A data plane proxy connects to the control plane to fetch its configuration, including mTLS certificates.
Because the data plane proxy and the control plane exchange sensitive information, all communication must be encrypted with TLS.
By default, the control plane server that data plane proxies connect to is secured by TLS with autogenerated certificates.
We recommend that data plane proxies verify the identity of the control plane. To do so, they need to obtain the CA used to generate the control plane server’s certificate.
This CA is not the same CA used for service-to-service communication.
If overridden, Kong Mesh uses the certificates to protect not only data plane proxy to control plane traffic, but also user to control plane traffic and control plane to control plane traffic.
To configure the control plane and data plane proxies with custom TLS certificates:
-
Prepare certificates:
Generate a TLS pair with a PKI of your choice and store it in PEM-encoded format in /tmp/tls.crt and /tmp/tls.key.
Store the CA used to sign this pair in /tmp/ca.crt.
You can also use kumactl to generate self-signed certificates:
kumactl generate tls-certificate \
--type=server \
--hostname=$KUMA_CP_DNS_NAME \
--cert-file=/tmp/tls.crt \
--key-file=/tmp/tls.key
Since tls.crt is a self-signed certificate, it also serves as the CA:
cp /tmp/tls.crt /tmp/ca.crt
- Create a secret in the namespace where the control plane is installed:
kubectl create secret generic general-tls-certs -n kong-mesh-system \
--from-file=tls.crt=/tmp/tls.crt \
--from-file=tls.key=/tmp/tls.key \
--from-file=ca.crt=/tmp/ca.crt
- Install or upgrade Kong Mesh with the generated certificates:
helm upgrade --install kong-mesh kong-mesh/kong-mesh \
--namespace kong-mesh-system \
--set controlPlane.tls.general.secretName=general-tls-certs \
--set "controlPlane.tls.general.caBundle=$(cat /tmp/ca.crt | base64)"
The data plane proxy injector in the control plane automatically provides the CA to the Kong Mesh sidecar so it can verify the control plane’s identity.
If you get an error like the following, make sure you are using a supported certificate type (PEM) and that the certificate doesn’t contain incomplete or corrupted data:
Warning FailedCreate 3m39s (x18 over 14m) replicaset-controller Error creating: Internal error occurred: failed calling webhook "namespace-kuma-injector.kuma.io": could not get REST client: unable to load root certificates: unable to parse bytes as PEM block
-
Prepare certificates:
Generate a TLS pair with a PKI of your choice and store it in PEM-encoded format in /tmp/tls.crt and /tmp/tls.key.
Store the CA used to sign this pair in /tmp/ca.crt.
You can also use kumactl to generate self-signed certificates:
kumactl generate tls-certificate \
--type=server \
--hostname=$KUMA_CP_DNS_NAME \
--cert-file=/tmp/tls.crt \
--key-file=/tmp/tls.key
Since tls.crt is a self-signed certificate, it also serves as the CA:
cp /tmp/tls.crt /tmp/ca.crt
- Configure the control plane with the generated certificates:
KUMA_GENERAL_TLS_CERT_FILE=/tmp/tls.crt \
KUMA_GENERAL_TLS_KEY_FILE=/tmp/tls.key \
kuma-cp run
- Configure the data plane proxy with the CA:
kuma-dp run \
--cp-address=https://<KUMA_CP_DNS_NAME>:5678 \
--ca-cert-file=/tmp/ca.crt \
--dataplane-file=dp.yaml \
--dataplane-token-file=/tmp/kuma-dp-redis-1-token
You can also provide the CA via the environment variable KUMA_CONTROL_PLANE_CA_CERT.
See Data plane proxy authentication and Zone proxy authentication.