Workload

The Workload resource represents a logical grouping of data plane proxies that share the same workload identifier. Kuma automatically creates and manages this resource on Kubernetes when data plane proxies reference a workload via the kuma.io/workload annotation.

Use Workload resources to:

• Monitor connected and healthy data plane proxies per workload
• Group data plane proxies by workload identifier for observability
• Integrate with MeshIdentity for workload-based identity assignment

Status fields

The Workload status provides statistics about associated data plane proxies:

Examples

Workload created automatically

When you deploy a pod with the kuma.io/workload annotation, Kuma automatically creates a Workload resource:

apiVersion: v1
kind: Pod
metadata:
  name: demo-app
  annotations:
    kuma.io/workload: demo-workload

apiVersion: kuma.io/v1alpha1
kind: Workload
metadata:
  name: demo-workload
  namespace: default
  labels:
    kuma.io/mesh: default
    kuma.io/managed-by: k8s-controller
spec: {}
status:
  dataplaneProxies:
    connected: 3
    healthy: 3
    total: 3

Workload with MeshIdentity

Use Workload with MeshIdentity to assign identity based on the workload identifier:

apiVersion: kuma.io/v1alpha1
kind: MeshIdentity
metadata:
  name: workload-identity
  namespace: {{site.mesh_namespace}}
  labels:
    kuma.io/mesh: default
spec:
  type: spiffe
  identityRef:
    type: workload
    tags:
      kuma.io/workload: demo-workload
  config:
    trustDomain: example.com
    path:
      template: /workload/{{ .Workload }}

Checking Workload status

Monitor workload health using kubectl:

kubectl get workloads -n default

NAME            MESH      AGE
demo-workload   default   5m

kubectl get workload demo-workload -n default -o yaml

Workload label management

The kuma.io/workload label is automatically managed by Kuma:

• Automatic assignment: The workload label is automatically derived from pod labels (configurable via runtime.kubernetes.workloadLabels in the control plane configuration)
• Manual assignment: Set via the kuma.io/workload annotation on pods
• Protection: Cannot be manually set as a label on pods; Kuma will reject pod creation/updates with this label

Limitations

• Kubernetes only: Workload resources are only available on Kubernetes. Universal deployments do not support this resource.
• Single mesh: All data plane proxies referencing a workload must belong to the same mesh.
• Automatic lifecycle: Cannot be manually created or modified. The resource is fully managed by the k8s-controller.

See also

• MeshIdentity
• Data plane proxy configuration
• Data plane proxy authentication

All options