kuma-cp configuration reference

Kuma CP configuration

  1. # Environment type. Available values are: "kubernetes" or "universal"
  2. environment: universal # ENV: KUMA_ENVIRONMENT
  3. # Mode in which Kuma CP is running. Available values are: "standalone", "global", "zone"
  4. mode: standalone # ENV: KUMA_MODE
  6. # Resource Store configuration
  7. store:
  8.   # Type of Store used in the Control Plane. Available values are: "kubernetes", "postgres" or "memory"
  9.   type: memory # ENV: KUMA_STORE_TYPE
  11.   # Kubernetes Store configuration (used when store.type=kubernetes)
  12.   kubernetes:
  13.     # Namespace where Control Plane is installed to.
  14.     systemNamespace: kuma-system # ENV: KUMA_STORE_KUBERNETES_SYSTEM_NAMESPACE
  16.   # Postgres Store configuration (used when store.type=postgres)
  17.   postgres:
  18.     # Host of the Postgres DB
  19.     host: 127.0.0.1 # ENV: KUMA_STORE_POSTGRES_HOST
  20.     # Port of the Postgres DB
  21.     port: 15432 # ENV: KUMA_STORE_POSTGRES_PORT
  22.     # User of the Postgres DB
  23.     user: kuma # ENV: KUMA_STORE_POSTGRES_USER
  24.     # Password of the Postgres DB
  25.     password: kuma # ENV: KUMA_STORE_POSTGRES_PASSWORD
  26.     # Database name of the Postgres DB
  27.     dbName: kuma # ENV: KUMA_STORE_POSTGRES_DB_NAME
  28.     # Driver to use, one of: pgx, postgres
  29.     driverName: pgx # ENV: KUMA_STORE_POSTGRES_DRIVER_NAME
  30.     # Connection Timeout to the DB in seconds
  31.     connectionTimeout: 5 # ENV: KUMA_STORE_POSTGRES_CONNECTION_TIMEOUT
  32.     # MaxConnectionLifetime (applied only when driverName=pgx) is the duration since creation after which a connection will be automatically closed
  33.     maxConnectionLifetime: "1h" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME
  34.     # MaxConnectionLifetimeJitter (applied only when driverName=pgx) is the duration after maxConnectionLifetime to randomly decide to close a connection.
  35.     # This helps prevent all connections from being closed at the exact same time, starving the pool.
  36.     maxConnectionLifetimeJitter: "1m" # ENV: KUMA_STORE_POSTGRES_MAX_CONNECTION_LIFETIME_JITTER
  37.     # HealthCheckInterval (applied only when driverName=pgx) is the duration between checks of the health of idle connections.
  38.     healthCheckInterval: "30s" # ENV: KUMA_STORE_POSTGRES_HEALTH_CHECK_INTERVAL
  39.     # MinOpenConnections (applied only when driverName=pgx) is the minimum number of open connections to the database
  40.     minOpenConnections: 0 # ENV: KUMA_STORE_POSTGRES_MIN_OPEN_CONNECTIONS
  41.     # MaxOpenConnections is the maximum number of open connections to the database
  42.     # `0` value means number of open connections is unlimited
  43.     maxOpenConnections: 50 # ENV: KUMA_STORE_POSTGRES_MAX_OPEN_CONNECTIONS
  44.     # MaxIdleConnections (applied only when driverName=postgres) is the maximum number of connections in the idle connection pool
  45.     # <0 value means no idle connections and 0 means default max idle connections
  46.     maxIdleConnections: 50  # ENV: KUMA_STORE_POSTGRES_MAX_IDLE_CONNECTIONS
  47.     # MaxListQueryElements defines maximum number of changed elements before requesting full list of elements from the store.
  48.     maxListQueryElements: 0 # ENV: KUMA_STORE_POSTGRES_MAX_LIST_QUERY_ELEMENTS
  49.     # TLS settings
  50.     tls:
  51.       # Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  52.       mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  53.       # Path to TLS Certificate of the client. Required when server has METHOD=cert
  54.       certPath: # ENV: KUMA_STORE_POSTGRES_TLS_CERT_PATH
  55.       # Path to TLS Key of the client. Required when server has METHOD=cert
  56.       keyPath: # ENV: KUMA_STORE_POSTGRES_TLS_KEY_PATH
  57.       # Path to the root certificate. Used in verifyCa and verifyFull modes.
  58.       caPath: # ENV: KUMA_STORE_POSTGRES_TLS_ROOT_CERT_PATH
  59.     # MinReconnectInterval (applied only when driverName=postgres) controls the duration to wait before trying to
  60.     # re-establish the database connection after connection loss. After each
  61.     # consecutive failure this interval is doubled, until MaxReconnectInterval
  62.     # is reached. Successfully completing the connection establishment procedure
  63.     # resets the interval back to MinReconnectInterval.
  64.     minReconnectInterval: "10s" # ENV: KUMA_STORE_POSTGRES_MIN_RECONNECT_INTERVAL
  65.     # MaxReconnectInterval (applied only when driverName=postgres) controls the maximum possible duration to wait before trying
  66.     # to re-establish the database connection after connection loss.
  67.     maxReconnectInterval: "60s" # ENV: KUMA_STORE_POSTGRES_MAX_RECONNECT_INTERVAL
  68.     # ReadReplica is a setting for a DB replica used only for read queries
  69.     readReplica:
  70.       # Host of the Postgres DB read replica. If not set, read replica is not used.
  71.       host: "" # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_HOST
  72.       # Port of the Postgres DB read replica
  73.       port: 5432 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_PORT
  74.       # Ratio in [0-100] range. How many SELECT queries (out of 100) will use read replica.
  75.       ratio: 100 # ENV: KUMA_STORE_POSTGRES_READ_REPLICA_RATIO
  77.   # Cache for read only operations. This cache is local to the instance of the control plane.
  78.   cache:
  79.     # If true then cache is enabled
  80.     enabled: true # ENV: KUMA_STORE_CACHE_ENABLED
  81.     # Expiration time for elements in cache.
  82.     expirationTime: 1s # ENV: KUMA_STORE_CACHE_EXPIRATION_TIME
  84.   # Upsert (get and update) configuration
  85.   upsert:
  86.     # Base time for exponential backoff on upsert operations when retry is enabled
  87.     conflictRetryBaseBackoff: 200ms # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_BASE_BACKOFF
  88.     # Max retries on upsert (get and update) operation when retry is enabled
  89.     conflictRetryMaxTimes: 10 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_MAX_TIMES
  90.     # Percentage of jitter. For example: if backoff is 20s, and this value 10, the backoff will be between 18s and 22s.
  91.     conflictRetryJitterPercent: 30 # ENV: KUMA_STORE_UPSERT_CONFLICT_RETRY_JITTER_PERCENT
  93.   # If true, skips validation of resource delete.
  94.   # For example you don't have to delete all Dataplane objects before you delete a Mesh
  95.   unsafeDelete: false # ENV: KUMA_STORE_UNSAFE_DELETE
  97. # Configuration of Bootstrap Server, which provides bootstrap config to Dataplanes
  98. bootstrapServer:
  99.   # Parameters of bootstrap configuration
  100.   params:
  101.     # Address of Envoy Admin
  102.     adminAddress: 127.0.0.1 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ADDRESS
  103.     # Port of Envoy Admin
  104.     adminPort: 9901 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_PORT
  105.     # Path to access log file of Envoy Admin
  106.     adminAccessLogPath: /dev/null # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_ADMIN_ACCESS_LOG_PATH
  107.     # Host of XDS Server. By default it is the same host as the one used by kuma-dp to connect to the control plane
  108.     xdsHost: "" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_HOST
  109.     # Port of XDS Server. By default it is autoconfigured from KUMA_DP_SERVER_PORT
  110.     xdsPort: 0 # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_PORT
  111.     # Connection timeout to the XDS Server
  112.     xdsConnectTimeout: 1s # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_XDS_CONNECT_TIMEOUT
  114. #  Monitoring Assignment Discovery Service (MADS) server configuration
  115. monitoringAssignmentServer:
  116.   # Port of a gRPC server that serves Monitoring Assignment Discovery Service (MADS).
  117.   port: 5676 # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_PORT
  118.   # Which MADS API versions to serve
  119.   apiVersions: ["v1"] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_API_VERSIONS
  120.   # Interval for re-generating monitoring assignments for clients connected to the Control Plane.
  121.   assignmentRefreshInterval: 1s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_ASSIGNMENT_REFRESH_INTERVAL
  122.   # The default timeout for a single fetch-based discovery request, if not specified
  123.   defaultFetchTimeout: 30s # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_DEFAULT_FETCH_TIMEOUT
  124.   # Path to TLS certificate file
  125.   tlsCertFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CERT_FILE
  126.   # Path to TLS key file
  127.   tlsKeyFile: "" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_KEY_FILE
  128.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  129.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MIN_VERSION
  130.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  131.   tlsMaxVersion: # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_MAX_VERSION
  132.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  133.   tlsCipherSuites: [] # ENV: KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_CIPHER_SUITES
  135. # Envoy XDS server configuration
  136. xdsServer:
  137.   # Interval for re-genarting configuration for Dataplanes connected to the Control Plane
  138.   dataplaneConfigurationRefreshInterval: 1s # ENV: KUMA_XDS_SERVER_DATAPLANE_CONFIGURATION_REFRESH_INTERVAL
  139.   # Interval for flushing status of Dataplanes connected to the Control Plane
  140.   dataplaneStatusFlushInterval: 10s # ENV: KUMA_XDS_SERVER_DATAPLANE_STATUS_FLUSH_INTERVAL
  141.   # Backoff that is executed when Control Plane is sending the response that was previously rejected by Dataplane
  142.   nackBackoff: 5s # ENV: KUMA_XDS_SERVER_NACK_BACKOFF
  143.   # A delay between proxy terminating a connection and the CP trying to deregister the proxy.
