In the Konnect UI, create a global control plane from Service Mesh, then create a zone with the Universal configuration type and follow the steps shown in the UI to deploy the zone control plane on your VM or bare metal machine.
This tutorial requires a Konnect Plus account. If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.
Using Konnect UI, you can create a global control plane and connect a Universal (VM or bare metal) zone. This guide creates a global control plane and connects a Universal zone control plane using the Konnect UI.
To deploy services and test traffic across the mesh, see Configure a Kong Mesh global control plane on Kubernetes with the Konnect UI.
Before you can add services or apply configurations, you must create a global control plane.
example-cp.The global control plane is now created but has no functionality until you connect a zone.
Add a zone to connect a data plane and receive configuration updates.
In the Name field, enter zone-1.
The zone name must use lowercase alphanumeric characters or hyphens, and start and end with an alphanumeric character.
Follow the steps shown in the UI to deploy the zone control plane on your machine.
Konnect automatically provisions a system account access token for the zone and includes it, along with the control plane ID and address, in the deployment steps. You don’t need to create a token manually.
Confirm the zone is connected to your global control plane:
zone-1 appears in the list of zones with an Online status.Stop the zone control plane running on your machine:
pkill -f kuma-cpDeleting the control plane also removes its zone and the system account access token that Konnect provisioned for it.
Remove the files and binaries created during setup:
rm -rf ~/kuma-cp kong-mesh-*How does a zone authenticate to the global control plane?
Each zone control plane authenticates to the Konnect-managed global control plane with an access token. When you create a zone with the UI wizard, Konnect provisions this token for you as a system account access token and includes it in the generated deployment instructions, so you don’t need to create one manually.
Konnect supports two types of access tokens:
kpat_ and tied to an individual user account. Use a PAT for interactive or one-off tasks.spat_ and tied to a system account rather than a person. We recommend system account tokens for zone authentication and automation because they aren’t tied to a user who might leave the organization.If you provision zones with automation instead of the UI wizard, such as with Terraform, create a system account, assign it the Connector role on the control plane, and generate a system account access token to authenticate the zone. For a full example, see Deploy Kong Mesh using Terraform and Konnect.