You are browsing unreleased documentation. See the latest documentation here.
Use Kong Mesh
After Kong Mesh is installed, you can access the control plane via the following methods:
Access method | Mode | Permissions |
---|---|---|
Kong Mesh user interface | Kubernetes and Universal | Read-only |
HTTP API | Kubernetes and Universal | Read-only |
kumactl |
Kubernetes | Read-only |
kumactl |
Universal | Read and write |
kubectl |
Kubernetes | Read and write |
By accessing the control plane using one of these methods, you can see the current Kong Mesh configuration or with some methods, you can edit the configuration.
Kong Mesh - being an application that wants to improve the underlying connectivity between your services by making the underlying network more reliable - also comes with some networking requirements itself.
Control Plane ports
First and foremost, the kuma-cp
application is a server that offers a number of services - some meant for internal consumption by kuma-dp
data-planes, some meant for external consumption by kumactl
, the HTTP API, the GUI or other systems.
The number and type of exposed ports depends on the mode in which the control plane is running as:
Global Control Plane
When Kong Mesh is run as a distributed service mesh, the Global control plane exposes the following ports:
- TCP
-
5443
: The port for the admission webhook, only enabled inKubernetes
. The default Kuberneteskong-mesh-control-plane
service exposes this port on443
. -
5680
: the HTTP server that returns the health status of the control-plane. -
5681
: the HTTP API server that is being used bykumactl
, and that you can also use to retrieve Kong Mesh’s policies and - when running inuniversal
- that you can use to apply new policies. Manipulating the dataplane resources is not possible. It also exposes the Kong Mesh GUI at/gui
-
5682
: HTTPS version of the services available under5681
-
5683
: gRPC Intercommunication CP server used internally by Kong Mesh to communicate between CP instances. -
5685
: the Kong Mesh Discovery Service port, leveraged in multi-zone deployment
-
Zone Control Plane
When Kong Mesh is run as a distributed service mesh, the Zone control plane exposes the following ports:
- TCP
-
5443
: The port for the admission webhook, only enabled inKubernetes
. The default Kuberneteskong-mesh-control-plane
service exposes this port on443
. -
5676
: the Monitoring Assignment server that responds to discovery requests from monitoring tools, such asPrometheus
, that are looking for a list of targets to scrape metrics from, e.g. a list of all dataplanes in the mesh. -
5678
: the server for the control-plane to data-planes communication (bootstrap configuration, xDS to retrieve their configuration, SDS to retrieve mTLS certificates). -
5680
: the HTTP server that returns the health status and metrics of the control-plane. -
5681
: the HTTP API server that is being used bykumactl
, and that you can also use to retrieve Kong Mesh’s policies and - when running inuniversal
- you can only manage the dataplane resources. When not connected to global, It also exposes the Kong Mesh GUI at/gui
-
5682
: HTTPS version of the services available under5681
-
5683
: gRPC Intercommunication CP server used internally by Kong Mesh to communicate between CP instances.
-