  144.   # It is used only in universal mode when you use direct lifecycle.
  145.   # Setting this setting to 0s disables the delay.
  146.   # Disabling this may cause race conditions that one instance of CP removes proxy object
  147.   # while proxy is connected to another instance of the CP.
  148.   dataplaneDeregistrationDelay: 10s # ENV: KUMA_XDS_DATAPLANE_DEREGISTRATION_DELAY
  150. # API Server configuration
  151. apiServer:
  152.   # HTTP configuration of the API Server
  153.   http:
  154.     # If true then API Server will be served on HTTP
  155.     enabled: true # ENV: KUMA_API_SERVER_HTTP_ENABLED
  156.     # Network interface on which HTTP API Server will be exposed
  157.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTP_INTERFACE
  158.     # Port of the API Server
  159.     port: 5681 # ENV: KUMA_API_SERVER_HTTP_PORT
  160.   # HTTPS configuration of the API Server
  161.   https:
  162.     # If true then API Server will be served on HTTPS
  163.     enabled: true # ENV: KUMA_API_SERVER_HTTPS_ENABLED
  164.     # Network interface on which HTTPS API Server will be exposed
  165.     interface: 0.0.0.0 # ENV: KUMA_API_SERVER_HTTPS_INTERFACE
  166.     # Port of the HTTPS API Server
  167.     port: 5682 # ENV: KUMA_API_SERVER_HTTPS_PORT
  168.     # Path to TLS certificate file. Autoconfigured from KUMA_GENERAL_TLS_CERT_FILE if empty
  169.     tlsCertFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_CERT_FILE
  170.     # Path to TLS key file. Autoconfigured from KUMA_GENERAL_TLS_KEY_FILE if empty
  171.     tlsKeyFile: "" # ENV: KUMA_API_SERVER_HTTPS_TLS_KEY_FILE
  172.     # Path to the CA certificate which is used to sign client certificates. It is used only for verifying client certificates.
  173.     tlsCaFile: "" # ENV: KUMA_API_SERVER_HTTPS_CLIENT_CERTS_CA_FILE
  174.     # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  175.     tlsMinVersion: "TLSv1_2" # ENV: KUMA_API_SERVER_HTTPS_TLS_MIN_VERSION
  176.     # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  177.     tlsMaxVersion: # ENV: KUMA_API_SERVER_HTTPS_TLS_MAX_VERSION
  178.     # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  179.     tlsCipherSuites: [] # ENV: KUMA_API_SERVER_HTTPS_TLS_CIPHER_SUITES
  180.     # If true, then HTTPS connection will require client cert.
  181.     requireClientCert: false # ENV: KUMA_API_SERVER_HTTPS_REQUIRE_CLIENT_CERT
  182.   # Authentication configuration for administrative endpoints like Dataplane Token or managing Secrets
  183.   auth:
  184.     # Directory of authorized client certificates (only validate in HTTPS)
  185.     clientCertsDir: "" # ENV: KUMA_API_SERVER_AUTH_CLIENT_CERTS_DIR
  186.   # Api Server Authentication configuration
  187.   authn:
  188.     # Type of authentication mechanism (available values: "adminClientCerts", "tokens")
  189.     type: tokens # ENV: KUMA_API_SERVER_AUTHN_TYPE
  190.     # Localhost is authenticated as a user admin of group admin
  191.     localhostIsAdmin: true # ENV: KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN
  192.     # Configuration for tokens authentication
  193.     tokens:
  194.       # If true then User Token with name admin and group admin will be created and placed as admin-user-token Kuma secret
  195.       bootstrapAdminToken: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_BOOTSTRAP_ADMIN_TOKEN
  196.       # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  197.       enableIssuer: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_ENABLE_ISSUER
  198.       # Token validator configuration
  199.       validator:
  200.         # If true then Kuma secrets with prefix "user-token-signing-key" are considered as signing keys.
  201.         useSecrets: true # ENV: KUMA_API_SERVER_AUTHN_TOKENS_VALIDATOR_USE_SECRETS
  202.         # List of public keys used to validate the token. Example:
  203.         # - kid: 1
  204.         #   key: |
  205.         #     -----BEGIN RSA PUBLIC KEY-----
  206.         #     MIIBCgKCAQEAq....
  207.         #     -----END RSA PUBLIC KEY-----
  208.         # - kid: 2
  209.         #   keyFile: /keys/public.pem
  210.         publicKeys: []
  212.   # If true, then API Server will operate in read only mode (serving GET requests)
  213.   readOnly: false # ENV: KUMA_API_SERVER_READ_ONLY
  214.   # Allowed domains for Cross-Origin Resource Sharing. The value can be either domain or regexp
  215.   corsAllowedDomains:
  216.     - ".*" # ENV: KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
  217.   # Can be used if you use a reverse proxy
  218.   rootUrl: "" # ENV: KUMA_API_SERVER_ROOT_URL
  219.   # The path to serve the API from
  220.   basePath: "/" # ENV: KUMA_API_SERVER_BASE_PATH
  221.   # configuration specific to the GUI
  222.   gui:
  223.     # Whether to serve the gui (if mode=zone this has no effect)
  224.     enabled: true # ENV: KUMA_API_SERVER_GUI_ENABLED
  225.     # Can be used if you use a reverse proxy or want to serve the gui from a different path
  226.     rootUrl: "" # ENV: KUMA_API_SERVER_GUI_ROOT_URL
  227.     # The path to serve the GUI from
  228.     basePath: "/gui" # ENV: KUMA_API_SERVER_GUI_BASE_PATH
  230. # Environment-specific configuration
  231. runtime:
  232.   # Kubernetes-specific configuration
  233.   kubernetes:
  234.     # Service name of the Kuma Control Plane. It is used to point Kuma DP to proper URL.
  235.     controlPlaneServiceName: kuma-control-plane # ENV: KUMA_RUNTIME_KUBERNETES_CONTROL_PLANE_SERVICE_NAME
  236.     # Name of Service Account that is used to run the Control Plane
  237.     serviceAccountName: "system:serviceaccount:kuma-system:kuma-control-plane" # ENV: KUMA_RUNTIME_KUBERNETES_SERVICE_ACCOUNT_NAME
  238.     # Taint controller that prevents applications from scheduling until CNI is ready.
  239.     nodeTaintController:
  240.       # If true enables the taint controller.
  241.       enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_ENABLED
  242.       # Value of app label on CNI pod that indicates if node can be ready.
  243.       cniApp: "" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_APP
  244.       # Value of CNI namespace.
  245.       cniNamespace: "kube-system" # ENV: KUMA_RUNTIME_KUBERNETES_NODE_TAINT_CONTROLLER_CNI_NAMESPACE
  246.     # Admission WebHook Server configuration
  247.     admissionServer:
  248.       # Address the Admission WebHook Server should be listening on
  249.       address: # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_ADDRESS
  250.       # Port the Admission WebHook Server should be listening on
  251.       port: 5443 # ENV: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT
  252.       # Directory with a TLS cert and private key for the Admission WebHook Server.
  253.       # TLS certificate file must be named `tls.crt`.
  254.       # TLS key file must be named `tls.key`.
  255.       certDir: # ENV: kuma_runtime_kubernetes_admission_server_cert_dir
  256.     # Injector defines configuration of a Kuma Sidecar Injector.
  257.     injector:
  258.       # if true runs kuma-cp in CNI compatible mode
  259.       cniEnabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
  260.       # list of exceptions for Kuma injection
  261.       exceptions:
  262.         # a map of labels for exception. If pod matches label with given value Kuma won't be injected. Specify '*' to match any value.
  263.         labels:
  264.           openshift.io/build.name: "*"
  265.           openshift.io/deployer-pod-for.name: "*"
  266.       # VirtualProbesEnabled enables automatic converting HttpGet probes to virtual. Virtual probe
  267.       #    serves on sub-path of insecure port 'virtualProbesPort',
  268.       #    i.e :8080/health/readiness -> :9000/8080/health/readiness where 9000 is virtualProbesPort
  269.       virtualProbesEnabled: true # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED
  270.       # VirtualProbesPort is a port for exposing virtual probes which are not secured by mTLS
  271.       virtualProbesPort: 9000 # ENV: KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT
  272.       # CaCertFile is CA certificate which will be used to verify a connection to the control plane.
  273.       caCertFile:  # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
  274.       # SidecarContainer defines configuration of the Kuma sidecar container.
  275.       sidecarContainer:
  276.         # Image name.
  277.         image: kuma/kuma-dp:latest # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_IMAGE
  278.         # Redirect port for inbound traffic.
  279.         redirectPortInbound: 15006 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND
  280.         # Redirect port for inbound traffic.
  281.         redirectPortInboundV6: 15010 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_INBOUND_V6
  282.         # Redirect port for outbound traffic.
  283.         redirectPortOutbound: 15001 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_REDIRECT_PORT_OUTBOUND
  284.         # User ID.
  285.         uid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_UID
  286.         # Group ID.
  287.         gid: 5678 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_GUI
  288.         # Drain time for listeners.
  289.         drainTime: 30s # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_DRAIN_TIME
  290.         # Readiness probe.
  291.         readinessProbe:
  292.           # Number of seconds after the container has started before readiness probes are initiated.
  293.           initialDelaySeconds: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_INITIAL_DELAY_SECONDS
  294.           # Number of seconds after which the probe times out.
  295.           timeoutSeconds: 3 # ENV : KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_TIMEOUT_SECONDS
  296.           # Number of seconds after which the probe times out.
  297.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_PERIOD_SECONDS
  298.           # Minimum consecutive successes for the probe to be considered successful after having failed.
