minimum amount of compute resources required.
requests:
# CPU, in cores. (500m = .5 cores)
cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
# Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
# Maximum amount of compute resources allowed.
limits:
# CPU, in cores. (500m = .5 cores). Set to 0 to disable CPU limit.
cpu: "0" # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
# Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
# Additional environment variables that can be placed on Kuma DP sidecar
envVars: {} # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ENV_VARS
# If true, it enables a postStart script that waits until Envoy is ready.
# With the current Kubernetes behavior, any other container in the Pod will wait until the script is complete.
waitForDataplaneReady: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_WAIT_FOR_DATAPLANE_READY
# InitContainer defines configuration of the Kuma init container
initContainer:
# Image name.
image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
# Image pull policy for the Kuma init image; one of Always, IfNotPresent, Never.
imagePullPolicy: IfNotPresent # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE_PULL_POLICY
# Compute resource requirements.
resources:
# Minimum amount of compute resources required.
requests:
# CPU, in cores. (500m = .5 cores)
cpu: 20m # ENV: KUMA_INJECTOR_INIT_CONTAINER_RESOURCES_REQUESTS_CPU
# Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
memory: 20M # ENV: KUMA_INJECTOR_INIT_CONTAINER_RESOURCES_REQUESTS_MEMORY
# Maximum amount of compute resources allowed.
limits:
# CPU, in cores. (500m = .5 cores). Set to 0 to disable CPU limit.
cpu: "0" # ENV: KUMA_INJECTOR_INIT_CONTAINER_RESOURCES_LIMITS_CPU
# Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
memory: 50M # ENV: KUMA_INJECTOR_INIT_CONTAINER_RESOURCES_LIMITS_MEMORY
# ValidationContainer defines configuration of the Kuma validation init container
validationContainer:
# Compute resource requirements.
resources:
# Minimum amount of compute resources required.
requests:
# CPU, in cores. (500m = .5 cores)
cpu: 20m # ENV: KUMA_INJECTOR_VALIDATION_CONTAINER_RESOURCES_REQUESTS_CPU
# Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
memory: 20M # ENV: KUMA_INJECTOR_VALIDATION_CONTAINER_RESOURCES_REQUESTS_MEMORY
# Maximum amount of compute resources allowed.
limits:
# CPU, in cores. (500m = .5 cores). Set to 0 to disable CPU limit.
cpu: "0" # ENV: KUMA_INJECTOR_VALIDATION_CONTAINER_RESOURCES_LIMITS_CPU
# Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
memory: 50M # ENV: KUMA_INJECTOR_VALIDATION_CONTAINER_RESOURCES_LIMITS_MEMORY
# ContainerPatches is an optional list of ContainerPatch names which will be applied
# to init and sidecar containers if workload is not annotated with a patch list.
containerPatches: [] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
# Configuration for a traffic that is intercepted by sidecar
sidecarTraffic:
# List of inbound ports that will be excluded from interception.
# This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
excludeInboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
# List of outbound ports that will be excluded from interception.
# This setting is applied on every pod unless traffic.kuma.io/exclude-outbound-ports annotation is specified on Pod.
excludeOutboundPorts: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
# List of inbound IP addresses that will be excluded from interception.
# This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ips annotation is specified on the Pod.
# IP addresses can be specified with or without CIDR notation, and multiple addresses can be separated by commas.
excludeInboundIPs: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_IPS
# List of outbound IP addresses that will be excluded from interception.
# This setting is applied on every pod unless traffic.kuma.io/exclude-outbound-ips annotation is specified on the Pod.
# IP addresses can be specified with or without CIDR notation, and multiple addresses can be separated by commas.
excludeOutboundIPs: [] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_IPS
builtinDNS:
