Deploy a self-managed control plane on a VM or Bare metal

1. Run redis as a daemon on port 26379 and set a default zone name:

   redis-server --port 26379 --daemonize yes
   redis-cli -p 26379 set zone local
   

2. Install and start demo-app on the default port 5000:

   npm install --prefix=app/
   npm start --prefix=app/
   

Create a token for Redis and a token for the app (all valid for 30 days):

kumactl generate dataplane-token --tag kuma.io/service=redis --valid-for=720h > kuma-token-redis
kumactl generate dataplane-token --tag kuma.io/service=app --valid-for=720h > kuma-token-app

This action requires authentication unless executed against a control plane running on localhost.

For Redis:

kuma-dp run \
  --cp-address=https://localhost:5678/ \
  --dns-enabled=false \
  --dataplane-token-file=kuma-token-redis \
  --dataplane="
  type: Dataplane
  mesh: default
  name: redis
  networking: 
    address: 127.0.0.1
    inbound: 
      - port: 16379
        servicePort: 26379
        serviceAddress: 127.0.0.1
        tags: 
          kuma.io/service: redis
          kuma.io/protocol: tcp
    admin:
      port: 9901"

And for the demo app:

kuma-dp run \
  --cp-address=https://localhost:5678/ \
  --dns-enabled=false \
  --dataplane-token-file=kuma-token-app \
  --dataplane="
  type: Dataplane
  mesh: default
  name: app
  networking: 
    address: 127.0.0.1
    outbound:
      - port: 6379
        tags:
          kuma.io/service: redis
    inbound: 
      - port: 15000
        servicePort: 5000
        serviceAddress: 127.0.0.1
        tags: 
          kuma.io/service: app
          kuma.io/protocol: http
    admin:
      port: 9902"

Navigate to 127.0.0.1:5000 and increment the counter.

You can view the sidecar proxies that are connected to the Kong Mesh control plane:

kubectl port-forward svc/kong-mesh-control-plane -n kong-mesh-system 5681:5681&

kumactl get dataplanes
# MESH      NAME                                              TAGS
# default   kuma-demo-app-68758d8d5d-dddvg.kuma-demo          app=kuma-demo-demo-app env=prod pod-template-hash=68758d8d5d protocol=http service=demo-app_kuma-demo_svc_5000 version=v8
# default   redis-master-657c58c859-5wkb4.kuma-demo           app=redis pod-template-hash=657c58c859 protocol=tcp role=master service=redis_kuma-demo_svc_6379 tier=backend

kumactl config control-planes add --name=XYZ --address=http://{address-to-kuma}:5681

By default the network is unsecure and not encrypted. We can change this with Kong Mesh by enabling the Mutual TLS policy to provision a dynamic Certificate Authority (CA) on the default Mesh resource that will automatically assign TLS certificates to our services (more specifically to the injected dataplane proxies running alongside the services).

We can enable Mutual TLS with a builtin CA backend by executing:

cat <<EOF | kumactl apply -f -
type: Mesh
name: default
mtls:
  enabledBackend: ca-1
  backends:
  - name: ca-1
    type: builtin
EOF

Once Mutual TLS has been enabled, Kong Mesh will not allow traffic to flow freely across our services unless we explicitly have a Traffic Traffic Permission policy that describes what services can be consumed by other services.

You can try to make requests to the demo application at 127.0.0.1:5000/ and you will notice that they will not work.

Now let’s add back the default traffic permission:

cat <<EOF | kumactl apply -f -
type: MeshTrafficPermission
name: allow-all
mesh: default
spec:
  from:
  - targetRef:
      kind: Mesh
    default:
      action: Allow
EOF

By doing so every request we now make on our demo application at 127.0.0.1:5000/ is not only working again, but it is automatically encrypted and secure.

As usual, you can visualize the Mutual TLS configuration and the Traffic Permission policies we have just applied via the GUI, the HTTP API or kumactl.

One of the most important policies that Kong Mesh provides out of the box is Mesh Metrics.

With Traffic Metrics we can leverage Prometheus and Grafana to provide powerful dashboards that visualize the overall traffic activity of our application and the status of the service mesh.

cat <<EOF | kumactl apply -f -
type: Mesh
name: default
mtls:
  enabledBackend: ca-1
  backends:
  - name: ca-1
    type: builtin
metrics:
  enabledBackend: prometheus-1
  backends:
  - name: prometheus-1
    type: prometheus
    conf:
      tls:
        mode: disabled
EOF

This will enable the prometheus metrics backend on the default Mesh and automatically collect metrics for all of our traffic.

Increment the counter to generate traffic, and access the dashboard at 127.0.0.1:3000 with default credentials for both the username (admin) and the password (admin).

Kong Mesh automatically installs three dashboard that are ready to use:

• Kong Mesh Mesh: to visualize the status of the overall Mesh.
• Kong Mesh Dataplane: to visualize metrics for a single individual dataplane.
• Kong Mesh Service to Service: to visualize traffic metrics for our services.

You can now explore the dashboards and see the metrics being populated over time.