  299.           successThreshold: 1 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_SUCCESS_THRESHOLD
  300.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  301.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_READINESS_PROBE_FAILURE_THRESHOLD
  302.         # Liveness probe.
  303.         livenessProbe:
  304.           # Number of seconds after the container has started before liveness probes are initiated.
  305.           initialDelaySeconds: 60 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_INITIAL_DELAY_SECONDS
  306.           # Number of seconds after which the probe times out.
  307.           timeoutSeconds: 3 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_TIMEOUT_SECONDS
  308.           # How often (in seconds) to perform the probe.
  309.           periodSeconds: 5 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_PERIOD_SECONDS
  310.           # Minimum consecutive failures for the probe to be considered failed after having succeeded.
  311.           failureThreshold: 12 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_LIVENESS_PROBE_FAILURE_THRESHOLD
  312.         # Compute resource requirements.
  313.         resources:
  314.           # Minimum amount of compute resources required.
  315.           requests:
  316.             # CPU, in cores. (500m = .5 cores)
  317.             cpu: 50m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_CPU
  318.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  319.             memory: 64Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_REQUESTS_MEMORY
  320.           # Maximum amount of compute resources allowed.
  321.           limits:
  322.             # CPU, in cores. (500m = .5 cores)
  323.             cpu: 1000m # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_CPU
  324.             # Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
  325.             memory: 512Mi # ENV: KUMA_INJECTOR_SIDECAR_CONTAINER_RESOURCES_LIMITS_MEMORY
  326.         # Additional environment variables that can be placed on Kuma DP sidecar
  327.         envVars: {} # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_ENV_VARS
  328.         # If true, it enables a postStart script that waits until Envoy is ready.
  329.         # With the current Kubernetes behavior, any other container in the Pod will wait until the script is complete.
  330.         waitForDataplaneReady: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_SIDECAR_CONTAINER_WAIT_FOR_DATAPLANE_READY
  331.       # InitContainer defines configuration of the Kuma init container
  332.       initContainer:
  333.         # Image name.
  334.         image: kuma/kuma-init:latest # ENV: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
  335.       # ContainerPatches is an optional list of ContainerPatch names which will be applied
  336.       # to init and sidecar containers if workload is not annotated with a patch list.
  337.       containerPatches: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_CONTAINER_PATCHES
  338.       # Configuration for a traffic that is intercepted by sidecar
  339.       sidecarTraffic:
  340.         # List of inbound ports that will be excluded from interception.
  341.         # This setting is applied on every pod unless traffic.kuma.io/exclude-inbound-ports annotation is specified on Pod.
  342.         excludeInboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_INBOUND_PORTS
  343.         # List of outbound ports that will be excluded from interception.
  344.         # This setting is applied on every pod unless traffic.kuma.io/exclude-oubound-ports annotation is specified on Pod.
  345.         excludeOutboundPorts: [ ] # ENV: KUMA_RUNTIME_KUBERNETES_SIDECAR_TRAFFIC_EXCLUDE_OUTBOUND_PORTS
  346.       builtinDNS:
  347.         # Use the built-in DNS
  348.         enabled: true # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_ENABLED
  349.         # Redirect port for DNS
  350.         port: 15053 # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_PORT
  351.       # EBPF defines configuration for the ebpf, when transparent proxy is marked to be
  352.       # installed using ebpf instead of iptables
  353.       ebpf:
  354.         # Install transparent proxy using ebpf
  355.         enabled: false # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_ENABLED
  356.         # Name of the environmental variable which will include IP address of the pod
  357.         instanceIPEnvVarName: INSTANCE_IP # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_INSTANCE_IP_ENV_VAR_NAME
  358.         # Path where BPF file system will be mounted for pinning ebpf programs and maps
  359.         bpffsPath: /sys/fs/bpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
  360.         # Path of mounted cgroup2
  361.         cgroupPath: /sys/fs/cgroup # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH
  362.         # Name of the network interface which should be used to attach to it TC programs
  363.         # when not specified, we will try to automatically determine it
  364.         tcAttachIface: "" # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_TC_ATTACH_IFACE
  365.         # Path where compiled eBPF programs are placed
  366.         programsSourcePath: /kuma/ebpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_PROGRAMS_SOURCE_PATH
  367.     marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
  368.     # Kubernetes's resources reconciliation concurrency configuration
  369.     controllersConcurrency:
  370.       # PodController defines maximum concurrent reconciliations of Pod resources
  371.       # Default value 10. If set to 0 kube controller-runtime default value of 1 will be used.
  372.       podController: 10 # ENV: KUMA_RUNTIME_KUBERNETES_CONTROLLERS_CONCURRENCY_POD_CONTROLLER
  373.     # Kubernetes client configuration
  374.     clientConfig:
  375.       # Qps defines maximum requests kubernetes client is allowed to make per second.
  376.       # Default value 100. If set to 0 kube-client default value of 5 will be used.
  377.       qps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_QPS
  378.       # BurstQps defines maximum burst requests kubernetes client is allowed to make per second
  379.       # Default value 100. If set to 0 kube-client default value of 10 will be used.
  380.       burstQps: 100 # ENV: KUMA_RUNTIME_KUBERNETES_CLIENT_CONFIG_BURST_QPS
  381.     leaderElection:
  382.       # LeaseDuration is the duration that non-leader candidates will
  383.       # wait to force acquire leadership. This is measured against time of
  384.       # last observed ack. Default is 15 seconds.
  385.       leaseDuration: 15s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_LEASE_DURATION
  386.       # RenewDeadline is the duration that the acting controlplane will retry
  387.       # refreshing leadership before giving up. Default is 10 seconds.
  388.       renewDeadline: 10s # ENV: KUMA_RUNTIME_KUBERNETES_LEADER_ELECTION_RENEW_DEADLINE
  389.   # Universal-specific configuration
  390.   universal:
  391.     # DataplaneCleanupAge defines how long Dataplane should be offline to be cleaned up by GC
  392.     dataplaneCleanupAge: 72h0m0s # ENV: KUMA_RUNTIME_UNIVERSAL_DATAPLANE_CLEANUP_AGE
  394. # Default Kuma entities configuration
  395. defaults:
  396.   # If true, it skips creating the default Mesh
  397.   skipMeshCreation: false # ENV: KUMA_DEFAULTS_SKIP_MESH_CREATION
  398.   # If true, it skips creating the default tenant resources
  399.   skipTenantResources: false # ENV: KUMA_DEFAULTS_SKIP_TENANT_RESOURCES
  401. # Metrics configuration
  402. metrics:
  403.   dataplane:
  404.     # How many latest subscriptions will be stored in DataplaneInsight object, if equals 0 then unlimited
  405.     subscriptionLimit: 2 # ENV: KUMA_METRICS_DATAPLANE_SUBSCRIPTION_LIMIT
  406.     # How long data plane proxy can stay Online without active xDS connection
  407.     idleTimeout: 5m # ENV: KUMA_METRICS_DATAPLANE_IDLE_TIMEOUT
  408.   zone:
  409.     # How many latest subscriptions will be stored in ZoneInsights object, if equals 0 then unlimited
  410.     subscriptionLimit: 10 # ENV: KUMA_METRICS_ZONE_SUBSCRIPTION_LIMIT
  411.     # How long zone can stay Online without active KDS connection
  412.     idleTimeout: 5m # ENV: KUMA_METRICS_ZONE_IDLE_TIMEOUT
  413.     # Compact finished metrics (do not store config and details of KDS exchange).
  414.     compactFinishedSubscriptions: false # ENV: KUMA_METRICS_ZONE_COMPACT_FINISHED_SUBSCRIPTIONS
  415.   mesh:
  416.     # Minimum time between 2 refresh of insights
  417.     minResyncInterval: 1s # ENV: KUMA_METRICS_MESH_MIN_RESYNC_INTERVAL
  418.     # time between triggering a full refresh of all the insights
  419.     fullResyncInterval: 20s # ENV: KUMA_METRICS_MESH_FULL_RESYNC_INTERVAL
  420.     # the size of the buffer between event creation and processing
  421.     bufferSize: 1000 # ENV: KUMA_METRICS_MESH_BUFFER_SIZE
  422.     # the number of workers that process metrics events
  423.     eventProcessors: 1 # ENV: KUMA_METRICS_MESH_EVENT_PROCESSORS
  424.   controlPlane:
  425.     # If true metrics show number of resources in the system should be reported
  426.     reportResourcesCount: true # ENV: KUMA_METRICS_CONTROL_PLANE_REPORT_RESOURCES_COUNT
  428. # Reports configuration
  429. reports:
  430.   # If true then usage stats will be reported
  431.   enabled: false # ENV: KUMA_REPORTS_ENABLED
  433. # General configuration
  434. general:
  435.   # dnsCacheTTL represents duration for how long Kuma CP will cache result of resolving dataplane's domain name
  436.   dnsCacheTTL: 10s # ENV: KUMA_GENERAL_DNS_CACHE_TTL
  437.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert that will be used across all the Kuma Servers.
  438.   tlsCertFile: # ENV: KUMA_GENERAL_TLS_CERT_FILE
  439.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key that will be used across all the Kuma Servers.
  440.   tlsKeyFile: # ENV: KUMA_GENERAL_TLS_KEY_FILE
  441.   # TlsMinVersion the minimum version of TLS used across all the Kuma Servers.
  442.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_GENERAL_TLS_MIN_VERSION
  443.   # TlsMaxVersion the maximum version of TLS used across all the Kuma Servers.
  444.   tlsMaxVersion: # ENV: KUMA_GENERAL_TLS_MAX_VERSION
  445.   # TlsCipherSuites the list of cipher suites to be used across all the Kuma Servers.
  446.   tlsCipherSuites: [] # ENV: KUMA_GENERAL_TLS_CIPHER_SUITES
  447.   # WorkDir defines a path to the working directory
  448.   # Kuma stores in this directory autogenerated entities like certificates.
