Kong Mesh with OpenShift

You can run the following script to automatically detect the operating system and download Kong Mesh:

$ curl -L https://docs.konghq.com/mesh/installer.sh | VERSION=1.0.4 sh -

You can also download the distribution manually. Download a distribution for the client host from where you will be executing the commands to access Kubernetes:

• CentOS
• Red Hat
• Debian
• Ubuntu
• macOS

Then, extract the archive with:

$ tar xvzf kong-mesh-1.0.4*.tar.gz

kumactl install control-plane --cni-enabled --license-path=/path/to/license.json | oc apply -f -

Starting from version 4.1, OpenShift uses nftables instead of iptables. So, using init container for redirecting traffic to the proxy no longer works. Instead, we use kuma-cni, which can be installed with the --cni-enabled flag.

By default, MutatingAdmissionWebhook and ValidatingAdmissionWebhook are disabled on OpenShift 3.11.

To make them work, add the following pluginConfig into /etc/origin/master/master-config.yaml on the master node:

admissionConfig:
  pluginConfig:
    MutatingAdmissionWebhook:
      configuration:
        apiVersion: apiserver.config.k8s.io/v1alpha1
        kubeConfigFile: /dev/null
        kind: WebhookAdmission
    ValidatingAdmissionWebhook:
      configuration:
        apiVersion: apiserver.config.k8s.io/v1alpha1
        kubeConfigFile: /dev/null
        kind: WebhookAdmission

After updating master-config.yaml, restart the cluster and install control-plane:

$ ./kumactl install control-plane --license-path=/path/to/license.json | oc apply -f -

Kong Mesh ships with a read-only GUI that you can use to retrieve Kong Mesh resources. By default, the GUI listens on the API port 5681 and defaults to :5681/gui.

To access Kong Mesh, port-forward the API service with:

$ oc port-forward svc/kuma-control-plane -n kuma-system 5681:5681

Now you can navigate to 127.0.0.1:5681/gui to see the GUI.

You can use Kong Mesh with oc to perform read and write operations on Kong Mesh resources. For example:

$ oc get meshes

NAME          AGE
default       1m

Or, you can enable mTLS on the default Mesh with:

$ echo "apiVersion: kuma.io/v1alpha1
  kind: Mesh
  metadata:
    name: default
  spec:
    mtls:
      enabledBackend: ca-1
      backends:
      - name: ca-1
        type: builtin" | oc apply -f -

Kong Mesh ships with a read-only HTTP API that you use to retrieve Kong Mesh resources. By default, the HTTP API listens on port 5681.

To access Kong Mesh, port-forward the API service with:

$ oc port-forward svc/kuma-control-plane -n kuma-system 5681:5681

Now you can navigate to 127.0.0.1:5681 to see the HTTP API.

You can use the kumactl CLI to perform read-only operations on Kong Mesh resources. The kumactl binary is a client to the Kong Mesh HTTP API. To use it, first port-forward the API service with:

$ oc port-forward svc/kuma-control-plane -n kuma-system 5681:5681

Then run kumactl. For example:

$ kumactl get meshes

NAME          mTLS      METRICS      LOGGING   TRACING
default       off       off          off       off

You can configure kumactl to point to any remote kuma-cp instance by running:

$ kumactl config control-planes add --name=XYZ --address=http://{address-to-kong-mesh}:5681