Kong Mesh in Konnect
Konnect can host and operate the Kong Mesh global control plane for you. Instead of running and maintaining a global control plane yourself, you create one in Konnect and connect your own zone control planes to it. This gives you a Kong-managed global control plane, a unified view of your Kong Mesh, Kong Ingress Controller, and Konnect entities in one place, and a UI-driven setup for connecting zones.
Architecture
A Kong Mesh deployment in Konnect is always multi-zone: Konnect runs the global control plane, and you run one or more zone control planes in your own environment. Each zone control plane connects to the Konnect-managed global control plane and manages the data plane proxies running alongside your services in that zone.
The global and zone control planes have distinct responsibilities. The global control plane in Konnect is the source of truth for meshes and policies, and it synchronizes them to every connected zone. Each zone control plane registers its own data plane proxies, zone ingresses, and zone egresses, and reports their status back to the global control plane so you can see all zones from Konnect. Because the global control plane is managed by Konnect, you apply mesh and policy changes through Konnect or kumactl rather than directly on a zone.
flowchart TB
subgraph konnect[Konnect]
global[Global control plane]
end
subgraph env[Your environment]
zone1[Zone control plane]
zone2[Zone control plane]
dp1[Data plane proxies]
dp2[Data plane proxies]
end
global <-->|KDS| zone1
global <-->|KDS| zone2
zone1 --- dp1
zone2 --- dp2
Deploy a zone
You can create a global control plane and connect a zone from the Konnect UI, the Konnect API, or Terraform. The zone control plane itself can run on Kubernetes or on Universal (a VM or bare metal machine).
Kubernetes
Create a global control plane and connect a Kubernetes zone using the Konnect UI, the Konnect API, or Terraform.
Universal
Create a global control plane and connect a Universal (VM or bare metal) zone using the Konnect UI or API.
Move an existing mesh to Konnect
If you already run Kong Mesh, you can move it to a Konnect-managed global control plane without recreating your workloads.
Frequently asked questions
How does a zone connect to the global control plane?
A zone control plane connects to the global control plane over the Kong Mesh Discovery Service (KDS), a gRPC stream. When you create a zone, Konnect provides the values that the zone control plane needs to connect:
- The KDS global address, in the form
grpcs://{region}.mesh.sync.konghq.com:443, where{region}is your Konnect geographic region. - The control plane ID, which identifies the global control plane the zone belongs to.
- A token that the zone control plane uses to authenticate.
Once the zone control plane starts with these values, it connects to Konnect, appears as a zone in the Service Mesh area, and begins receiving configuration.
How does a zone authenticate to the global control plane?
Each zone control plane authenticates to the Konnect-managed global control plane with an access token. When you create a zone with the UI wizard, Konnect provisions this token for you as a system account access token and includes it in the generated deployment instructions, so you don’t need to create one manually.
Konnect supports two types of access tokens:
-
Personal access token (PAT): Prefixed with
kpat_and tied to an individual user account. Use a PAT for interactive or one-off tasks. -
System account access token (SAT): Prefixed with
spat_and tied to a system account rather than a person. We recommend system account tokens for zone authentication and automation because they aren’t tied to a user who might leave the organization.
If you provision zones with automation instead of the UI wizard, such as with Terraform, create a system account, assign it the Connector role on the control plane, and generate a system account access token to authenticate the zone. For a full example, see Deploy Kong Mesh using Terraform and Konnect.