# Use the built-in DNS
enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
# Redirect port for DNS
port: 15053 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_PORT
# IgnoredServiceSelectorLabels defines a list ignored labels in Service selector.
# A Pod that matches a Service on every other label gets that Service's inbounds in a ready
# state, so it is already an eligible endpoint when the selector moves onto it. Which Pods
# actually receive traffic is decided by the MeshService selector, which still matches the
# full set of labels.
# It is useful when you change Service selector and expect traffic to be sent immediately.
# An example of this is ArgoCD's BlueGreen deployment and "rollouts-pod-template-hash" selector.
ignoredServiceSelectorLabels: [] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_IGNORED_SERVICE_SELECTOR_LABELS
# nodeLabelsToCopy defines a list of node labels that should be copied to the Pod.
nodeLabelsToCopy: ["topology.kubernetes.io/zone", "topology.kubernetes.io/region", "kubernetes.io/hostname"] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_NODE_LABELS_TO_COPY
# TransparentProxyConfigMapName specifies the name of the ConfigMap in the system namespace that contains the base
# transparent proxy configuration. The sidecar injector reads it, merges it with pod annotations and injects the
# result. It defaults to "kuma-transparent-proxy-config" and the ConfigMap is expected to exist.
transparentProxyConfigMap: "kuma-transparent-proxy-config" # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_TRANSPARENT_PROXY_CONFIGMAP_NAME
# Spire is used to specify spire integration configuration.
spire:
# If true, enables mounting of SPIRE-related resources.
enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SPIRE_ENABLED
# mountPath is the location inside the container where the SPIRE agent socket will be mounted.
mountPath: "/run/spire/sockets" # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SPIRE_MOUNT_PATH
# socketFileName is the name of the socket on the host
socketFileName: "socket" # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SPIRE_SOCKET_FILE_NAME
marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
# Kubernetes's resources reconciliation concurrency configuration
controllersConcurrency:
# PodController defines maximum concurrent reconciliations of Pod resources
# Default value 10. If set to 0 kube controller-runtime default value of 1 will be used.
podController: 10 # ENV: KUMA_RUNTIME_KUBERNETES_CONTROLLERS_CONCURRENCY_POD_CONTROLLER
# Kubernetes client configuration
clientConfig:
# Qps defines maximum requests kubernetes client is allowed to make per second.
# Default value 100. If set to 0 kube-client default value of 5 will be used.
qps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_QPS
# BurstQps defines maximum burst requests kubernetes client is allowed to make per second
# Default value 100. If set to 0 kube-client default value of 10 will be used.
burstQps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_BURST_QPS
leaderElection:
# LeaseDuration is the duration that non-leader candidates will
# wait to force acquire leadership. This is measured against time of
# last observed ack. Default is 15 seconds.
leaseDuration: 15s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_LEASE_DURATION
# RenewDeadline is the duration that the acting controlplane will retry
# refreshing leadership before giving up. Default is 10 seconds.
renewDeadline: 10s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_RENEW_DEADLINE
# SkipMeshOwnerReference is a flag that allows to skip adding Mesh owner reference to resources.
# If this is set to true, deleting a Mesh will not delete resources that belong to that Mesh.
# This can be useful when resources are managed in Argo CD where creation/deletion is managed there.
skipMeshOwnerReference: false # ENV: KUMA_RUNTIME_KUBERNETES_SKIP_MESH_OWNER_REFERENCE
# WorkloadLabels is a prioritized list of pod labels to use for generating the kuma.io/workload label on DataplaneProxy.
# The first non-empty label value found will be used. If no labels match, falls back to ServiceAccount name.
# Default is empty list (uses ServiceAccount as workload identifier).
workloadLabels: [] # ENV: KUMA_RUNTIME_KUBERNETES_WORKLOAD_LABELS
# DisallowMultipleMeshesPerNamespace prevents pods from using kuma.io/mesh label in ways that would create
# multiple meshes within a single namespace. When enabled, the Pod admission webhook rejects
# a Pod if the namespace already contains a Dataplane in a different mesh.
disallowMultipleMeshesPerNamespace: false # ENV: KUMA_RUNTIME_KUBERNETES_DISALLOW_MULTIPLE_MESHES_PER_NAMESPACE
# Universal-specific configuration
universal:
# DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
# Spire defines default configuration of the spire properties
spire:
# SocketPath is the location of the socket file one the host
socketPath: /tmp/spire-agent/public/api.sock # ENV: KUMA_RUNTIME_UNIVERSAL_SPIRE_SOCKET_PATH
workload:
# How often we check whether Workloads need to be generated from Dataplanes
# Set to 0s to disable automatic Workload generation.
generationInterval: 2s # ENV: KUMA_RUNTIME_UNIVERSAL_WORKLOAD_GENERATION_INTERVAL
# Default Kuma entities configuration
defaults:
# If true, it skips creating the default Mesh
skipMeshCreation: false # ENV: KUMA_DEFAULTS_SKIP_MESH_CREATION
# If true, it skips creating the default tenant resources
skipTenantResources: false # ENV: KUMA_DEFAULTS_SKIP_TENANT_RESOURCES
# If true, it skips creating default hostname generators
skipHostnameGenerators: false # ENV: KUMA_DEFAULTS_SKIP_HOSTNAME_GENERATORS
# If true, a data plane proxy without reachableBackends reaches no destination in the mesh, and one without MeshPassthrough gets no outbound passthrough.
