Deploy a multi-zone global control plane
To set up a multi-zone deployment we will need to:
Set up the global control plane
The global control plane must run on a dedicated cluster (unless using “Universal on Kubernetes” mode), and cannot be assigned to a zone.
Set up the zone control planes
You need the following values to pass to each zone control plane setup:
zone – the zone name. An arbitrary string. This value registers the zone control plane with the global control plane.
kds-global-address – the external IP and port of the global control plane.
Verify control plane connectivity
If your global control plane runs on Kubernetes, you’ll need to configure your
kumactl like so:
# forward traffic from local pc into global control plane in the cluster
kubectl -n kong-mesh-system port-forward svc/kong-mesh-control-plane 5681:5681 &
# configure control plane for kumactl
kumactl config control-planes add \
--name global-control-plane \
--address http://localhost:5681 \
You can run
kumactl get zones, or check the list of zones in the web UI for the global control plane, to verify zone control plane connections.
When a zone control plane connects to the global control plane, the
Zone resource is created automatically in the global control plane.
The Zone Ingress tab of the web UI also lists zone control planes that you
deployed with zone ingress.
Ensure mTLS is enabled on the multi-zone meshes
MTLS is mandatory to enable cross-zone service communication.
mTLS can be configured in your mesh configuration as indicated in the mTLS section.
This is required because Kong Mesh uses the Server Name Indication field, part of the TLS protocol, as a way to pass routing information cross zones.
Cross-zone communication details
For this example we will assume we have a service running in a Kubernetes zone exposing a
kuma.io/service with value
The following examples are running in the remote zone trying to access the previously mentioned service.
For security reasons it’s not possible to customize the
kuma.io/service in Kubernetes.
If you want to have the same service running on both Universal and Kubernetes make sure to align the Universal’s data plane inbound to have the same
kuma.io/service as the one in Kubernetes or leverage TrafficRoute.
Delete a zone
To delete a
Zone we must first shut down the corresponding Kong Mesh zone control plane instances. As long as the Zone CP is running this will not be possible, and Kong Mesh returns a validation error like:
zone: unable to delete Zone, Zone CP is still connected, please shut it down first
When the Zone CP is fully disconnected and shut down, then the
Zone can be deleted. All corresponding resources (like
DataplaneInsight) will be deleted automatically as well.
Disable a zone
enabled property value to
false in the global control plane:
With this setting, the global control plane will stop exchanging configuration with this zone.
As a result, the zone’s ingress from zone-1 will be deleted from other zone and traffic won’t be routed to it anymore.
The zone will show as Offline in the GUI and CLI.