You are browsing documentation for an older version. See the latest documentation here.

Applying Policies

Once installed, Kong Mesh can be configured via its policies. You can apply policies with kumactl on Universal, and with kubectl on Kubernetes. Regardless of what environment you use, you can always read the latest Kong Mesh state with kumactl on both environments.

We follow the best practices. You should always change your Kubernetes state with CRDs, that’s why Kong Mesh disables kumactl apply [..] when running in K8s environments.

echo "
  apiVersion: kuma.io/v1alpha1
  kind: ..
  spec: ..
" | kubectl apply -f -

echo "
  type: ..
  spec: ..
" | kumactl apply -f -

In addition to kumactl, you can also retrieve the state via the Kong Mesh HTTP API.

Applying policies on Zone and Global Control Planes

Multi-zone deployment consists of Global Control Plane (Global CP) deployment with one or many Zone Control Planes (Zone CP) connected to it. Each Zone CP represents a single cluster (i.e. Kubernetes or Universal cluster). Policies can be applied on both Global and Zone CPs.

When policy is applied on Global CP:

• it is propagated to all Zone CPs and applied to all matched data plane proxies in all zones
• Global CP is a source of truth for the policy (when Global CP is down it’s not possible to create/update those policies)
• You cannot manage this policy (modify / delete) on Zone CP

When policy is applied on Zone CP:

• it is applied only to matched data plane proxies in the same zone
• Zone CP is a source of truth for the policy (when Global CP is down it’s still possible to create/update zone-originated policies)
• you cannot manage this policy (modify / delete) on Global CP
• it is synced to Global CP to be visible in the UI and API calls

Applying policy on Zone CP requires setting kuma.io/origin label to zone (zone is a keyword, not a name of the zone):

apiVersion: kuma.io/v1alpha1
kind: MeshTimeout
metadata:
  name: timeout-on-zone-cp
  namespace: kong-mesh-system
  labels:
    kuma.io/origin: zone
    kuma.io/mesh: default
spec:
  targetRef:
    kind: Mesh
  to:
  - targetRef:
      kind: Mesh
    default:
      idleTimeout: 20s
      connectionTimeout: 2s
      http:
        requestTimeout: 2s

type: MeshTimeout
name: timeout-on-zone-cp
mesh: default
labels:
  kuma.io/origin: zone
spec:
  targetRef:
    kind: Mesh
  to:
  - targetRef:
      kind: Mesh
    default:
      idleTimeout: 20s
      connectionTimeout: 2s
      http:
        requestTimeout: 2s

Validation of the origin label can be disabled by configuring a zone CP with KUMA_MULTIZONE_ZONE_DISABLE_ORIGIN_LABEL_VALIDATION: "true".