  449.   # If empty then the working directory is $HOME/.kuma
  450.   workDir: "" # ENV: KUMA_GENERAL_WORK_DIR
  452. # DNS Server configuration
  453. dnsServer:
  454.   # The domain that the server will resolve the services for
  455.   domain: "mesh" # ENV: KUMA_DNS_SERVER_DOMAIN
  456.   # The CIDR range used to allocate
  457.   CIDR: "240.0.0.0/4" # ENV: KUMA_DNS_SERVER_CIDR
  458.   # Will create a service "<kuma.io/service>.mesh" dns entry for every service.
  459.   serviceVipEnabled: true # ENV: KUMA_DNS_SERVER_SERVICE_VIP_ENABLED
  460.   # The port to use along with the `<kuma.io/service>.mesh` dns entry
  461.   serviceVipPort: 80 # ENV: KUMA_DNS_SERVICE_SERVICE_VIP_PORT
  463. # Multizone mode
  464. multizone:
  465.   global:
  466.     kds:
  467.       # Port of a gRPC server that serves Kuma Discovery Service (KDS).
  468.       grpcPort: 5685 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_GRPC_PORT
  469.       # Interval for refreshing state of the world
  470.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_REFRESH_INTERVAL
  471.       # Interval for flushing Zone Insights (stats of multi-zone communication)
  472.       zoneInsightFlushInterval: 10s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_ZONE_INSIGHT_FLUSH_INTERVAL
  473.       # TlsEnabled turns on TLS for KDS
  474.       tlsEnabled: true # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_ENABLED
  475.       # TlsCertFile defines a path to a file with PEM-encoded TLS cert.
  476.       tlsCertFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE
  477.       # TlsKeyFile defines a path to a file with PEM-encoded TLS key.
  478.       tlsKeyFile: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE
  479.       # TlsMinVersion the minimum version of TLS
  480.       tlsMinVersion: "TLSv1_2" # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MIN_VERSION
  481.       # TlsMaxVersion the maximum version of TLS
  482.       tlsMaxVersion: # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_MAX_VERSION
  483.       # TlsCipherSuites the list of cipher suites
  484.       tlsCipherSuites: [] # ENV: KUMA_MULTIZONE_GLOBAL_KDS_TLS_CIPHER_SUITES
  485.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  486.       # In practice this means a limit on full list of one resource type.
  487.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MAX_MSG_SIZE
  488.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  489.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  490.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_MSG_SEND_TIMEOUT
  491.       # Backoff that is executed when the global control plane is sending the response that was previously rejected by zone control plane
  492.       nackBackoff: 5s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_NACK_BACKOFF
  493.       # DisableSOTW if true doesn't expose SOTW version of KDS. Default: false
  494.       disableSOTW: false # ENV: KUMA_MULTIZONE_GLOBAL_KDS_DISABLE_SOTW
  495.       # Response backoff is a time Global CP waits before sending ACK/NACK.
  496.       # This is a way to slow down Zone CP from sending resources too often.
  497.       responseBackoff: 0s # ENV: KUMA_MULTIZONE_GLOBAL_KDS_RESPONSE_BACKOFF
  498.   zone:
  499.     # Kuma Zone name used to mark the zone dataplane resources
  500.     name: "" # ENV: KUMA_MULTIZONE_ZONE_NAME
  501.     # GlobalAddress URL of Global Kuma CP
  502.     globalAddress: # ENV KUMA_MULTIZONE_ZONE_GLOBAL_ADDRESS
  503.     kds:
  504.       # Interval for refreshing state of the world
  505.       refreshInterval: 1s # ENV: KUMA_MULTIZONE_ZONE_KDS_REFRESH_INTERVAL
  506.       # RootCAFile defines a path to a file with PEM-encoded Root CA. Client will verify server by using it.
  507.       rootCaFile: # ENV: KUMA_MULTIZONE_ZONE_KDS_ROOT_CA_FILE
  508.       # If true, TLS connection to the server won't be verified.
  509.       tlsSkipVerify: false # ENV: KUMA_MULTIZONE_ZONE_KDS_TLS_SKIP_VERIFY
  510.       # MaxMsgSize defines a maximum size of the message in bytes that is exchanged using KDS.
  511.       # In practice this means a limit on full list of one resource type.
  512.       maxMsgSize: 10485760 # ENV: KUMA_MULTIZONE_ZONE_KDS_MAX_MSG_SIZE
  513.       # MsgSendTimeout defines a timeout on sending a single KDS message.
  514.       # KDS stream between control planes is terminated if the control plane hits this timeout.
  515.       msgSendTimeout: 60s # ENV: KUMA_MULTIZONE_ZONE_KDS_MSG_SEND_TIMEOUT
  516.       # Backoff that is executed when the zone control plane is sending the response that was previously rejected by global control plane
  517.       nackBackoff: 5s # ENV: KUMA_MULTIZONE_ZONE_KDS_NACK_BACKOFF
  518.       # Response backoff is a time Zone CP waits before sending ACK/NACK.
  519.       # This is a way to slow down Global CP from sending resources too often.
  520.       responseBackoff: 0s # ENV: KUMA_MULTIZONE_ZONE_KDS_RESPONSE_BACKOFF
  522. # Diagnostics configuration
  523. diagnostics:
  524.   # Port of Diagnostic Server for checking health and readiness of the Control Plane
  525.   serverPort: 5680 # ENV: KUMA_DIAGNOSTICS_SERVER_PORT
  526.   # If true, enables https://golang.org/pkg/net/http/pprof/ debug endpoints
  527.   debugEndpoints: false # ENV: KUMA_DIAGNOSTICS_DEBUG_ENDPOINTS
  528.   # Whether tls is enabled or not
  529.   tlsEnabled: false # ENV: KUMA_DIAGNOSTICS_TLS_ENABLED
  530.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  531.   tlsCertFile: # ENV: KUMA_DIAGNOSTICS_TLS_CERT_FILE
  532.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  533.   tlsKeyFile: # ENV: KUMA_DIAGNOSTICS_TLS_KEY_FILE
  534.   # TlsMinVersion the minimum version of TLS
  535.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_DIAGNOSTICS_TLS_MIN_VERSION
  536.   # TlsMaxVersion the maximum version of TLS
  537.   tlsMaxVersion: # ENV: KUMA_DIAGNOSTICS_TLS_MAX_VERSION
  538.   # TlsCipherSuites the list of cipher suites
  539.   tlsCipherSuites: [] # ENV: KUMA_DIAGNOSTICS_TLS_CIPHER_SUITES
  541. # Dataplane Server configuration that servers API like Bootstrap/XDS for the Dataplane.
  542. dpServer:
  543.   # Port of the DP Server
  544.   port: 5678 # ENV: KUMA_DP_SERVER_PORT
  545.   # TlsCertFile defines a path to a file with PEM-encoded TLS cert. If empty, autoconfigured from general.tlsCertFile
  546.   tlsCertFile: # ENV: KUMA_DP_SERVER_TLS_CERT_FILE
  547.   # TlsKeyFile defines a path to a file with PEM-encoded TLS key. If empty, autoconfigured from general.tlsKeyFile
  548.   tlsKeyFile: # ENV: KUMA_DP_SERVER_TLS_KEY_FILE
  549.   # TlsMinVersion the minimum version of TLS
  550.   tlsMinVersion: "TLSv1_2" # ENV: KUMA_DP_SERVER_TLS_MIN_VERSION
  551.   # TlsMaxVersion the maximum version of TLS
  552.   tlsMaxVersion: # ENV: KUMA_DP_SERVER_TLS_MAX_VERSION
  553.   # TlsCipherSuites the list of cipher suites
  554.   tlsCipherSuites: [] # ENV: KUMA_DP_SERVER_TLS_CIPHER_SUITES
  555.   # ReadHeaderTimeout defines the amount of time DP server will be allowed
  556.   # to read request headers. The connection's read deadline is reset
  557.   # after reading the headers and the Handler can decide what is considered
  558.   # too slow for the body. If ReadHeaderTimeout is zero there is no timeout.
  559.   # The timeout is configurable as in rare cases, when Kuma CP was restarting,
  560.   # 1s which is explicitly set in other servers was insufficient and DPs
  561.   # were failing to reconnect (we observed this in Projected Service Account
  562.   # Tokens e2e tests, which started flaking a lot after introducing explicit
  563.   # 1s timeout)
  564.   readHeaderTimeout: 5s # ENV: KUMA_DP_SERVER_READ_HEADER_TIMEOUT
  565.   # Auth defines an authentication configuration for the DP Server
  566.   # DEPRECATED: use "authn" section.
  567.   auth:
  568.     # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  569.     # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  570.     type: "" # ENV: KUMA_DP_SERVER_AUTH_TYPE
  571.   # Authn defines an authentication configuration for the DP Server
  572.   authn:
  573.     # Configuration for data plane proxy authentication.
  574.     dpProxy:
  575.       # Type of authentication. Available values: "serviceAccountToken", "dpToken", "none".
  576.       # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "dpToken" on Universal.
  577.       type: ""
  578.       # Configuration of dpToken authentication method
  579.       dpToken:
  580.         # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  581.         enableIssuer: true
  582.         # DP Token validator configuration.
  583.         validator:
  584.           # If true then Kuma secrets with prefix "dataplane-token-signing-key-{mesh}" are considered as signing keys.
  585.           useSecrets: true
  586.           # List of public keys used to validate the token. Example:
  587.           # - kid: 1
  588.           #   mesh: default
  589.           #   key: |
  590.           #     -----BEGIN RSA PUBLIC KEY-----
  591.           #     MIIBCgKCAQEAq....
