Configuring your Mesh and multi-tenancy

Uses: Kong Mesh

Usage

The easiest way to create a Mesh is to specify its name. The name of a Mesh must be unique.

apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default

We will apply the configuration with kubectl apply -f [..].

type: Mesh
name: default

We will apply the configuration with kumactl apply -f [..] or via the HTTP API.

Creating resources in a Mesh

It is possible to determine to what Mesh other resources belong to in the following ways.

Data plane proxies

Every time we start a data plane proxy, we need to specify to what Mesh it belongs, this can be done in the following way:

By using the kuma.io/mesh annotation in a Deployment, like:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: example-app
  namespace: kuma-example
spec:
  ...
  template:
    metadata:
      ...
      annotations:
        # indicate to Kong Mesh what is the Mesh that the data plane proxy belongs to
        kuma.io/mesh: default
    spec:
      containers:
        ...

A Mesh may span multiple Kubernetes namespaces. Any Kong Mesh resource in the cluster which specifies a particular Mesh will be part of that Mesh.

By using the -m or --mesh argument when running kuma-dp, for example:

kuma-dp run \
  --name=backend-1 \
  --mesh=default \
  --cp-address=https://127.0.0.1:5678 \
  --dataplane-token-file=/tmp/kuma-dp-backend-1-token

You can control which data plane proxies are allowed to join the mesh using mesh constraints.

Policies

When creating new Policies we also must specify to what Mesh they belong. This can be done in the following way:

By using the kuma.io/mesh label, like:

apiVersion: kuma.io/v1alpha1
kind: MeshHTTPRoute
metadata:
  name: route-1
  namespace: kong-mesh-system
  labels:
    kuma.io/mesh: default # indicate to Kong Mesh what is the Mesh that the resource belongs to
spec:
  ...

Kong Mesh consumes all Policies on the cluster and joins each to an individual Mesh, identified by this property.

By using the mesh property, like:

type: MeshHTTPRoute
name: route-1
mesh: default # indicate to Kong Mesh what is the Mesh that the resource belongs to
...

Skipping default resource creation

By default, to help users get started we create the following default policies:

apiVersion: kuma.io/v1alpha1
kind: MeshTimeout
metadata:
  name: mesh-gateways-timeout-all-default
  namespace: kong-mesh-system
  labels:
    kuma.io/mesh: default
spec:
  targetRef:
    kind: Mesh
    proxyTypes:
    - Gateway
  to:
  - targetRef:
      kind: Mesh
    default:
      idleTimeout: 1h
      http:
        streamIdleTimeout: 5s
  from:
  - targetRef:
      kind: Mesh
    default:
      idleTimeout: 5m
      http:
        streamIdleTimeout: 5s
        requestHeadersTimeout: 500ms
---
apiVersion: kuma.io/v1alpha1
kind: MeshTimeout
metadata:
  name: mesh-timeout-all-default
  namespace: kong-mesh-system
  labels:
    kuma.io/mesh: default
spec:
  targetRef:
    kind: Mesh
    proxyTypes:
    - Sidecar
  to:
  - targetRef:
      kind: Mesh
    default:
      connectionTimeout: 5s
      idleTimeout: 1h
      http:
        requestTimeout: 15s
        streamIdleTimeout: 30m
  from:
  - targetRef:
      kind: Mesh
    default:
      connectionTimeout: 10s
      idleTimeout: 2h
      http:
        requestTimeout: 0s
        streamIdleTimeout: 1h
        maxStreamDuration: 0s
---
apiVersion: kuma.io/v1alpha1
kind: MeshRetry
metadata:
  name: mesh-retry-all-default
  namespace: kong-mesh-system
  labels:
    kuma.io/mesh: default
spec:
  targetRef:
    kind: Mesh
  to:
  - targetRef:
      kind: Mesh
    default:
      tcp:
        maxConnectAttempt: 5
      http:
        numRetries: 5
        perTryTimeout: 16s
        backOff:
          baseInterval: 25ms
          maxInterval: 250ms
      grpc:
        numRetries: 5
        perTryTimeout: 16s
        backOff:
          baseInterval: 25ms
          maxInterval: 250ms
---
apiVersion: kuma.io/v1alpha1
kind: MeshCircuitBreaker
metadata:
  name: mesh-circuit-breaker-all-default
  namespace: kong-mesh-system
  labels:
    kuma.io/mesh: default
spec:
  targetRef:
    kind: Mesh
  to:
  - targetRef:
      kind: Mesh
    default:
      connectionLimits:
        maxConnections: 1024
        maxPendingRequests: 1024
        maxRetries: 3
        maxRequests: 1024

type: MeshTimeout
mesh: default
name: mesh-gateways-timeout-all-default
spec:
  targetRef:
    kind: Mesh
    proxyTypes:
    - Gateway
  to:
  - targetRef:
      kind: Mesh
    default:
      idleTimeout: 1h
      http:
        streamIdleTimeout: 5s
  from:
  - targetRef:
      kind: Mesh
    default:
      idleTimeout: 5m
      http:
        streamIdleTimeout: 5s
        requestHeadersTimeout: 500ms
---
type: MeshTimeout
mesh: default
name: mesh-timeout-all-default
spec:
  targetRef:
    kind: Mesh
    proxyTypes:
    - Sidecar
  to:
  - targetRef:
      kind: Mesh
    default:
      connectionTimeout: 5s
      idleTimeout: 1h
      http:
        requestTimeout: 15s
        streamIdleTimeout: 30m
  from:
  - targetRef:
      kind: Mesh
    default:
      connectionTimeout: 10s
      idleTimeout: 2h
      http:
        requestTimeout: 0s
        streamIdleTimeout: 1h
        maxStreamDuration: 0s
---
type: MeshRetry
mesh: default
name: mesh-retry-all-default
spec:
  targetRef:
    kind: Mesh
  to:
  - targetRef:
      kind: Mesh
    default:
      tcp:
        maxConnectAttempt: 5
      http:
        numRetries: 5
        perTryTimeout: 16s
        backOff:
          baseInterval: 25ms
          maxInterval: 250ms
      grpc:
        numRetries: 5
        perTryTimeout: 16s
        backOff:
          baseInterval: 25ms
          maxInterval: 250ms
---
type: MeshCircuitBreaker
mesh: default
name: mesh-circuit-breaker-all-default
spec:
  targetRef:
    kind: Mesh
  to:
  - targetRef:
      kind: Mesh
    default:
      connectionLimits:
        maxConnections: 1024
        maxPendingRequests: 1024
        maxRetries: 3
        maxRequests: 1024

