Careful!
You are browsing documentation for a version of Kuma that is not the latest release.
Looking for even older versions? Learn more.
Deploy Kuma on Universal
This demo shows how to run Kuma in Universal mode on a single machine.
To start learning how Kuma works, you will run and secure a simple demo application that consists of two services:
demo-app
: a web application that lets you increment a numeric counter. It listens on port 5000redis
: data store for the counter
Prerequisites
Install Kuma
To download Kuma we will use official installer, it will automatically detect the operating system (Amazon Linux, CentOS, RedHat, Debian, Ubuntu, and macOS) and download Kuma:
To finish installation we need to add Kuma binaries to path:
Start control plane
Now we need to start control plane in background by running command:
To check if control plane started without issues you can check logs:
Deploy demo application
Generate tokens for data plane proxies
On Universal we need to manually create tokens for data plane proxies. To do this need to run this commands (these tokens will be valid for 30 days):
After generating tokens we can start the data plane proxies that will be used for proxying traffic between demo-app
and redis
.
Start the data plane proxies
Because this is a quickstart, we don’t setup certificates for communication
between the data plane proxies and the control plane.
You’ll see a warning like the following in the kuma-dp
logs:
This isn’t related to mTLS between services.
First we can start the data plane proxy for redis
. On Universal we need to manually create Dataplane resources for data plane proxies, and
run kuma-dp manually, to do this run:
You can notice that we are manually specifying the readiness port with environment variable KUMA_READINESS_PORT
, when each data plane is
running on separate machines this is not required.
We need a separate terminal window, with the same binaries directory as above added to PATH
. So assuming the same initial directory:
Now we can start the data plane proxy for our demo-app, we can do this by running:
Run kuma-counter-demo app
We will start the kuma-counter-demo in a new terminal window:
- With the data plane proxies running, we can start our apps, first we will start and configure
Redis
:You should see message
OK
fromRedis
if this operation was successful. - Now we can start our
demo-app
. To do this we need to download repository with its source code: - Now we need to run:
If
demo-app
was started correctly you will see message:
In a browser, go to 127.0.0.1:5000 and increment the counter. demo-app
GUI should work without issues now.
Explore Kuma GUI
You can view the sidecar proxies that are connected to the Kuma control plane.
Kuma ships with a read-only GUI that you can use to retrieve Kuma resources.
By default, the GUI listens on the API port which defaults to 5681
.
To access Kuma we need to navigate to 127.0.0.1:5681/gui in your browser.
To learn more, read the documentation about the user interface.
Introduction to zero-trust security
By default, the network is insecure and not encrypted. We can change this with Kuma by enabling the Mutual TLS policy to provision a Certificate Authority (CA) that will automatically assign TLS certificates to our services (more specifically to the injected data plane proxies running alongside the services).
We can enable Mutual TLS with a builtin
CA backend by executing:
The traffic is now encrypted and secure. Kuma does not define default traffic permissions, which means that no traffic will flow with mTLS enabled until we define a proper MeshTrafficPermission policy.
For now, the demo application won’t work.
You can verify this by clicking the increment button again and seeing the error message in the browser.
We can allow the traffic from the demo-app
to redis
by applying the following MeshTrafficPermission
:
You can click the increment button, the application should function once again.
However, the traffic to redis
from any other service than demo-app
is not allowed.
Next steps
- Explore the Features available to govern and orchestrate your service traffic.
- Learn more about what you can do with the GUI.
- Read the full documentation to learn about all the capabilities of Kuma.
- Chat with us at the official Kuma Slack for questions or feedback.