Skip to content
2023 API Summit Hackathon: Experiment with AI for APIs (August 28 - September 27) Learn More →
Kong Logo | Kong Docs Logo
search
  • We're Hiring!
  • Docs
    • Kong Gateway
      Lightweight, fast, and flexible cloud-native API gateway
      Kong Konnect
      Single platform for SaaS end-to-end connectivity
      Kong Mesh
      Enterprise service mesh based on Kuma and Envoy
      decK
      Helps manage Kong’s configuration in a declarative fashion
      Kong Ingress Controller
      Works inside a Kubernetes cluster and configures Kong to proxy traffic
      Kong Gateway Operator
      Manage your Kong deployments on Kubernetes using YAML Manifests
      Insomnia
      Collaborative API development platform
      Kuma
      Open-source distributed control plane with a bundled Envoy Proxy integration
  • API Specs
  • Plugin Hub
    • Explore the Plugin Hub
      View all plugins View all plugins View all plugins arrow image
    • Functionality View all View all arrow image
      View all plugins
      Authentication's icon
      Authentication
      Protect your services with an authentication layer
      Security's icon
      Security
      Protect your services with additional security layer
      Traffic Control's icon
      Traffic Control
      Manage, throttle and restrict inbound and outbound API traffic
      Serverless's icon
      Serverless
      Invoke serverless functions in combination with other plugins
      Analytics & Monitoring's icon
      Analytics & Monitoring
      Visualize, inspect and monitor APIs and microservices traffic
      Transformations's icon
      Transformations
      Transform request and responses on the fly on Kong
      Logging's icon
      Logging
      Log request and response data using the best transport for your infrastructure
  • Support
  • Community
  • Kong Academy
Get a Demo Start Free Trial
Kong Mesh
2.4.x (latest)
  • Home icon
  • Kong Mesh
  • Production
  • Use Kong Mesh
github-edit-pageEdit this page
report-issueReport an issue
  • Kong Gateway
  • Kong Konnect
  • Kong Mesh
  • Plugin Hub
  • decK
  • Kong Ingress Controller
  • Kong Gateway Operator
  • Insomnia
  • Kuma

  • Docs contribution guidelines
  • 2.4.x (latest)
  • 2.3.x
  • 2.2.x
  • 2.1.x
  • 2.0.x
  • 1.9.x
  • 1.8.x
  • 1.7.x
  • 1.6.x
  • 1.5.x
  • 1.4.x
  • 1.3.x
  • 1.2.x
enterprise-switcher-icon Switch to OSS
On this pageOn this page
  • Control Plane ports
    • Standalone Control Plane
    • Global Control Plane
    • Zone Control Plane

Use Kong Mesh

After Kong Mesh is installed, you can access the control plane via the following methods:

Access method Mode Permissions
Kong Mesh user interface Kubernetes and Universal Read-only
HTTP API Kubernetes and Universal Read-only
kumactl Kubernetes Read-only
kumactl Universal Read and write
kubectl Kubernetes Read and write

By accessing the control plane using one of these methods, you can see the current Kong Mesh configuration or with some methods, you can edit the configuration.

Kubernetes
Universal
GUI (Read-Only)
kubectl (Read & Write)
HTTP API (Read-Only)
kumactl (Read-Only)

Kong Mesh ships with a read-only GUI that you can use to retrieve Kong Mesh resources. By default the GUI listens on the API port and defaults to :5681/gui.

To access Kong Mesh we need to first port-forward the API service with:

kubectl port-forward svc/kong-mesh-control-plane -n kong-mesh-system 5681:5681

And then navigate to 127.0.0.1:5681/gui to see the GUI.

You will notice that Kong Mesh automatically creates a Mesh entity with name default.

You can use Kong Mesh with kubectl to perform read and write operations on Kong Mesh resources. For example:

kubectl get meshes
# NAME          AGE
# default       1m

or you can enable mTLS on the default Mesh with:

echo "apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: default
spec:
  mtls:
    enabledBackend: ca-1
    backends:
    - name: ca-1
      type: builtin" | kubectl apply -f -

You will notice that Kong Mesh automatically creates a Mesh entity with name default.

Kong Mesh ships with a read-only HTTP API that you can use to retrieve Kong Mesh resources.

By default the HTTP API listens on port 5681. To access Kong Mesh we need to first port-forward the API service with:

kubectl port-forward svc/kong-mesh-control-plane -n kong-mesh-system 5681:5681

And then you can navigate to 127.0.0.1:5681 to see the HTTP API.

You will notice that Kong Mesh automatically creates a Mesh entity with name default.

You can use the kumactl CLI to perform read-only operations on Kong Mesh resources. The kumactl binary is a client to the Kong Mesh HTTP API, you will need to first port-forward the API service with:

kubectl port-forward svc/kong-mesh-control-plane -n kong-mesh-system 5681:5681

and then run kumactl, for example:

kumactl get meshes
# NAME          mTLS      METRICS      LOGGING   TRACING
# default       off       off          off       off

You can configure kumactl to point to any zone kuma-cp instance by running:

kumactl config control-planes add --name=XYZ --address=http://{address-to-kuma}:5681

You will notice that Kong Mesh automatically creates a Mesh entity with name default.

GUI (Read-Only)
HTTP API (Read & Write)
kumactl (Read & Write)

Kong Mesh ships with a read-only GUI that you can use to retrieve Kong Mesh resources. By default the GUI listens on the API port and defaults to :5681/gui.