# Set it to false to restore the legacy behavior where outbound traffic is allowed by default (insecure).
# Unset means true.
restrictOutbound: null # ENV: KUMA_DEFAULTS_RESTRICT_OUTBOUND
# Metrics configuration
metrics:
dataplane:
# How many latest subscriptions will be stored in DataplaneInsight object, if equals 0 then unlimited
subscriptionLimit: 2 # ENV: KUMA_METRICS_DATAPLANE_SUBSCRIPTION_LIMIT
# How long data plane proxy can stay Online without active xDS connection
idleTimeout: 5m # ENV: KUMA_METRICS_DATAPLANE_IDLE_TIMEOUT
zone:
# How many latest subscriptions will be stored in ZoneInsights object, if equals 0 then unlimited
subscriptionLimit: 10 # ENV: KUMA_METRICS_ZONE_SUBSCRIPTION_LIMIT
# How long zone can stay Online without active KDS connection
idleTimeout: 5m # ENV: KUMA_METRICS_ZONE_IDLE_TIMEOUT
# Compact finished metrics (do not store config and details of KDS exchange).
compactFinishedSubscriptions: false # ENV: KUMA_METRICS_ZONE_COMPACT_FINISHED_SUBSCRIPTIONS
mesh:
# Minimum time between 2 refresh of insights
minResyncInterval: 1s # ENV: KUMA_METRICS_MESH_MIN_RESYNC_INTERVAL
# time between triggering a full refresh of all the insights
fullResyncInterval: 20s # ENV: KUMA_METRICS_MESH_FULL_RESYNC_INTERVAL
# the size of the buffer between event creation and processing
bufferSize: 1000 # ENV: KUMA_METRICS_MESH_BUFFER_SIZE
# the number of workers that process metrics events
eventProcessors: 1 # ENV: KUMA_METRICS_MESH_EVENT_PROCESSORS
controlPlane:
# If true metrics show number of resources in the system should be reported
reportResourcesCount: true # ENV: KUMA_METRICS_CONTROL_PLANE_REPORT_RESOURCES_COUNT
openTelemetry:
# If true, CP metrics will be pushed via OTLP when OTEL_EXPORTER_OTLP_ENDPOINT is set
enabled: true # ENV: KUMA_METRICS_OPENTELEMETRY_ENABLED
# Reports configuration
reports:
# If true then usage stats will be reported
enabled: false # ENV: KUMA_REPORTS_ENABLED
# General configuration
general:
# dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
dnsCacheTTL: 10s # ENV: KUMA_GENERAL_DNS_CACHE_TTL
# TlsCertFile defines a path to a file with PEM-encoded TLS cert that will be used across all the Kuma Servers.
tlsCertFile: # ENV: KUMA_GENERAL_TLS_CERT_FILE
# TlsKeyFile defines a path to a file with PEM-encoded TLS key that will be used across all the Kuma Servers.
tlsKeyFile: # ENV: KUMA_GENERAL_TLS_KEY_FILE
# Minimum TLS version for all Kuma servers. When non-empty, overrides per-server minimum versions.
# Set to "" to use the individual servers' tlsMinVersion settings.
tlsMinVersion: "TLSv1_2" # ENV: KUMA_GENERAL_TLS_MIN_VERSION
# Maximum TLS version for all Kuma servers. When non-empty, overrides per-server maximum versions.
# Set to "" to use the individual servers' tlsMaxVersion settings.
tlsMaxVersion: # ENV: KUMA_GENERAL_TLS_MAX_VERSION
# TLS cipher suites for all Kuma servers. When non-empty, overrides per-server cipher suites.
# Set to [] to use the individual servers' tlsCipherSuites settings.
tlsCipherSuites: [] # ENV: KUMA_GENERAL_TLS_CIPHER_SUITES
# WorkDir defines a path to the working directory
# Kuma stores in this directory autogenerated entities like certificates.
# If empty then the working directory is $HOME/.kuma
workDir: "" # ENV: KUMA_GENERAL_WORK_DIR
# ResilientComponentBaseBackoff configures base backoff for restarting resilient components:
# KDS sync, Insight resync, PostgresEventListener, etc.
resilientComponentBaseBackoff: 5s # ENV: KUMA_GENERAL_RESILIENT_COMPONENT_BASE_BACKOFF
# ResilientComponentMaxBackoff configures max backoff for restarting resilient component:
# KDS sync, Insight resync, PostgresEventListener, etc.
resilientComponentMaxBackoff: 1m # ENV: KUMA_GENERAL_RESILIENT_COMPONENT_MAX_BACKOFF
# CertGenerationBaseBackoff configures the base backoff before retrying dataplane certificate
# generation after a failure (e.g. a misconfigured CA backend), so a failing backend is not
# called on every DP sync tick.
certGenerationBaseBackoff: 5s # ENV: KUMA_GENERAL_CERT_GENERATION_BASE_BACKOFF
# CertGenerationMaxBackoff configures the max backoff before retrying dataplane certificate
# generation after a failure (e.g. a misconfigured CA backend).
certGenerationMaxBackoff: 5m # ENV: KUMA_GENERAL_CERT_GENERATION_MAX_BACKOFF
# CertGenerationCircuitBreakerMinProxies is the number of distinct proxies that must fail
# certificate generation against the same backend before its circuit breaker opens and
# short-circuits further attempts. Kept well above 1 so a single misbehaving proxy can never
# trip a whole backend. In a mesh with fewer proxies than this the circuit breaker never opens
# and only the per-proxy backoff applies (still bounded), so small deployments may want to lower
# it. 0 disables the circuit breaker, leaving only per-proxy backoff.
certGenerationCircuitBreakerMinProxies: 10 # ENV: KUMA_GENERAL_CERT_GENERATION_CIRCUIT_BREAKER_MIN_PROXIES
# Multizone mode
multizone:
global:
kds:
# Port of a gRPC server that serves Kuma Discovery Service (KDS).
grpcPort: 5685 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_GRPC_PORT
# Interval for flushing Zone Insights (stats of multi-zone communication)
zoneInsightFlushInterval: 10s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_ZONE_INSIGHT_FLUSH_INTERVAL
# TlsEnabled turns on TLS for KDS
tlsEnabled: true # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_ENABLED
# TlsCertFile defines a path to a file with PEM-encoded TLS cert.
tlsCertFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
# TlsKeyFile defines a path to a file with PEM-encoded TLS key.
tlsKeyFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
# TlsMinVersion the minimum version of TLS
tlsMinVersion: "TLSv1_2" # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MIN_VERSION
# TlsMaxVersion the maximum version of TLS
tlsMaxVersion: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MAX_VERSION
# TlsCipherSuites the list of cipher suites
tlsCipherSuites: [] # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CIPHER_SUITES
# MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
# In practice this means a limit on full list of one resource type.
maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MAX_MSG_SIZE
# MsgSendTimeout defines a timeout on sending a single KDS message.
# KDS stream between control planes is terminated if the control plane hits this timeout.
msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MSG_SEND_TIMEOUT
# Backoff that is executed when the global control plane is sending the response that was previously rejected by zone control plane
nackBackoff: 5s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_NACK_BACKOFF
# Response backoff is a time Global CP waits before sending ACK/NACK.
# This is a way to slow down Zone CP from sending resources too often.
responseBackoff: 0s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_RESPONSE_BACKOFF
# If true, Global CP logs full DeltaDiscoveryResponse payloads received from Zone CPs at V(1) instead of compact summaries.
logPayloads: false # ENV: KUMA_MULTIZONE_GLOBAL_KDS_LOG_PAYLOADS
# Event-based snapshot watchdog timing for Global KDS.
eventBasedWatchdog:
# How often changed resources are flushed to a KDS snapshot.
flushInterval: 5s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_EVENT_BASED_WATCHDOG_FLUSH_INTERVAL
# How often a full KDS resync is scheduled.
fullResyncInterval: 1m # ENV: KUMA_MULTIZONE_GLOBAL_KDS_EVENT_BASED_WATCHDOG_FULL_RESYNC_INTERVAL
# If true, the initial full resync is delayed by a random duration up to FullResyncInterval.
delayFullResync: true # ENV: KUMA_MULTIZONE_GLOBAL_KDS_EVENT_BASED_WATCHDOG_DELAY_FULL_RESYNC
tracing:
# Defines whether tracing is enabled for all gRPC methods
# of GlobalKDSServer and KDSSyncService or completely disabled
enabled: true # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TRACING_ENABLED
# Authentication of Zone CPs connecting to Global CP
auth:
# Type of authentication. Available values: "none", "zoneToken", plus the types a distribution adds.
# With "zoneToken" every Zone CP has to present a Zone Token generated with `kumactl generate zone-token --zone=<zone> --scope=cp`
type: none # ENV: KUMA_MULTIZONE_GLOBAL_KDS_AUTH_TYPE
# Configuration of the "zoneToken" authentication type
zoneToken:
# If true the Global CP issues Zone Tokens over its API.
# Set it to false when all the tokens are signed offline with the private key.
enableIssuer: true # ENV: KUMA_MULTIZONE_GLOBAL_KDS_AUTH_ZONE_TOKEN_ENABLE_ISSUER
# Zone Token validator configuration
validator:
# If true then Kuma secrets with prefix "zone-token-signing-key" are considered as signing keys.
useSecrets: true # ENV: KUMA_MULTIZONE_GLOBAL_KDS_AUTH_ZONE_TOKEN_VALIDATOR_USE_SECRETS
# List of public keys used to validate the token. Example:
# - kid: 1
# key: |
# -----BEGIN RSA PUBLIC KEY-----
# MIIBCgKCAQEAq....
# -----END RSA PUBLIC KEY-----
# - kid: 2
# keyFile: /keys/public.pem
publicKeys: []
zone:
# Kuma Zone name used to mark the zone dataplane resources
name: "default" # ENV: KUMA_MULTIZONE_ZONE_NAME
# GlobalAddress URL of Global Kuma CP
globalAddress: # ENV KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
kds:
# RootCAFile defines a path to a file with PEM-encoded Root CA. Client will verify server by using it.
rootCaFile: # ENV: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
# If true, TLS connection to the server won't be verified.
tlsSkipVerify: false # ENV: KUMA_MULTIZONE_ZONE_KDS_TLS_SKIP_VERIFY
# MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
# In practice this means a limit on full list of one resource type.
maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_ZONE_KDS_MAX_MSG_SIZE
# MsgSendTimeout defines a timeout on sending a single KDS message.
# KDS stream between control planes is terminated if the control plane hits this timeout.
msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_ZONE_KDS_MSG_SEND_TIMEOUT
# Backoff that is executed when the zone control plane is sending the response that was previously rejected by global control plane
nackBackoff: 5s # ENV: KUMA_MULTIZONE_ZONE_KDS_NACK_BACKOFF
# Response backoff is a time Zone CP waits before sending ACK/NACK.
# This is a way to slow down Global CP from sending resources too often.
responseBackoff: 0s # ENV: KUMA_MULTIZONE_ZONE_KDS_RESPONSE_BACKOFF
# If true, Zone CP logs full DeltaDiscoveryResponse payloads received from Global CP at V(1) instead of compact summaries.
logPayloads: false # ENV: KUMA_MULTIZONE_ZONE_KDS_LOG_PAYLOADS
# Event-based snapshot watchdog timing for Zone KDS.
eventBasedWatchdog:
# How often changed resources are flushed to a KDS snapshot.
flushInterval: 5s # ENV: KUMA_MULTIZONE_ZONE_KDS_EVENT_BASED_WATCHDOG_FLUSH_INTERVAL
# How often a full KDS resync is scheduled.
fullResyncInterval: 1m # ENV: KUMA_MULTIZONE_ZONE_KDS_EVENT_BASED_WATCHDOG_FULL_RESYNC_INTERVAL
# If true, the initial full resync is delayed by a random duration up to FullResyncInterval.
delayFullResync: true # ENV: KUMA_MULTIZONE_ZONE_KDS_EVENT_BASED_WATCHDOG_DELAY_FULL_RESYNC
# Credentials Zone CP presents to Global CP. Requires grpcs scheme in globalAddress.
auth:
# Zone Token provided as a string
tokenInline: "" # ENV: KUMA_MULTIZONE_ZONE_KDS_AUTH_TOKEN_INLINE
# Path to a file with a Zone Token. The file is read on every new KDS stream, so the token can be rotated without a restart.