  592.           #     -----END RSA PUBLIC KEY-----
  593.           # - kid: 2
  594.           #   mesh: demo
  595.           #   keyFile: /keys/public.pem
  596.           publicKeys: []
  597.     # Configuration for zone proxy authentication.
  598.     zoneProxy:
  599.       # Type of authentication. Available values: "serviceAccountToken", "zoneToken", "none".
  600.       # If empty, autoconfigured based on the environment - "serviceAccountToken" on Kubernetes, "zoneToken" on Universal.
  601.       type: ""
  602.       # Configuration for zoneToken authentication method.
  603.       zoneToken:
  604.         # If true the control plane token issuer is enabled. It's recommended to set it to false when all the tokens are issued offline.
  605.         enableIssuer: true
  606.         # Zone Token validator configuration.
  607.         validator:
  608.           # If true then Kuma secrets with prefix "zone-token-signing-key" are considered as signing keys.
  609.           useSecrets: true
  610.           # List of public keys used to validate the token. Example:
  611.           # - kid: 1
  612.           #   key: |
  613.           #     -----BEGIN RSA PUBLIC KEY-----
  614.           #     MIIBCgKCAQEAq....
  615.           #     -----END RSA PUBLIC KEY-----
  616.           # - kid: 2
  617.           #   keyFile: /keys/public.pem
  618.           publicKeys: []
  619.     # If true then Envoy uses Google gRPC instead of Envoy gRPC which lets a proxy reload the auth data (service account token, dp token etc.) stored in the file without proxy restart.
  620.     enableReloadableTokens: false # ENV: KUMA_DP_SERVER_AUTHN_ENABLE_RELOADABLE_TOKENS
  621.   # Hds defines a Health Discovery Service configuration
  622.   hds:
  623.     # Enabled if true then Envoy will actively check application's ports, but only on Universal.
  624.     # On Kubernetes this feature disabled for now regardless the flag value
  625.     enabled: true # ENV: KUMA_DP_SERVER_HDS_ENABLED
  626.     # Interval for Envoy to send statuses for HealthChecks
  627.     interval: 5s # ENV: KUMA_DP_SERVER_HDS_INTERVAL
  628.     # RefreshInterval is an interval for re-genarting configuration for Dataplanes connected to the Control Plane
  629.     refreshInterval: 10s # ENV: KUMA_DP_SERVER_HDS_REFRESH_INTERVAL
  630.     # Check defines a HealthCheck configuration
  631.     checkDefaults:
  632.       # Timeout is a time to wait for a health check response. If the timeout is reached the
  633.       # health check attempt will be considered a failure
  634.       timeout: 2s # ENV: KUMA_DP_SERVER_HDS_CHECK_TIMEOUT
  635.       # Interval between health checks
  636.       interval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_INTERVAL
  637.       # NoTrafficInterval is a special health check interval that is used when a cluster has
  638.       #    never had traffic routed to it
  639.       noTrafficInterval: 1s # ENV: KUMA_DP_SERVER_HDS_CHECK_NO_TRAFFIC_INTERVAL
  640.       # HealthyThreshold is a number of healthy health checks required before a host is marked healthy
  641.       healthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_HEALTHY_THRESHOLD
  642.       # UnhealthyThreshold is a number of unhealthy health checks required before a host is marked unhealthy
  643.       unhealthyThreshold: 1 # ENV: KUMA_DP_SERVER_HDS_CHECK_UNHEALTHY_THRESHOLD
  645. # Intercommunication CP configuration
  646. interCp:
  647.   # Catalog configuration. Catalog keeps a record of all live CP instances in the zone.
  648.   catalog:
  649.     # Indicates an address on which other control planes can communicate with this CP.
  650.     # If empty then it's autoconfigured by taking the first IP of the nonloopback network interface.
  651.     instanceAddress: "" # ENV: KUMA_INTER_CP_CATALOG_INSTANCE_ADDRESS
  652.     # Interval on which CP will send heartbeat to a leader.
  653.     heartbeatInterval: 5s # ENV: KUMA_INTER_CP_CATALOG_HEARTBEAT_INTERVAL
  654.     # Interval on which CP will write all instances to a catalog.
  655.     writerInterval: 15s # ENV: KUMA_INTER_CP_CATALOG_WRITER_INTERVAL
  656.   # Intercommunication CP server configuration
  657.   server:
  658.     # Port of the inter-cp server
  659.     port: 5683 # ENV: KUMA_INTER_CP_SERVER_PORT
  660.     # TlsMinVersion the minimum version of TLS
  661.     tlsMinVersion: "TLSv1_2" # ENV: KUMA_INTER_CP_SERVER_TLS_MIN_VERSION
  662.     # TlsMaxVersion the maximum version of TLS
  663.     tlsMaxVersion: # ENV: KUMA_INTER_CP_SERVER_TLS_MAX_VERSION
  664.     # TlsCipherSuites the list of cipher suites
  665.     tlsCipherSuites: [ ] # ENV: KUMA_INTER_CP_SERVER_TLS_CIPHER_SUITES
  667. # Access Control configuration
  668. access:
  669.   # Type of access strategy (available values: "static")
  670.   type: static
  671.   # Configuration of static access strategy
  672.   static:
  673.     # AdminResources defines an access to admin resources (Secret/GlobalSecret)
  674.     adminResources:
  675.       # List of users that are allowed to access admin resources
  676.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_USERS
  677.       # List of groups that are allowed to access admin resources
  678.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_ADMIN_RESOURCES_GROUPS
  679.     # GenerateDPToken defines an access to generating dataplane token
  680.     generateDpToken:
  681.       # List of users that are allowed to generate dataplane token
  682.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_USERS
  683.       # List of groups that are allowed to generate dataplane token
  684.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_DP_TOKEN_GROUPS
  685.     # GenerateUserToken defines an access to generating user token
  686.     generateUserToken:
  687.       # List of users that are allowed to generate user token
  688.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_USERS
  689.       # List of groups that are allowed to generate user token
  690.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_USER_TOKEN_GROUPS
  691.     # GenerateZoneToken defines an access to generating zone token
  692.     generateZoneToken:
  693.       # List of users that are allowed to generate zone token
  694.       users: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_USERS
  695.       # List of groups that are allowed to generate zone token
  696.       groups: ["mesh-system:admin"] # ENV: KUMA_ACCESS_STATIC_GENERATE_ZONE_TOKEN_GROUPS
  697.     viewConfigDump:
  698.       # List of users that are allowed to get envoy config dump
  699.       users: [ ] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_USERS
  700.       # List of groups that are allowed to get envoy config dump
  701.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_GET_CONFIG_DUMP_GROUPS
  702.     viewStats:
  703.       # List of users that are allowed to get envoy stats
  704.       users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_USERS
  705.       # List of groups that are allowed to get envoy stats
  706.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_STATS_GROUPS
  707.     viewClusters:
  708.       # List of users that are allowed to get envoy clusters
  709.       users: [ ] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_USERS
  710.       # List of groups that are allowed to get envoy clusters
  711.       groups: ["mesh-system:unauthenticated","mesh-system:authenticated"] # ENV: KUMA_ACCESS_STATIC_VIEW_CLUSTERS_GROUPS
  713. # Configuration of experimental features of Kuma
  714. experimental:
  715.   # If true, experimental Gateway API is enabled
  716.   gatewayAPI: false # ENV: KUMA_EXPERIMENTAL_GATEWAY_API
  717.   # If true, instead of embedding kubernetes outbounds into Dataplane object, they are persisted next to VIPs in ConfigMap
  718.   # This can improve performance, but it should be enabled only after all instances are migrated to version that supports this config
  719.   kubeOutboundsAsVIPs: true # ENV: KUMA_EXPERIMENTAL_KUBE_OUTBOUNDS_AS_VIPS
  720.   # Tag first virtual outbound model is compressed version of default Virtual Outbound model
  721.   # It is recommended to use tag first model for deployments with more than 2k services
  722.   # You can enable this flag on existing deployment. In order to downgrade cp with this flag enabled
  723.   # you need to first disable this flag and redeploy cp, after config is rewritten to default
  724.   # format you can downgrade your cp
  725.   useTagFirstVirtualOutboundModel: false # ENV: KUMA_EXPERIMENTAL_USE_TAG_FIRST_VIRTUAL_OUTBOUND_MODEL
  726.   # If true, KDS will sync using incremental xDS updates
  727.   kdsDeltaEnabled: true # ENV: KUMA_EXPERIMENTAL_KDS_DELTA_ENABLED
  728.   # List of prefixes that will be used to filter out tags by keys from ingress' available services section.
  729.   # This can trim the size of the ZoneIngress object significantly.
  730.   # The drawback is that you cannot use filtered out tags for traffic routing.
  731.   # If empty, no filter is applied.
  732.   ingressTagFilters: [] # ENV: KUMA_EXPERIMENTAL_INGRESS_TAG_FILTERS
  733.   # KDS event based watchdog settings. It is a more optimal way to generate KDS snapshot config.
  734.   kdsEventBasedWatchdog:
  735.     # If true, then experimental event based watchdog to generate KDS snapshot is used.
  736.     enabled: false # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_ENABLED
  737.     # How often we flush changes when experimental event based watchdog is used.
  738.     flushInterval: 5s # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_FLUSH_INTERVAL
  739.     # How often we schedule full KDS resync when experimental event based watchdog is used.
  740.     fullResyncInterval: 60s # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_FULL_RESYNC_INTERVAL
  741.     # If true, then initial full resync is going to be delayed by 0 to FullResyncInterval.
  742.     delayFullResync: false # ENV: KUMA_EXPERIMENTAL_KDS_EVENT_BASED_WATCHDOG_DELAY_FULL_RESYNC
  743.   # If true then control plane computes reachable services automatically based on MeshTrafficPermission.
  744.   # Lack of MeshTrafficPermission is treated as Deny the traffic.