Please adjust konnect_mesh_control_plane.my_meshcontrolplane.id and konnect_mesh.my_mesh.name according to your current configuration.

resource "konnect_mesh_timeout" "mesh_gateways_timeout_all_default" {
  provider = konnect-beta
  type = "MeshTimeout"
  name = "mesh-gateways-timeout-all-default"
  spec = {
    target_ref = {
      kind = "Mesh"
      proxy_types = [
         = "Gateway"
      ]
    }
    to = [
      {
        target_ref = {
          kind = "Mesh"
        }
        default = {
          idle_timeout = "1h"
          http = {
            stream_idle_timeout = "5s"
          }
        }
      }
    ]
    from = [
      {
        target_ref = {
          kind = "Mesh"
        }
        default = {
          idle_timeout = "5m"
          http = {
            stream_idle_timeout = "5s"
            request_headers_timeout = "500ms"
          }
        }
      }
    ]
  }
  labels   = {
  "kuma.io/mesh" = konnect_mesh.my_mesh.name
  }
  cp_id    = konnect_mesh_control_plane.my_meshcontrolplane.id
  mesh     = konnect_mesh.my_mesh.name
}
resource "konnect_mesh_timeout" "mesh_timeout_all_default" {
  provider = konnect-beta
  type = "MeshTimeout"
  name = "mesh-timeout-all-default"
  spec = {
    target_ref = {
      kind = "Mesh"
      proxy_types = [
         = "Sidecar"
      ]
    }
    to = [
      {
        target_ref = {
          kind = "Mesh"
        }
        default = {
          connection_timeout = "5s"
          idle_timeout = "1h"
          http = {
            request_timeout = "15s"
            stream_idle_timeout = "30m"
          }
        }
      }
    ]
    from = [
      {
        target_ref = {
          kind = "Mesh"
        }
        default = {
          connection_timeout = "10s"
          idle_timeout = "2h"
          http = {
            request_timeout = "0s"
            stream_idle_timeout = "1h"
            max_stream_duration = "0s"
          }
        }
      }
    ]
  }
  labels   = {
  "kuma.io/mesh" = konnect_mesh.my_mesh.name
  }
  cp_id    = konnect_mesh_control_plane.my_meshcontrolplane.id
  mesh     = konnect_mesh.my_mesh.name
}
resource "konnect_mesh_retry" "mesh_retry_all_default" {
  provider = konnect-beta
  type = "MeshRetry"
  name = "mesh-retry-all-default"
  spec = {
    target_ref = {
      kind = "Mesh"
    }
    to = [
      {
        target_ref = {
          kind = "Mesh"
        }
        default = {
          tcp = {
            max_connect_attempt = "5"
          }
          http = {
            num_retries = "5"
            per_try_timeout = "16s"
            back_off = {
              base_interval = "25ms"
              max_interval = "250ms"
            }
          }
          grpc = {
            num_retries = "5"
            per_try_timeout = "16s"
            back_off = {
              base_interval = "25ms"
              max_interval = "250ms"
            }
          }
        }
      }
    ]
  }
  labels   = {
  "kuma.io/mesh" = konnect_mesh.my_mesh.name
  }
  cp_id    = konnect_mesh_control_plane.my_meshcontrolplane.id
  mesh     = konnect_mesh.my_mesh.name
}
resource "konnect_mesh_circuit_breaker" "mesh_circuit_breaker_all_default" {
  provider = konnect-beta
  type = "MeshCircuitBreaker"
  name = "mesh-circuit-breaker-all-default"
  spec = {
    target_ref = {
      kind = "Mesh"
    }
    to = [
      {
        target_ref = {
          kind = "Mesh"
        }
        default = {
          connection_limits = {
            max_connections = "1024"
            max_pending_requests = "1024"
            max_retries = "3"
            max_requests = "1024"
          }
        }
      }
    ]
  }
  labels   = {
  "kuma.io/mesh" = konnect_mesh.my_mesh.name
  }
  cp_id    = konnect_mesh_control_plane.my_meshcontrolplane.id
  mesh     = konnect_mesh.my_mesh.name
}

If you want to not have these policies be added on creation of the mesh set the configuration: skipCreatingInitialPolicies:

apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  skipCreatingInitialPolicies: ['*']

type: Mesh
name: default
skipCreatingInitialPolicies: ['*']

You can also skip creating the default mesh by setting the control-plane configuration: KUMA_DEFAULTS_SKIP_MESH_CREATION=true.

Configuring your Mesh and multi-tenancy

Usage

Creating resources in a Mesh

Data plane proxies

Policies

Skipping default resource creation

All options

Help us make these docs great!

Still need help