You can find instructions to install on kubernetes for standalone or multi-zone.
This page covers special steps for some Kubernetes distributions or version and some troubleshooting help.
Adding the Kong Mesh charts repository
To use Kong Mesh with Helm charts, add the Kong Mesh charts repository locally:
helm repo add kong-mesh https://kong.github.io/kong-mesh-charts
You can fetch all following updates by running
helm repo update.
You can find a full reference of helm configuration.
You can also set any control-plane configuration by using the prefix:
kuma.controlPlane.envVars.. Find detailed explanations in the page: control plane configuration.
Kong Mesh zones require a certificate to verify a connection between the control plane and a data plane proxy.
Kong Mesh Helm chart autogenerate self-signed certificate if the certificate isn’t explicitly set.
Argo CD uses
helm template to compare and apply Kubernetes YAMLs.
Helm template doesn’t work with chart logic to verify if the certificate is present.
This results in replacing the certificate on each Argo redeployment.
The solution to this problem is to explicitly set the certificates.
See “Data plane proxy to control plane communication” to learn how to preconfigure Kong Mesh with certificates.
On Kubernetes there are two ways to redirect traffic to the sidecar:
- init-containers which need to run with elevated privileges.
CNI which requires a little extra setup.
To use the CNI you can use the detailed instructions to configure the Kong Mesh CNI.
Native sidecar support
In version 1.28 Kubernetes introduced native sidecar containers.
This feature is tracked in #7541.
Starting from version 4.1 OpenShift uses
nftables instead of
So using init container for redirecting traffic to the proxy no longer works and you should use the
Webhooks on OpenShift 3.11
ValidatingAdmissionWebhook are disabled on OpenShift 3.11.
In order to make it work add the following
/etc/origin/master/master-config.yaml on the master node:
master-config.yaml restart the cluster and install