  745.   autoReachableServices: false # ENV: KUMA_EXPERIMENTAL_AUTO_REACHABLE_SERVICES
  746.   # KDSSyncNameWithHashSuffix if true then during KDS sync resource name is going to be suffixed with hash.
  747.   # The hash is computed based on various resource characteristics like mesh, namespace, etc. The feature prevents name
  748.   # collisions when syncing policies with the same names but different meshes from Global(Universal) to Zone(Kubernetes).
  749.   # More extensive explanation of the problem and solution can be found in the MADR https://github.com/kumahq/kuma/blob/master/docs/madr/decisions/029-kds-sync-hash-suffix.md
  750.   KDSSyncNameWithHashSuffix: false # ENV: KUMA_EXPERIMENTAL_KDS_SYNC_NAME_WITH_HASH_SUFFIX
  752. proxy:
  753.   gateway:
  754.     # Sets the envoy runtime value to limit maximum number of incoming
  755.     # connections to a builtin gateway data plane proxy
  756.     globalDownstreamMaxConnections: 50000 # ENV: KUMA_PROXY_GATEWAY_GLOBAL_DOWNSTREAM_MAX_CONNECTIONS
  758. tracing:
  759.   openTelemetry:
  760.     endpoint: "" # e.g. otel-collector:4317
  762. # Configuration of the event bus which is local to one instance of CP
  763. eventBus:
  764.   # BufferSize controls the buffer for every single event listener.
  765.   # If we go over buffer, additional delay may happen to various operation like insight recomputation or KDS.
  766.   bufferSize: 100 # ENV: KUMA_EVENT_BUS_BUFFER_SIZE

Helm values.yaml

  1. global:
  2.   image:
  3.     # -- Default registry for all Kuma Images
  4.     registry: "docker.io/kumahq"
  5.     # -- The default tag for all Kuma images, which itself defaults to .Chart.AppVersion
  6.     tag:
  7.   # -- Add `imagePullSecrets` to all the service accounts used for Kuma components
  8.   imagePullSecrets: []
  10. # -- Whether to patch the target namespace with the system label
  11. patchSystemNamespace: true
  13. installCrdsOnUpgrade:
  14.   # -- Whether install new CRDs before upgrade (if any were introduced with the new version of Kuma)
  15.   enabled: true
  16.   # -- The `imagePullSecrets` to attach to the Service Account running CRD installation.
  17.   # This field will be deprecated in a future release, please use .global.imagePullSecrets
  18.   imagePullSecrets: []
  20. # -- Whether to disable all helm hooks
  21. noHelmHooks: false
  23. # -- Whether to restart control-plane by calculating a new checksum for the secret
  24. restartOnSecretChange: true
  26. controlPlane:
  27.   # -- Environment that control plane is run in, useful when running universal global control plane on k8s
  28.   environment: "kubernetes"
  30.   # -- Labels to add to resources in addition to default labels
  31.   extraLabels: {}
  33.   # -- Kuma CP log level: one of off,info,debug
  34.   logLevel: "info"
  36.   # -- Kuma CP log output path: Defaults to /dev/stdout
  37.   logOutputPath: ""
  39.   # -- Kuma CP modes: one of standalone,zone,global
  40.   mode: "standalone"
  42.   # -- (string) Kuma CP zone, if running multizone
  43.   zone:
  45.   # -- Only used in `zone` mode
  46.   kdsGlobalAddress: ""
  48.   # -- Number of replicas of the Kuma CP. Ignored when autoscaling is enabled
  49.   replicas: 1
  51.   # -- Minimum number of seconds for which a newly created pod should be ready for it to be considered available.
  52.   minReadySeconds: 0
  54.   # -- Annotations applied only to the `Deployment` resource
  55.   deploymentAnnotations: {}
  57.   # -- Annotations applied only to the `Pod` resource
  58.   podAnnotations: {}
  60.   # Horizontal Pod Autoscaling configuration
  61.   autoscaling:
  62.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  63.     enabled: false
  65.     # -- The minimum CP pods to allow
  66.     minReplicas: 2
  67.     # -- The max CP pods to scale to
  68.     maxReplicas: 5
  70.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  71.     targetCPUUtilizationPercentage: 80
  72.     # -- For clusters that do support autoscaling/v2, use metrics
  73.     metrics:
  74.       - type: Resource
  75.         resource:
  76.           name: cpu
  77.           target:
  78.             type: Utilization
  79.             averageUtilization: 80
  81.   # -- Node selector for the Kuma Control Plane pods
  82.   nodeSelector:
  83.     kubernetes.io/os: linux
  85.   # -- Tolerations for the Kuma Control Plane pods
  86.   tolerations: []
  88.   podDisruptionBudget:
  89.     # -- Whether to create a pod disruption budget
  90.     enabled: false
  91.     # -- The maximum number of unavailable pods allowed by the budget
  92.     maxUnavailable: 1
  94.   # -- Affinity placement rule for the Kuma Control Plane pods.
  95.   # This is rendered as a template, so you can reference other helm variables or includes.
  96.   affinity:
  97.     podAntiAffinity:
  98.       preferredDuringSchedulingIgnoredDuringExecution:
  99.       - weight: 100
  100.         podAffinityTerm:
  101.           labelSelector:
  102.             # These match the selector labels used on the deployment.
  103.             matchExpressions:
  104.               - key: app.kubernetes.io/name
  105.                 operator: In
  106.                 values:
  107.                   - '{{ include "kuma.name" . }}'
  108.               - key: app.kubernetes.io/instance
  109.                 operator: In
  110.                 values:
  111.                   - '{{ .Release.Name }}'
  112.               - key: app
  113.                 operator: In
  114.                 values:
  115.                   - '{{ include "kuma.name" . }}-control-plane'
  116.           topologyKey: kubernetes.io/hostname
  118.   # -- Topology spread constraints rule for the Kuma Control Plane pods.
  119.   # This is rendered as a template, so you can use variables to generate match labels.
  120.   topologySpreadConstraints:
  122.   # -- Failure policy of the mutating webhook implemented by the Kuma Injector component
  123.   injectorFailurePolicy: Fail
  125.   service:
  126.     apiServer:
  127.       http:
  128.         # -- Port on which Http api server Service is exposed on Node for service of type NodePort
  129.         nodePort: 30681
  130.       https:
  131.         # -- Port on which Https api server Service is exposed on Node for service of type NodePort
  132.         nodePort: 30682
  134.     # -- Whether to create a service resource.
  135.     enabled: true
  137.     # -- (string) Optionally override of the Kuma Control Plane Service's name
  138.     name:
  140.     # -- Service type of the Kuma Control Plane
  141.     type: ClusterIP
  143.     # -- Additional annotations to put on the Kuma Control Plane
  144.     annotations: { }
  146.   # Kuma API and GUI ingress settings. Useful if you want to expose the
  147.   # API and GUI of Kuma outside the k8s cluster.
  148.   ingress:
  149.     # -- Install K8s Ingress resource that exposes GUI and API
  150.     enabled: false
  151.     # -- IngressClass defines which controller will implement the resource
  152.     ingressClassName:
  153.     # -- Ingress hostname
  154.     hostname:
  155.     # -- Map of ingress annotations.
  156.     annotations: {}
  157.     # -- Ingress path.
  158.     path: /
  159.     # -- Each path in an Ingress is required to have a corresponding path type. (ImplementationSpecific/Exact/Prefix)
  160.     pathType: ImplementationSpecific
  161.     # -- Port from kuma-cp to use to expose API and GUI. Switch to 5682 to expose TLS port
  162.     servicePort: 5681
  164.   globalZoneSyncService:
  165.     # -- Whether to create a k8s service for the global zone sync
  166.     # service. It will only be created when enabled and deploying the global
  167.     # control plane.
  168.     enabled: true
  169.     # -- Service type of the Global-zone sync
  170.     type: LoadBalancer
  171.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  172.     loadBalancerIP:
  173.     # -- Optionally specify allowed source ranges that can access the load balancer
  174.     loadBalancerSourceRanges: []
  175.     # -- Additional annotations to put on the Global Zone Sync Service
  176.     annotations: { }
  177.     # -- Port on which Global Zone Sync Service is exposed on Node for service of type NodePort
  178.     nodePort: 30685
  179.     # -- Port on which Global Zone Sync Service is exposed
  180.     port: 5685
  181.     # -- Protocol of the Global Zone Sync service port
  182.     protocol: grpc
  184.   defaults:
  185.     # -- Whether to skip creating the default Mesh
  186.     skipMeshCreation: false
  188.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  189.   automountServiceAccountToken: true
  191.   # -- Optionally override the resource spec
  192.   resources:
  193.     requests:
  194.        cpu: 500m
  195.        memory: 256Mi
  196.     limits:
  197.        memory: 256Mi
  199.   # -- Pod lifecycle settings (useful for adding a preStop hook, when
  200.   # using AWS ALB or NLB)
  201.   lifecycle: {}
  203.   # -- Number of seconds to wait before force killing the pod. Make sure to
  204.   # update this if you add a preStop hook.
  205.   terminationGracePeriodSeconds: 30
  207.   # TLS for various servers
  208.   tls:
  209.     general:
  210.       # -- Secret that contains tls.crt, tls.key [and ca.crt when no
  211.       # controlPlane.tls.general.caSecretName specified] for protecting
  212.       # Kuma in-cluster communication
  213.       secretName: ""
  214.       # -- Secret that contains ca.crt that was used to sign cert for protecting
  215.       # Kuma in-cluster communication (ca.crt present in this secret
  216.       # have precedence over the one provided in the controlPlane.tls.general.secretName)
  217.       caSecretName: ""
  218.       # -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
  219.       caBundle: ""
  220.     apiServer:
  221.       # -- Secret that contains tls.crt, tls.key for protecting Kuma API on HTTPS
  222.       secretName: ""
  223.       # -- Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS
  224.       clientCertsSecretName: ""
  225.     # - if not creating the global control plane, then do nothing
  226.     # - if secretName is empty and create is false, then do nothing
  227.     # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
  228.     # - if secretName is empty and create is true, then create a secret with a default name and use it
  229.     # - if secretName is non-empty and create is true, then create the secret using the provided name
  230.     kdsGlobalServer:
  231.       # -- Name of the K8s TLS Secret resource. If you set this and don't set
  232.       # create=true, you have to create the secret manually.
