Skip to content
Kong Logo | Kong Docs Logo
search
  • We're Hiring!
  • Docs
    • Kong Gateway
    • Kong Konnect
    • Kong Mesh
    • Plugin Hub
    • decK
    • Kubernetes Ingress Controller
    • Insomnia
    • Kuma

    • Docs contribution guidelines
  • Plugin Hub
  • Support
  • Community
  • Kong Academy
Get a Demo Start Free Trial
  • Kong Gateway
  • Kong Konnect
  • Kong Mesh
  • Plugin Hub
  • decK
  • Kubernetes Ingress Controller
  • Insomnia
  • Kuma

  • Docs contribution guidelines
  • 2.2.x (latest)
  • 2.1.x
  • 2.0.x
  • 1.9.x
  • 1.8.x
  • 1.7.x
  • 1.6.x
  • 1.5.x
  • 1.4.x
  • 1.3.x
  • 1.2.x

github-edit-pageEdit this page

report-issueReport an issue

enterprise-switcher-iconSwitch to OSS

On this pageOn this page
  • Usage
  • Example use cases
    • Restrict which Pods in Kubernetes namespaces can join a Mesh
    • Enforce consistency of tags
    • Multizone mesh segmentation
Kong Mesh
2.2.x (latest)
  • Home
  • Kong Mesh
  • Production
  • Secure Deployment
  • Configure data plane proxy membership

Configure data plane proxy membership

Data plane proxy membership constraints let us define a set of rules that are executed when a data plane proxy is joining a mesh.

Constraints contains two lists:

  • Requirements - a data plane proxy has to fulfill at least one requirement to join a mesh.
  • Restrictions - a data plane proxy cannot fulfill any restriction to join a mesh.

Keep in mind that membership rules are enforced only on new data plane proxies. If we put rules that existing data plane proxies violate, we need to remove them manually from the mesh.

Usage

Kubernetes
Universal
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  constraints:
    dataplaneProxy:
      requirements:
      - tags: # set of required tags. You can specify '*' in value to require non-empty value of tag
          kuma.io/zone: east
      restrictions:
      - tags: # set of restricted tags. You can specify '*' in value to restrict tag with any value
          kuma.io/service: backend
type: Mesh
name: default
constraints:
  dataplaneProxy:
    requirements:
      - tags: # set of required tags. You can specify '*' in value to require non-empty value of tag
          kuma.io/zone: east
    restrictions:
      - tags: # set of restricted tags. You can specify '*' in value to restrict tag with any value
          kuma.io/service: backend

Example use cases

Restrict which Pods in Kubernetes namespaces can join a Mesh

Kubernetes
Universal
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  constraints:
    dataplaneProxy:
      requirements:
      - tags:
          kuma.io/namespace: ns-1
      - tags:
          kuma.io/namespace: ns-2
type: Mesh
name: default
constraints:
  dataplaneProxy:
    requirements:
      - tags:
          kuma.io/namespace: ns-1
      - tags:
          kuma.io/namespace: ns-2

By default, any Pod can join any mesh by changing its kuma.io/mesh annotation. We can restrict that by relying on autogenerated k8s.kuma.io/namespace tag. In this example, only data plane proxies from ns-1 and ns-2 can join a default mesh. If there is another mesh without any requirements, Pods from ns-1 and ns-2 namespaces can also join that mesh.

Enforce consistency of tags

Kubernetes
Universal
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  constraints:
    dataplaneProxy:
      requirements:
      - tags:
          team: '*'
          cloud: '*'
      restrictions:
      - tags:
          legacy: '*'
type: Mesh
name: default
constraints:
  dataplaneProxy:
    requirements:
      - tags:
          team: '*'
          cloud: '*'
    restrictions:
      - tags:
          legacy: '*'

By using these constraints, we can enforce consistency of tags in Kong Mesh deployment. With the example above, every data plane proxy must have non-empty team and cloud tags and cannot have legacy tag.

Multizone mesh segmentation

Kubernetes
Universal
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  constraints:
    dataplaneProxy:
      requirements:
      - tags:
          kuma.io/zone: east
---
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: demo
spec:
  constraints:
    dataplaneProxy:
      requirements:
        - tags:
            kuma.io/zone: west
type: Mesh
name: default
constraints:
  dataplaneProxy:
    requirements:
    - tags:
        kuma.io/zone: east
---
type: Mesh
name: demo
constraints:
  dataplaneProxy:
    requirements:
      - tags:
          kuma.io/zone: west

This way, only data plane proxies from the east zone can join default mesh and only data plane proxies from the west zone can join demo mesh.

Thank you for your feedback.
Was this page useful?
  • Kong
    THE CLOUD CONNECTIVITY COMPANY

    Kong powers reliable digital connections across APIs, hybrid and multi-cloud environments.

    • Company
    • Customers
    • Events
    • Investors
    • Careers Hiring!
    • Partners
    • Press
    • Contact
  • Products
    • Kong Konnect
    • Kong Gateway
    • Kong Mesh
    • Get Started
    • Pricing
  • Resources
    • eBooks
    • Webinars
    • Briefs
    • Blog
    • API Gateway
    • Microservices
  • Open Source
    • Install Kong Gateway
    • Kong Community
    • Kubernetes Ingress
    • Kuma
    • Insomnia
  • Solutions
    • Decentralize
    • Secure & Govern
    • Create a Dev Platform
    • API Gateway
    • Kubernetes
    • Service Mesh
Star
  • Terms•Privacy
© Kong Inc. 2023