tokenPath: "" # ENV: KUMA_MULTIZONE_ZONE_KDS_AUTH_TOKEN_PATH
# Diagnostics configuration
diagnostics:
# Port of Diagnostic Server for checking health and readiness of the Control Plane
serverPort: 5680 # ENV: KUMA_DIAGNOSTICS_SERVER_PORT
# If true, enables https://golang.org/pkg/net/http/pprof/ debug endpoints
debugEndpoints: false # ENV: KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS
# Whether tls is enabled or not
tlsEnabled: false # ENV: KUMA_DIAGNOSTICS_TLS_ENABLED
# TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
tlsCertFile: # ENV: KUMA_DIAGNOSTICS_TLS_CERT_FILE
# TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
tlsKeyFile: # ENV: KUMA_DIAGNOSTICS_TLS_KEY_FILE
# TlsMinVersion the minimum version of TLS
tlsMinVersion: "TLSv1_2" # ENV: KUMA_DIAGNOSTICS_TLS_MIN_VERSION
# TlsMaxVersion the maximum version of TLS
tlsMaxVersion: # ENV: KUMA_DIAGNOSTICS_TLS_MAX_VERSION
# TlsCipherSuites the list of cipher suites
tlsCipherSuites: [] # ENV: KUMA_DIAGNOSTICS_TLS_CIPHER_SUITES
# Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
dpServer:
# Port of the DP Server
port: 5678 # ENV: KUMA_DP_SERVER_PORT
# TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
tlsCertFile: # ENV: KUMA_DP_SERVER_TLS_CERT_FILE
# TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
tlsKeyFile: # ENV: KUMA_DP_SERVER_TLS_KEY_FILE
# TlsMinVersion the minimum version of TLS
tlsMinVersion: "TLSv1_2" # ENV: KUMA_DP_SERVER_TLS_MIN_VERSION
# TlsMaxVersion the maximum version of TLS
tlsMaxVersion: # ENV: KUMA_DP_SERVER_TLS_MAX_VERSION
# TlsCipherSuites the list of cipher suites
tlsCipherSuites: [] # ENV: KUMA_DP_SERVER_TLS_CIPHER_SUITES
# ReadHeaderTimeout defines the amount of time DP server will be allowed
# to read request headers. The connection's read deadline is reset
# after reading the headers and the Handler can decide what is considered
# too slow for the body. If ReadHeaderTimeout is zero there is no timeout.
# The timeout is configurable as in rare cases, when Kuma CP was restarting,
# 1s which is explicitly set in other servers was insufficient and DPs
# were failing to reconnect (we observed this in Projected Service Account
# Tokens e2e tests, which started flaking a lot after introducing explicit
# 1s timeout)
readHeaderTimeout: 5s # ENV: KUMA_DP_SERVER_READ_HEADER_TIMEOUT
# GracefulShutdownTimeout should be smaller than controller-runtime's
# shutdown budget (30s upstream default) and the pod's
# terminationGracePeriodSeconds.
gracefulShutdownTimeout: 10s # ENV: KUMA_DP_SERVER_GRACEFUL_SHUTDOWN_TIMEOUT
# Authn defines an authentication configuration for the DP Server
authn:
# Configuration for data plane proxy authentication.
dpProxy:
# Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
# If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
type: ""
# Configuration of dpToken authentication method
dpToken:
# If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
enableIssuer: true
# DP Token validator configuration.
validator:
# If true then Kuma secrets with prefix "dataplane-token-signing-key-{mesh}" are considered as signing keys.
useSecrets: true
# List of public keys used to validate the token. Example:
# - kid: 1
# mesh: default
# key: |
# -----BEGIN RSA PUBLIC KEY-----
# MIIBCgKCAQEAq....
# -----END RSA PUBLIC KEY-----
# - kid: 2
# mesh: demo
# keyFile: /keys/public.pem
publicKeys: []
# If true then Envoy uses Google gRPC instead of Envoy gRPC which lets a proxy reload the auth data (service account token, dp token etc.) stored in the file without proxy restart.