  233.       secretName: ""
  234.       # -- Whether to create the TLS secret in helm.
  235.       create: false
  236.       # -- The TLS certificate to offer.
  237.       cert: ""
  238.       # -- The TLS key to use.
  239.       key: ""
  240.     # - if not creating the zonal control plane, then do nothing
  241.     # - if secretName is empty and create is false, then do nothing
  242.     # - if secretName is non-empty and create is false, then use the secret made outside of helm with the name secretName
  243.     # - if secretName is empty and create is true, then create a secret with a default name and use it
  244.     # - if secretName is non-empty and create is true, then create the secret using the provided name
  245.     kdsZoneClient:
  246.       # -- Name of the K8s Secret resource that contains ca.crt which was
  247.       # used to sign the certificate of KDS Global Server. If you set this
  248.       # and don't set create=true, you have to create the secret manually.
  249.       secretName: ""
  250.       # -- Whether to create the TLS secret in helm.
  251.       create: false
  252.       # -- CA bundle that was used to sign the certificate of KDS Global Server.
  253.       cert: ""
  254.       # -- If true, TLS cert of the server is not verified.
  255.       skipVerify: false
  257.   # -- Annotations to add for Control Plane's Service Account
  258.   serviceAccountAnnotations: { }
  260.   image:
  261.     # -- Kuma CP ImagePullPolicy
  262.     pullPolicy: IfNotPresent
  263.     # -- Kuma CP image repository
  264.     repository: "kuma-cp"
  265.     # -- Kuma CP Image tag. When not specified, the value is copied from global.tag
  266.     tag:
  268.   # -- (object with { Env: string, Secret: string, Key: string }) Secrets to add as environment variables,
  269.   # where `Env` is the name of the env variable,
  270.   # `Secret` is the name of the Secret,
  271.   # and `Key` is the key of the Secret value to use
  272.   secrets:
  273.   #  someSecret:
  274.   #    Secret: some-secret
  275.   #    Key: secret_key
  276.   #    Env: SOME_SECRET
  278.   # -- Additional environment variables that will be passed to the control plane
  279.   envVars: { }
  281.   # -- Additional config maps to mount into the control plane, with optional inline values
  282.   extraConfigMaps: [ ]
  283. #    - name: extra-config
  284. #      mountPath: /etc/extra-config
  285. #      readOnly: true
  286. #      values:
  287. #        extra-config-key: |
  288. #          extra-config-value
  290.   # -- (object with { name: string, mountPath: string, readOnly: string }) Additional secrets to mount into the control plane,
  291.   # where `Env` is the name of the env variable,
  292.   # `Secret` is the name of the Secret,
  293.   # and `Key` is the key of the Secret value to use
  294.   extraSecrets:
  295.   #  extraConfig:
  296.   #    name: extra-config
  297.   #    mountPath: /etc/extra-config
  298.   #    readOnly: true
  300.   webhooks:
  301.     validator:
  302.       # -- Additional rules to apply on Kuma validator webhook. Useful when building custom policy on top of Kuma.
  303.       additionalRules: ""
  304.     ownerReference:
  305.       # -- Additional rules to apply on Kuma owner reference webhook. Useful when building custom policy on top of Kuma.
  306.       additionalRules: ""
  308.   # -- Specifies if the deployment should be started in hostNetwork mode.
  309.   hostNetwork: false
  310.   # -- Define a new server port for the admission controller. Recommended to set in combination with
  311.   # hostNetwork to prevent multiple port bindings on the same port (like Calico in AWS EKS).
  312.   admissionServerPort: 5443
  314.   # -- Security context at the pod level for control plane.
  315.   podSecurityContext:
  316.     runAsNonRoot: true
  318.   # -- Security context at the container level for control plane.
  319.   containerSecurityContext:
  320.     readOnlyRootFilesystem: true
  322. cni:
  323.   # -- Install Kuma with CNI instead of proxy init container
  324.   enabled: false
  325.   # -- Install CNI in chained mode
  326.   chained: false
  327.   # -- Set the CNI install directory
  328.   netDir: /etc/cni/multus/net.d
  329.   # -- Set the CNI bin directory
  330.   binDir: /var/lib/cni/bin
  331.   # -- Set the CNI configuration name
  332.   confName: kuma-cni.conf
  333.   # -- CNI log level: one of off,info,debug
  334.   logLevel: info
  335.   # -- Node Selector for the CNI pods
  336.   nodeSelector:
  337.     kubernetes.io/os: linux
  338.   # -- Tolerations for the CNI pods
  339.   tolerations: []
  340.   # -- Additional pod annotations
  341.   podAnnotations: { }
  342.   # -- Set the CNI namespace
  343.   namespace: kube-system
  345.   image:
  346.     # -- CNI image repository
  347.     repository: "kuma-cni"
  348.     # -- CNI image tag - defaults to .Chart.AppVersion
  349.     tag:
  350.     # -- CNI image pull policy
  351.     imagePullPolicy: IfNotPresent
  353.   # -- it's only useful in tests to trigger a possible race condition
  354.   delayStartupSeconds: 0
  356.   # -- use new CNI (experimental)
  357.   experimental:
  358.     imageEbpf:
  359.       # -- CNI experimental eBPF image registry
  360.       registry: "docker.io/kumahq"
  361.       # -- CNI experimental eBPF image repository
  362.       repository: "merbridge"
  363.       # -- CNI experimental eBPF image tag
  364.       tag: "0.8.5"
  366.   resources:
  367.     requests:
  368.       cpu: 100m
  369.       memory: 100Mi
  370.     limits:
  371.       memory: 100Mi
  373.   # -- Security context at the pod level for cni
  374.   podSecurityContext: {}
  376.   # -- Security context at the container level for cni
  377.   containerSecurityContext:
  378.     readOnlyRootFilesystem: true
  379.     runAsNonRoot: false
  380.     runAsUser: 0
  381.     runAsGroup: 0
  383. dataPlane:
  384.   image:
  385.     # -- The Kuma DP image repository
  386.     repository: "kuma-dp"
  387.     # -- Kuma DP ImagePullPolicy
  388.     pullPolicy: IfNotPresent
  389.     # -- Kuma DP Image Tag. When not specified, the value is copied from global.tag
  390.     tag:
  392.   initImage:
  393.     # -- The Kuma DP init image repository
  394.     repository: "kuma-init"
  395.     # -- Kuma DP init image tag When not specified, the value is copied from global.tag
  396.     tag:
  398. ingress:
  399.   # -- If true, it deploys Ingress for cross cluster communication
  400.   enabled: false
  402.   # -- Labels to add to resources, in addition to default labels
  403.   extraLabels: {}
  405.   # -- Time for which old listener will still be active as draining
  406.   drainTime: 30s
  408.   # -- Number of replicas of the Ingress. Ignored when autoscaling is enabled.
  409.   replicas: 1
  411.   # -- Log level for ingress (available values: off|info|debug)
  412.   logLevel: info
  414.   # -- Define the resources to allocate to mesh ingress
  415.   resources:
  416.     requests:
  417.       cpu: 50m
  418.       memory: 64Mi
  419.     limits:
  420.       cpu: 1000m
  421.       memory: 512Mi
  423.   # -- Pod lifecycle settings (useful for adding a preStop hook, when
  424.   # using AWS ALB or NLB)
  425.   lifecycle: {}
  427.   # -- Number of seconds to wait before force killing the pod. Make sure to
  428.   # update this if you add a preStop hook.
  429.   terminationGracePeriodSeconds: 40
  431.   # Horizontal Pod Autoscaling configuration
  432.   autoscaling:
  433.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  434.     enabled: false
  436.     # -- The minimum CP pods to allow
  437.     minReplicas: 2
  438.     # -- The max CP pods to scale to
  439.     maxReplicas: 5
  441.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  442.     targetCPUUtilizationPercentage: 80
  443.     # -- For clusters that do support autoscaling/v2, use metrics
  444.     metrics:
  445.       - type: Resource
  446.         resource:
  447.           name: cpu
  448.           target:
  449.             type: Utilization
  450.             averageUtilization: 80
  452.   service:
  453.     # -- Whether to create a Service resource.
  454.     enabled: true
  455.     # -- Service type of the Ingress
  456.     type: LoadBalancer
  457.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  458.     loadBalancerIP:
  459.     # -- Additional annotations to put on the Ingress service
  460.     annotations: { }
  461.     # -- Port on which Ingress is exposed
  462.     port: 10001
  463.     # -- Port on which service is exposed on Node for service of type NodePort
  464.     nodePort:
  465.   # -- Additional pod annotations (deprecated favor `podAnnotations`)
  466.   annotations: { }
  467.   # -- Additional pod annotations
  468.   podAnnotations: { }
  469.   # -- Node Selector for the Ingress pods
  470.   nodeSelector:
  471.     kubernetes.io/os: linux
  472.   # -- Tolerations for the Ingress pods
  473.   tolerations: []
  474.   podDisruptionBudget:
  475.     # -- Whether to create a pod disruption budget
  476.     enabled: false
  477.     # -- The maximum number of unavailable pods allowed by the budget
  478.     maxUnavailable: 1
  480.   # -- Affinity placement rule for the Kuma Ingress pods
  481.   # This is rendered as a template, so you can reference other helm variables
  482.   # or includes.
