Secure access across services

Uses: Kong Mesh

This page explains how access is secured across a Kong Mesh deployment:

Kong Mesh stores autogenerated certificates and other files in a working directory. The default directory is $HOME/.kuma. You can change it by setting the KUMA_GENERAL_WORK_DIR environment variable.

This section is not to be confused with the mTLS policy that you can apply to a Mesh to secure service-to-service traffic.

Data plane proxy to control plane communication

A data plane proxy connects to the control plane to fetch its configuration, including mTLS certificates.

Data plane proxy to control plane TLS

Because the data plane proxy and the control plane exchange sensitive information, all communication must be encrypted with TLS. By default, the control plane server that data plane proxies connect to is secured by TLS with autogenerated certificates.

We recommend that data plane proxies verify the identity of the control plane. To do so, they need to obtain the CA used to generate the control plane server’s certificate.

This CA is not the same CA used for service-to-service communication.

Override data plane proxy TLS certificates

If overridden, Kong Mesh uses the certificates to protect not only data plane proxy to control plane traffic, but also user to control plane traffic and control plane to control plane traffic.

To configure the control plane and data plane proxies with custom TLS certificates:

Data plane proxy to control plane authentication

See Data plane proxy authentication and Zone proxy authentication.

Prometheus to control plane communication

You can enable TLS on the Monitoring Assignment Discovery Service. By default, it uses the same certificate as CP-to-DP communication, configured with the --tls-general options. You can enable it by using the KUMA_MONITORING_ASSIGNMENT_SERVER_TLS_ENABLED=true environment variable.

Configure Kong Mesh’s Prometheus SD with the correct TLS settings using the Prometheus docs.

User to control plane communication

Users and automation tools can interact with the control plane via the API Server using curl, kumactl, or similar tools. The API Server is exposed by default on HTTP (:5681) and HTTPS (:5682).

User to control plane TLS

The API Server HTTPS server is secured by default by autogenerated certificates.

Override user to control plane TLS certificates

To configure the API Server with custom TLS certificates:

User to control plane authentication

See API Server authentication.

Control plane to control plane (Multi-zone)

A zone control plane connects to a global control plane for policy configuration.

Control plane to control plane TLS

Because the global control plane and the zone control plane exchange sensitive information, all communication must be encrypted with TLS. By default, the global control plane server that zone control planes connect to is secured by TLS with autogenerated certificates.

We recommend that zone control planes verify the identity of the global control plane. To do so, they need to obtain the CA used to generate the global control plane server’s certificate.

Override control plane to control plane TLS certificates

To configure the global and zone control planes with custom TLS certificates:

Control plane to control plane authentication

Define firewall rules on the global control plane to only accept connections from known IPs of the zone control planes.

Third-party extensions, cloud implementations, or commercial offerings may extend authentication support.

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!