To access Kong Mesh you can navigate to 127.0.0.1:5681/gui to see the GUI.

You will notice that Kong Mesh automatically creates a Mesh entity with name default.

Kong Mesh ships with a read and write HTTP API that you can use to perform operations on Kong Mesh resources. By default the HTTP API listens on port 5681.

To access Kong Mesh you can navigate to 127.0.0.1:5681 to see the HTTP API.

You will notice that Kong Mesh automatically creates a Mesh entity with name default.

You can use the kumactl CLI to perform read and write operations on Kong Mesh resources. The kumactl binary is a client to the Kong Mesh HTTP API. For example:

kumactl get meshes
# NAME          mTLS      METRICS      LOGGING   TRACING
# default       off       off          off       off

or you can enable mTLS on the default Mesh with:

echo "type: Mesh
name: default
mtls:
  enabledBackend: ca-1
  backends:
  - name: ca-1
    type: builtin" | kumactl apply -f -

You can configure kumactl to point to any zone kuma-cp instance by running:

kumactl config control-planes add --name=XYZ --address=http://{address-to-kuma}:5681

You will notice that Kong Mesh automatically creates a Mesh entity with name default.

Kong Mesh - being an application that wants to improve the underlying connectivity between your services by making the underlying network more reliable - also comes with some networking requirements itself.

Control Plane ports

First and foremost, the kuma-cp application is a server that offers a number of services - some meant for internal consumption by kuma-dp data-planes, some meant for external consumption by kumactl, the HTTP API, the GUI or other systems.

The number and type of exposed ports depends on the mode in which the control plane is running as:

Standalone Control Plane

This is the default, single zone mode, in which all of the following ports are enabled in kuma-cp

  • TCP
    • 5443: The port for the admission webhook, only enabled in Kubernetes
    • 5676: the Monitoring Assignment server that responds to discovery requests from monitoring tools, such as Prometheus, that are looking for a list of targets to scrape metrics from, e.g. a list of all dataplanes in the mesh.
    • 5678: the server for the control-plane to data-planes communication (bootstrap configuration, xDS to retrieve their configuration, SDS to retrieve mTLS certificates).
    • 5680: the HTTP server that returns the health status and metrics of the control-plane.
    • 5681: the HTTP API server that is being used by kumactl, and that you can also use to retrieve Kong Mesh’s policies and - when running in universal - that you can use to apply new policies. It also exposes the Kong Mesh GUI at /gui
    • 5682: HTTPS version of the services available under 5681
    • 5683: gRPC Intercommunication CP server used internally by Kong Mesh to communicate between CP instances.

Global Control Plane

When Kong Mesh is run as a distributed service mesh, the Global control plane exposes the following ports:

  • TCP
    • 5443: The port for the admission webhook, only enabled in Kubernetes
    • 5680: the HTTP server that returns the health status of the control-plane.
    • 5681: the HTTP API server that is being used by kumactl, and that you can also use to retrieve Kong Mesh’s policies and - when running in universal - that you can use to apply new policies. Manipulating the dataplane resources is not possible. It also exposes the Kong Mesh GUI at /gui
    • 5682: HTTPS version of the services available under 5681
    • 5683: gRPC Intercommunication CP server used internally by Kong Mesh to communicate between CP instances.
    • 5685: the Kong Mesh Discovery Service port, leveraged in multi-zone deployment

Zone Control Plane

When Kong Mesh is run as a distributed service mesh, the Zone control plane exposes the following ports:

  • TCP
    • 5443: The port for the admission webhook, only enabled in Kubernetes
    • 5676: the Monitoring Assignment server that responds to discovery requests from monitoring tools, such as Prometheus, that are looking for a list of targets to scrape metrics from, e.g. a list of all dataplanes in the mesh.
    • 5678: the server for the control-plane to data-planes communication (bootstrap configuration, xDS to retrieve their configuration, SDS to retrieve mTLS certificates).
    • 5680: the HTTP server that returns the health status of the control-plane.
    • 5681: the HTTP API server that is being used by kumactl, and that you can also use to retrieve Kong Mesh’s policies and - when running in universal - you can only manage the dataplane resources.
    • 5682: HTTPS version of the services available under 5681
    • 5683: gRPC Intercommunication CP server used internally by Kong Mesh to communicate between CP instances.
Thank you for your feedback.
Was this page useful?
Too much on your plate? close cta icon
More features, less infrastructure with Kong Konnect. 1M requests per month for free.
Try it for Free
  • Kong
    THE CLOUD CONNECTIVITY COMPANY

    Kong powers reliable digital connections across APIs, hybrid and multi-cloud environments.

    • Company
    • Customers
    • Events
    • Investors
    • Careers Hiring!
    • Partners
    • Press
    • Contact
  • Products
    • Kong Konnect
    • Kong Gateway
    • Kong Mesh
    • Get Started
    • Pricing
  • Resources
    • eBooks
    • Webinars
    • Briefs
    • Blog
    • API Gateway
    • Microservices
  • Open Source
    • Install Kong Gateway
    • Kong Community
    • Kubernetes Ingress
    • Kuma
    • Insomnia
  • Solutions
    • Decentralize
    • Secure & Govern
    • Create a Dev Platform
    • API Gateway
    • Kubernetes
    • Service Mesh
Star
  • Terms•Privacy
© Kong Inc. 2023