  483.   affinity:
  484.     podAntiAffinity:
  485.       preferredDuringSchedulingIgnoredDuringExecution:
  486.       - weight: 100
  487.         podAffinityTerm:
  488.           labelSelector:
  489.             # These match the selector labels used on the deployment.
  490.             matchExpressions:
  491.               - key: app.kubernetes.io/name
  492.                 operator: In
  493.                 values:
  494.                   - '{{ include "kuma.name" . }}'
  495.               - key: app.kubernetes.io/instance
  496.                 operator: In
  497.                 values:
  498.                   - '{{ .Release.Name }}'
  499.               - key: app
  500.                 operator: In
  501.                 values:
  502.                   - kuma-ingress
  503.           topologyKey: kubernetes.io/hostname
  505.   # -- Topology spread constraints rule for the Kuma Mesh Ingress pods.
  506.   # This is rendered as a template, so you can use variables to generate match labels.
  507.   topologySpreadConstraints:
  509.   # -- Security context at the pod level for ingress
  510.   podSecurityContext:
  511.     runAsNonRoot: true
  512.     runAsUser: 5678
  513.     runAsGroup: 5678
  515.   # -- Security context at the container level for ingress
  516.   containerSecurityContext:
  517.     readOnlyRootFilesystem: true
  519.   # -- Annotations to add for Control Plane's Service Account
  520.   serviceAccountAnnotations: { }
  521.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  522.   automountServiceAccountToken: true
  524. egress:
  525.   # -- If true, it deploys Egress for cross cluster communication
  526.   enabled: false
  527.   # -- Labels to add to resources, in addition to the default labels.
  528.   extraLabels: {}
  529.   # -- Time for which old listener will still be active as draining
  530.   drainTime: 30s
  531.   # -- Number of replicas of the Egress. Ignored when autoscaling is enabled.
  532.   replicas: 1
  534.   # -- Log level for egress (available values: off|info|debug)
  535.   logLevel: info
  537.   # Horizontal Pod Autoscaling configuration
  538.   autoscaling:
  539.     # -- Whether to enable Horizontal Pod Autoscaling, which requires the [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) in the cluster
  540.     enabled: false
  542.     # -- The minimum CP pods to allow
  543.     minReplicas: 2
  544.     # -- The max CP pods to scale to
  545.     maxReplicas: 5
  547.     # -- For clusters that don't support autoscaling/v2, autoscaling/v1 is used
  548.     targetCPUUtilizationPercentage: 80
  549.     # -- For clusters that do support autoscaling/v2, use metrics
  550.     metrics:
  551.       - type: Resource
  552.         resource:
  553.           name: cpu
  554.           target:
  555.             type: Utilization
  556.             averageUtilization: 80
  557.   resources:
  558.     requests:
  559.       cpu: 50m
  560.       memory: 64Mi
  561.     limits:
  562.       cpu: 1000m
  563.       memory: 512Mi
  565.   service:
  566.     # -- Whether to create the service object
  567.     enabled: true
  568.     # -- Service type of the Egress
  569.     type: ClusterIP
  570.     # -- (string) Optionally specify IP to be used by cloud provider when configuring load balancer
  571.     loadBalancerIP:
  572.     # -- Additional annotations to put on the Egress service
  573.     annotations: { }
  574.     # -- Port on which Egress is exposed
  575.     port: 10002
  576.     # -- Port on which service is exposed on Node for service of type NodePort
  577.     nodePort:
  578.   # -- Additional pod annotations (deprecated favor `podAnnotations`)
  579.   annotations: { }
  580.   # -- Additional pod annotations
  581.   podAnnotations: { }
  582.   # -- Node Selector for the Egress pods
  583.   nodeSelector:
  584.     kubernetes.io/os: linux
  585.   # -- Tolerations for the Egress pods
  586.   tolerations: []
  587.   podDisruptionBudget:
  588.     # -- Whether to create a pod disruption budget
  589.     enabled: false
  590.     # -- The maximum number of unavailable pods allowed by the budget
  591.     maxUnavailable: 1
  593.   # -- Affinity placement rule for the Kuma Egress pods.
  594.   # This is rendered as a template, so you can reference other helm variables or includes.
  595.   affinity:
  596.     podAntiAffinity:
  597.       preferredDuringSchedulingIgnoredDuringExecution:
  598.       - weight: 100
  599.         podAffinityTerm:
  600.           labelSelector:
  601.             # These match the selector labels used on the deployment.
  602.             matchExpressions:
  603.               - key: app.kubernetes.io/name
  604.                 operator: In
  605.                 values:
  606.                   - '{{ include "kuma.name" . }}'
  607.               - key: app.kubernetes.io/instance
  608.                 operator: In
  609.                 values:
  610.                   - '{{ .Release.Name }}'
  611.               - key: app
  612.                 operator: In
  613.                 values:
  614.                   - kuma-egress
  615.           topologyKey: kubernetes.io/hostname
  617.   # -- Topology spread constraints rule for the Kuma Egress pods.
  618.   # This is rendered as a template, so you can use variables to generate match labels.
  619.   topologySpreadConstraints:
  621.   # -- Security context at the pod level for egress
  622.   podSecurityContext:
  623.     runAsNonRoot: true
  624.     runAsUser: 5678
  625.     runAsGroup: 5678
  627.   # -- Security context at the container level for egress
  628.   containerSecurityContext:
  629.     readOnlyRootFilesystem: true
  631.   # -- Annotations to add for Control Plane's Service Account
  632.   serviceAccountAnnotations: { }
  633.   # -- Whether to automountServiceAccountToken for cp. Optionally set to false
  634.   automountServiceAccountToken: true
  636. kumactl:
  637.   image:
  638.     # -- The kumactl image repository
  639.     repository: kumactl
  640.     # -- The kumactl image tag. When not specified, the value is copied from global.tag
  641.     tag:
  643. kubectl:
  644.   image:
  645.     # -- The kubectl image registry
  646.     registry: docker.io
  647.     # -- The kubectl image repository
  648.     repository: bitnami/kubectl
  649.     # -- The kubectl image tag
  650.     tag: "1.27.5"
  651. hooks:
  652.   # -- Node selector for the HELM hooks
  653.   nodeSelector:
  654.     kubernetes.io/os: linux
  655.   # -- Tolerations for the HELM hooks
  656.   tolerations: []
  657.   # -- Security context at the pod level for crd/webhook/ns
  658.   podSecurityContext:
  659.     runAsNonRoot: true
  661.   # -- Security context at the container level for crd/webhook/ns
  662.   containerSecurityContext:
  663.     readOnlyRootFilesystem: true
  665.   # -- ebpf-cleanup hook needs write access to the root filesystem to clean ebpf programs
  666.   # Changing below values will potentially break ebpf cleanup completely,
  667.   # so be cautious when doing so.
  668.   ebpfCleanup:
  669.     # -- Security context at the pod level for crd/webhook/cleanup-ebpf
  670.     podSecurityContext:
  671.       runAsNonRoot: false
  672.     # -- Security context at the container level for crd/webhook/cleanup-ebpf
  673.     containerSecurityContext:
  674.       readOnlyRootFilesystem: false
  676. experimental:
  677.   # -- If true, it installs experimental Gateway API support
  678.   gatewayAPI: false
  679.   # Configuration for the experimental ebpf mode for transparent proxy
  680.   ebpf:
  681.     # -- If true, ebpf will be used instead of using iptables to install/configure transparent proxy
  682.     enabled: false
  683.     # -- Name of the environmental variable which will contain the IP address of a pod
  684.     instanceIPEnvVarName: INSTANCE_IP
  685.     # -- Path where BPF file system should be mounted
  686.     bpffsPath: /sys/fs/bpf
  687.     # -- Host's cgroup2 path
  688.     cgroupPath: /sys/fs/cgroup
  689.     # -- Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty
  690.     tcAttachIface: ""
  691.     # -- Path where compiled eBPF programs which will be installed can be found
  692.     programsSourcePath: /kuma/ebpf
  693.   # -- If false, it uses legacy API for resource synchronization
  694.   deltaKds: true
  696. # Postgres' settings for universal control plane on k8s
  697. postgres:
  698.   # -- Postgres port, password should be provided as a secret reference in "controlPlane.secrets"
  699.   # with the Env value "KUMA_STORE_POSTGRES_PASSWORD".
  700.   # Example:
  701.   # controlPlane:
  702.   #   secrets:
  703.   #     - Secret: postgres-postgresql
  704.   #       Key: postgresql-password
  705.   #       Env: KUMA_STORE_POSTGRES_PASSWORD
  706.   port: "5432"
  707.   # TLS settings
  708.   tls:
  709.     # -- Mode of TLS connection. Available values are: "disable", "verifyNone", "verifyCa", "verifyFull"
  710.     mode: disable # ENV: KUMA_STORE_POSTGRES_TLS_MODE
  711.     # -- Whether to disable SNI the postgres `sslsni` option.
  712.     disableSSLSNI: false # ENV: KUMA_STORE_POSTGRES_TLS_DISABLE_SSLSNI
  713.     # -- Secret name that contains the ca.crt
  714.     caSecretName:
  715.     # -- Secret name that contains the client tls.crt, tls.key
  716.     secretName:
  718. # @ignored for helm-docs
  719. plugins:
  720.   policies:
  721.     meshaccesslogs: {}
  722.     meshcircuitbreakers: {}
  723.     meshfaultinjections: {}
  724.     meshhealthchecks: {}
  725.     meshhttproutes: {}
  726.     meshloadbalancingstrategies: {}
  727.     meshproxypatches: {}
  728.     meshratelimits: {}
  729.     meshretries: {}
  730.     meshtcproutes: {}
  731.     meshtimeouts: {}
  732.     meshtraces: {}
  733.     meshtrafficpermissions: {}