Configure data plane proxy membership

Data plane proxy membership constraints allow you to define a set of rules that are executed when a data plane proxy is joining a mesh. These help determine if a data plane proxy can or can’t join the mesh.

Constraints contains two lists:

• Requirements: A data plane proxy has to fulfill at least one requirement to join a mesh.
• Restrictions: If a data plane proxy matches any of the restrictions, it can’t join the mesh.

Membership rules are enforced only on new data plane proxies. If existing data plane proxies violate rules, you must remove them manually from the mesh.

Data plane proxy constraints are defined using the constrains.dataplaneProxy.requirements and constrains.dataplaneProxy.restrictions parameters.

The following examples show you different ways you can configure data plane proxy membership constraints.

Restrict data plane membership based on namespaces

In this example, we allow data plane proxies to join the mesh if they are in either the ns-1 namespace or the ns-2 namespace:

apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  constraints:
    dataplaneProxy:
      requirements:
      - tags:
          kuma.io/namespace: ns-1
      - tags:
          kuma.io/namespace: ns-2

type: Mesh
name: default
constraints:
  dataplaneProxy:
    requirements:
      - tags:
          kuma.io/namespace: ns-1
      - tags:
          kuma.io/namespace: ns-2

Enforce consistency of tags

In this example, every data plane proxy must have non-empty team and cloud tags and can’t have a legacy tag.

apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  constraints:
    dataplaneProxy:
      requirements:
      - tags:
          team: '*'
          cloud: '*'
      restrictions:
      - tags:
          legacy: '*'

type: Mesh
name: default
constraints:
  dataplaneProxy:
    requirements:
      - tags:
          team: '*'
          cloud: '*'
    restrictions:
      - tags:
          legacy: '*'

Multi-zone mesh segmentation

In this example, only data plane proxies from the east zone can join the default mesh, and only data plane proxies from the west zone can join the demo mesh.

apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  constraints:
    dataplaneProxy:
      requirements:
      - tags:
          kuma.io/zone: east
---
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: demo
spec:
  constraints:
    dataplaneProxy:
      requirements:
        - tags:
            kuma.io/zone: west

type: Mesh
name: default
constraints:
  dataplaneProxy:
    requirements:
    - tags:
        kuma.io/zone: east
---
type: Mesh
name: demo
constraints:
  dataplaneProxy:
    requirements:
      - tags:
          kuma.io/zone: west