Interacting with the Kong Mesh control plane

Uses: Kong Mesh

Access method	Deployment mode	Permissions
Kong Mesh UI	Kubernetes and Universal	Read-only
HTTP API	Kubernetes and Universal	Read-only
`kumactl`	Kubernetes	Read-only
`kumactl`	Universal	Read and write
`kubectl`	Kubernetes	Read and write

Kubernetes

Kong Mesh ships with a read-only UI that you can use to retrieve Kong Mesh resources. By default the UI listens on the API port and defaults to :5681/gui.

To access the Kong Mesh UI, you must first port-forward to make the port accessible outside of the cluster:

kubectl port-forward svc/kong-mesh-control-plane -n kong-mesh-system 5681:5681

Copied!

You can then navigate to 127.0.0.1:5681/gui to see the UI.

You can use kubectl to perform read and write operations on Kong Mesh resources.

For example, you can use the following command to enable mTLS on the default mesh:

echo "apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  mtls:
    enabledBackend: ca-1
    backends:
    - name: ca-1
      type: builtin" | kubectl apply -f -

Copied!

Kong Mesh ships with a read-only HTTP API that you can use to retrieve Kong Mesh resources.

By default the HTTP API listens on port 5681. To access the API, you must first port-forward to make the port accessible outside of the cluster:

kubectl port-forward svc/kong-mesh-control-plane -n kong-mesh-system 5681:5681

Copied!

You can then navigate to 127.0.0.1:5681 to see the HTTP API.

You can use the kumactl CLI to perform read-only operations on Kong Mesh resources. The kumactl binary uses the Kong Mesh HTTP API, so you must first port-forward to make the HTTP API port accessible outside of the cluster:

kubectl port-forward svc/kong-mesh-control-plane -n kong-mesh-system 5681:5681

Copied!

You can then run kumactl, for example:

kumactl get meshes

Copied!

You can configure kumactl to point to any zone kuma-cp instance by running:

kumactl config control-planes add --name=$CP_NAME --address=http://$HOST:5681

Copied!

Universal

Kong Mesh ships with a read-only UI that you can use to retrieve Kong Mesh resources. By default the UI listens on the API port and defaults to :5681/gui.

Kong Mesh ships with a read and write HTTP API that you can use to perform operations on Kong Mesh resources. By default the HTTP API listens on port 5681.

You can use the kumactl CLI to perform read and write operations on Kong Mesh resources. The kumactl binary is a client to the Kong Mesh HTTP API. For example:

You can then run kumactl, for example:

kumactl get meshes

Copied!

You can configure kumactl to point to any zone kuma-cp instance by running:

kumactl config control-planes add --name=$CP_NAME --address=http://$HOST:5681

Copied!

You can enable mTLS on the default mesh with:

echo "type: Mesh
name: default
mtls:
  enabledBackend: ca-1
  backends:
  - name: ca-1
    type: builtin" | kumactl apply -f -

Copied!

Kong Mesh improves connectivity between your services and makes the network more reliable. However, it also has its own networking requirements.

Control plane ports

The kuma-cp application is a server that offers a number of services. Some are meant for internal consumption by kuma-dp data plane proxies, and some are meant for external consumption by kumactl, the HTTP API, the UI, or other systems.

The number and type of exposed ports depends on the type of control plane.

Global control plane

When Kong Mesh runs as a distributed service mesh, the global control plane exposes the following TCP ports:

5443: The port for the admission webhook, only enabled in Kubernetes. The default Kubernetes kong-mesh-control-plane service exposes this port on 443.
5680: The HTTP server that returns the health status and metrics of the control plane.
5681: The HTTP API server used by kumactl, which you can also use to retrieve Kong Mesh’s policies and, when running in universal, that you can use to apply new policies. Manipulating data plane resources is not possible. It also exposes the Kong Mesh UI at /gui.
5682: The HTTPS version of the services available under 5681.
5683: The gRPC intercommunication CP server used internally by Kong Mesh to communicate between CP instances.
5685: The Kong Mesh Discovery Service port, leveraged in multi-zone deployments.

Zone control plane

When Kong Mesh is run as a distributed service mesh, the zone control plane exposes the following TCP ports:

5443: The port for the admission webhook, only enabled in Kubernetes. The default Kubernetes kong-mesh-control-plane service exposes this port on 443.
5676: The Monitoring Assignment server that responds to discovery requests from monitoring tools, such as Prometheus, that are looking for a list of targets to scrape metrics from.
5678: The server for the control plane to data plane proxy communication (bootstrap configuration, xDS to retrieve data plane proxy configuration, SDS to retrieve mTLS certificates).
5680: The HTTP server that returns the health status and metrics of the control plane.
5681: The HTTP API server that is being used by kumactl. You can also use it to retrieve Kong Mesh’s policies and, when running in Universal mode, you can manage data plane resources. When not connected to a global control plane, it also exposes the Kong Mesh UI at /gui.
5682: The HTTPS version of the services available under 5681.
5683: The gRPC intercommunication CP server used internally by Kong Mesh to communicate between CP instances.

Interacting with the Kong Mesh control plane

Kubernetes

Universal

Control plane ports

Global control plane

Zone control plane

Help us make these docs great!

Still need help