このページは、まだ日本語ではご利用いただけません。翻訳中です。
旧バージョンのドキュメントを参照しています。 最新のドキュメントはこちらをご参照ください。
Use Kong Mesh
After Kong Mesh is installed, you can access the control plane via the following methods:
Access method | Mode | Permissions |
---|---|---|
Kong Mesh GUI | Kubernetes and Universal | Read-only |
HTTP API | Kubernetes and Universal | Read-only |
kumactl |
Kubernetes | Read-only |
kumactl |
Universal | Read and write |
kubectl |
Kubernetes | Read and write |
By accessing the control plane using one of these methods, you can see the current Kong Mesh configuration or with some methods, you can edit the configuration.
Kong Mesh, being an application that improves the underlying connectivity between your services by making the underlying network more reliable, also comes with some networking requirements itself.
Control plane ports
First and foremost, the kuma-cp
application is a server that offers a number of services - some meant for internal consumption by kuma-dp
data plane proxies and some meant for external consumption by kumactl
, the HTTP API, the GUI or other systems.
The number and type of exposed ports depends on the mode in which the control plane is running as:
Standalone control plane
This is the default, single zone mode, in which all of the following ports are enabled in kuma-cp
- TCP
-
5443
: the port for the admission webhook, only enabled inKubernetes
. The default Kuberneteskong-mesh-control-plane
service exposes this port on443
. -
5676
: the Monitoring Assignment server that responds to discovery requests from monitoring tools, such asPrometheus
, that are looking for a list of targets to scrape metrics from. -
5678
: the server for the control plane to data plane proxy communication (bootstrap configuration, xDS to retrieve data plane proxy configuration, SDS to retrieve mTLS certificates). -
5680
: the HTTP server that returns the health status and metrics of the control plane. -
5681
: the HTTP API server that is being used bykumactl
. You can also use it to retrieve Kong Mesh’s policies and, when running inuniversal
, you can manage Dataplane resources. It also exposes the Kong Mesh GUI at/gui
-
5682
: HTTPS version of the services available under5681
-
5683
: gRPC Intercommunication CP server used internally by Kong Mesh to communicate between CP instances.
-
Global control plane
When Kong Mesh is run as a distributed service mesh, the global control plane exposes the following ports:
- TCP
-
5443
: the port for the admission webhook, only enabled inKubernetes
. The default Kuberneteskong-mesh-control-plane
service exposes this port on443
. -
5680
: the HTTP server that returns the health status of the control plane. -
5681
: the HTTP API server that is being used bykumactl
, and that you can also use to retrieve Kong Mesh’s policies and - when running inuniversal
- that you can use to apply new policies. Manipulating Dataplane resources is not possible. It also exposes the Kong Mesh GUI at/gui
-
5682
: HTTPS version of the services available under5681
-
5683
: gRPC Intercommunication CP server used internally by Kong Mesh to communicate between CP instances. -
5685
: the Kong Mesh Discovery Service port, leveraged in multi-zone deployments
-
Zone control plane
When Kong Mesh is run as a distributed service mesh, the zone control plane exposes the following ports:
- TCP
-
5443
: the port for the admission webhook, only enabled inKubernetes
. The default Kuberneteskong-mesh-control-plane
service exposes this port on443
. -
5676
: the Monitoring Assignment server that responds to discovery requests from monitoring tools, such asPrometheus
, that are looking for a list of targets to scrape metrics from. -
5678
: the server for the control plane to data plane proxy communication (bootstrap configuration, xDS to retrieve data plane proxy configuration, SDS to retrieve mTLS certificates). -
5680
: the HTTP server that returns the health status and metrics of the control plane. -
5681
: the HTTP API server that is being used bykumactl
. You can also use it to retrieve Kong Mesh’s policies and, when running inuniversal
, you can manage Dataplane resources. -
5682
: HTTPS version of the services available under5681
-
5683
: gRPC Intercommunication CP server used internally by Kong Mesh to communicate between CP instances.
-