enableReloadableTokens: false # ENV: KUMA_DP_SERVER_AUTHN_ENABLE_RELOADABLE_TOKENS
# Hds defines a Health Discovery Service configuration
hds:
# Enabled if true then Envoy will actively check application's ports, but only on Universal.
# On Kubernetes this feature disabled for now regardless the flag value
enabled: true # ENV: KUMA_DP_SERVER_HDS_ENABLED
# Interval for Envoy to send statuses for HealthChecks
interval: 5s # ENV: KUMA_DP_SERVER_HDS_INTERVAL
# RefreshInterval is an interval for re-generating configuration for Dataplanes connected to the Control Plane
refreshInterval: 10s # ENV: KUMA_DP_SERVER_HDS_REFRESH_INTERVAL
# Check defines a HealthCheck configuration
checkDefaults:
# Timeout is a time to wait for a health check response. If the timeout is reached the
# health check attempt will be considered a failure
timeout: 2s # ENV: KUMA_DP_SERVER_HDS_CHECK_TIMEOUT
# Interval between health checks
interval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_INTERVAL
# NoTrafficInterval is a special health check interval that is used when a cluster has
# never had traffic routed to it
noTrafficInterval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_NO_TRAFFIC_INTERVAL
# HealthyThreshold is a number of healthy health checks required before a host is marked healthy
healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
# UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
# Intercommunication CP configuration
interCp:
# Catalog configuration. Catalog keeps a record of all live CP instances in the zone.
catalog:
# Indicates an address on which other control planes can communicate with this CP.
# If empty then it's autoconfigured by taking the first IP of the nonloopback network interface.
instanceAddress: "" # ENV: KUMA_INTER_CP_CATALOG_INSTANCE_ADDRESS
# Interval on which CP will send heartbeat to a leader.
heartbeatInterval: 5s # ENV: KUMA_INTER_CP_CATALOG_HEARTBEAT_INTERVAL
# Interval on which CP will write all instances to a catalog.
writerInterval: 15s # ENV: KUMA_INTER_CP_CATALOG_WRITER_INTERVAL
# Intercommunication CP server configuration
server:
# Port of the inter-cp server
port: 5683 # ENV: KUMA_INTER_CP_SERVER_PORT
# TlsMinVersion the minimum version of TLS
tlsMinVersion: "TLSv1_2" # ENV: KUMA_INTER_CP_SERVER_TLS_MIN_VERSION
# TlsMaxVersion the maximum version of TLS
tlsMaxVersion: # ENV: KUMA_INTER_CP_SERVER_TLS_MAX_VERSION
# TlsCipherSuites the list of cipher suites
tlsCipherSuites: [] # ENV: KUMA_INTER_CP_SERVER_TLS_CIPHER_SUITES
# Access Control configuration
access:
# Type of access strategy (available values: "static")
type: static
# Configuration of static access strategy
static:
# AdminResources defines an access to admin resources (Secret/GlobalSecret)
adminResources:
# List of users that are allowed to access admin resources
users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_USERS
# List of groups that are allowed to access admin resources
groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_GROUPS
# GenerateDPToken defines an access to generating dataplane token
generateDpToken:
# List of users that are allowed to generate dataplane token
users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_USERS
# List of groups that are allowed to generate dataplane token
groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_GROUPS
# GenerateUserToken defines an access to generating user token
generateUserToken:
# List of users that are allowed to generate user token
users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_USERS
# List of groups that are allowed to generate user token
groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_GROUPS
# GenerateZoneToken defines an access to generating zone token
generateZoneToken:
# List of users that are allowed to generate zone token
users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_USERS
# List of groups that are allowed to generate zone token
groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
viewConfigDump:
# List of users that are allowed to get envoy config dump
users: [] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
# List of groups that are allowed to get envoy config dump
groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
viewStats:
# List of users that are allowed to get envoy stats
users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
# List of groups that are allowed to get envoy stats
groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
viewClusters:
# List of users that are allowed to get envoy clusters
users: [] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
# List of groups that are allowed to get envoy clusters
groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
controlPlaneMetadata:
# List of users that are allowed to get control plane metadata
users: [] # ENV: KUMA_ACCESS_STATIC_CONTROL_PLANE_METADATA_USERS
# List of groups that are allowed to get control plane metadata
groups: ["mesh-system:unauthenticated", "mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_CONTROL_PLANE_METADATA_GROUPS
# Configuration of experimental features of Kuma
experimental: {}
tracing:
openTelemetry:
# If true, enables control plane tracing using standard OTEL_EXPORTER_OTLP_* environment variables.
enabled: false # ENV: KUMA_TRACING_OPENTELEMETRY_ENABLED
# Deprecated: use enabled and OTEL_EXPORTER_OTLP_* environment variables instead.
# A non-empty endpoint also enables tracing and uses insecure gRPC, for example otel-collector:4317.
endpoint: "" # ENV: KUMA_TRACING_OPENTELEMETRY_ENDPOINT
# Configuration of the event bus which is local to one instance of CP
eventBus:
# BufferSize controls the buffer for every single event listener.
# If we go over buffer, additional delay may happen to various operation like insight recomputation or KDS.
bufferSize: 100 # ENV: KUMA_EVENT_BUS_BUFFER_SIZE
policies:
# PluginPoliciesEnabled controls which policy plugins are enabled
pluginPoliciesEnabled: # ENV: KUMA_PLUGIN_POLICIES_ENABLED
- meshaccesslogs
- meshcircuitbreakers
- meshfaultinjections
- meshhealthchecks
- meshhttproutes
- meshloadbalancingstrategies
- meshmetrics
- meshpassthroughs
- meshproxypatches
- meshratelimits
- meshretries
- meshtcproutes
- meshtimeouts
- meshtlses
- meshtraces
- meshtrafficpermissions
coreResources:
status:
# How often we compute status of MeshMultiZoneService
meshMultiZoneServiceInterval: 5s # ENV: KUMA_CORE_RESOURCES_STATUS_MESH_MULTI_ZONE_SERVICE_INTERVAL
# How often we compute status of MeshService
meshServiceInterval: 5s # ENV: KUMA_CORE_RESOURCES_STATUS_MESH_SERVICE_INTERVAL
# How often we compute status of MeshIdentity
meshIdentityInterval: 5s # ENV: KUMA_CORE_RESOURCES_STATUS_MESH_IDENTITY_INTERVAL
# How often we compute status of Workload
workloadInterval: 5s # ENV: KUMA_CORE_RESOURCES_STATUS_WORKLOAD_INTERVAL
# How often we compute status of MeshOpenTelemetryBackend
meshOpenTelemetryBackendInterval: 5s # ENV: KUMA_CORE_RESOURCES_STATUS_MESH_OPEN_TELEMETRY_BACKEND_INTERVAL
enabled: # ENV: KUMA_CORE_RESOURCES_ENABLED
- hostnamegenerators
- meshexternalservices
- meshidentities
- meshmultizoneservices
- meshopentelemetrybackends
- meshservices
- meshtrusts
- meshzoneaddresses
- workloads
# IP address management configuration
ipam:
# MeshService address management
meshService:
# CIDR for MeshService IPs
cidr: 241.0.0.0/8 # ENV: KUMA_IPAM_MESH_SERVICE_CIDR
meshExternalService:
# CIDR for MeshExternalService IPs
cidr: 242.0.0.0/8 # ENV: KUMA_IPAM_MESH_EXTERNAL_SERVICE_CIDR
meshMultiZoneService:
# CIDR for MeshMultiZoneService IPs
cidr: 243.0.0.0/8 # ENV: KUMA_IPAM_MESH_MULTI_ZONE_SERVICE_CIDR
# Interval on which Kuma will allocate new IPs for MeshServices and MeshExternalServices
allocationInterval: 5s # ENV: KUMA_IPAM_ALLOCATION_INTERVAL
# Contains a list of CIDRs which are considered internal and trusted, Envoy attaches internal only headers to requests from these clients when forwarding HTTP requests
knownInternalCIDRs: # ENV: KUMA_IPAM_KNOWN_INTERNAL_CIDRS
- 10.0.0.0/8
- 192.168.0.0/16
- 172.16.0.0/12
- fc00::/7
- fd00::/8
- 127.0.0.1/32
- ::1/128
meshService:
# How often we check whether MeshServices need to be generated from Dataplanes
# Set to 0s to disable automatic MeshService generation. Only applies to Universal.
generationInterval: 2s # ENV: KUMA_MESH_SERVICE_GENERATION_INTERVAL
# How long we wait before deleting a MeshService if all Dataplanes are gone
deletionGracePeriod: 1h # ENV: KUMA_MESH_SERVICE_DELETION_GRACE_PERIOD
# Controls propagation of user-defined labels from MeshService to generated resources.
labelPropagation:
# If true, propagate allowed user-defined labels from MeshService to generated resources.
enabled: false # ENV: KUMA_MESH_SERVICE_LABEL_PROPAGATION_ENABLED
# List of non-reserved label keys eligible for propagation. When empty and enabled is true, all non-reserved labels are propagated. Reserved kuma.io/ and k8s.kuma.io/ keys are rejected.
allowedLabelKeys: [] # ENV: KUMA_MESH_SERVICE_LABEL_PROPAGATION_ALLOWED_LABEL_KEYS
