Networking

    First and foremost, the application is a server that offers a number of services - some meant for internal consumption by kuma-dp data-planes, some meant for external consumption by the kumactl CLI, by the HTTP API, or by the GUI.

    The number and type of exposed ports depends on the mode in which the control plane is run

    • TCP
      • 5443: The port for the admission webhook, only enabled in Kubernetes
      • 5676: the Monitoring Assignment server that responds to discovery requests from monitoring tools, such as Prometheus, that are looking for a list of targets to scrape metrics from, e.g. a list of all dataplanes in the mesh.
      • 5678: the server for the control-plane to data-planes communication (bootstrap configuration, xDS to retrieve their configuration, SDS to retrieve mTLS certificates).
      • 5681: the HTTP API server that is being used by kumactl, and that you can also use to retrieve Kuma’s policies and - when running in universal - that you can use to apply new policies. It also exposes the Kuma GUI at /gui
      • 5682: HTTPS version of the services available under 5681
    • UDP
      • : the Kuma DNS server

    When Kuma is run as a distributed service mesh, the Global control plane exposes the following ports:

    • TCP
      • 5443: The port for the admission webhook, only enabled in Kubernetes
      • 5680: the HTTP server that returns the health status of the control-plane.
      • 5681: the HTTP API server that is being used by kumactl, and that you can also use to retrieve Kuma’s policies and - when running in universal - that you can use to apply new policies. Manipulating the dataplane resources is not possible. It also exposes the Kuma GUI at /gui
      • 5682: HTTPS version of the services available under 5681

    When Kuma is run as a distributed service mesh, the Remote control plane exposes the following ports:

    • TCP
      • 5443: The port for the admission webhook, only enabled in Kubernetes
      • 5676: the Monitoring Assignment server that responds to discovery requests from monitoring tools, such as Prometheus, that are looking for a list of targets to scrape metrics from, e.g. a list of all dataplanes in the mesh.
      • : the server for the control-plane to data-planes communication (bootstrap configuration, xDS to retrieve their configuration, SDS to retrieve mTLS certificates).
      • 5680: the HTTP server that returns the health status of the control-plane.
      • 5681: the HTTP API server that is being used by kumactl, and that you can also use to retrieve Kuma’s policies and - when running in universal - you can only manage the dataplane resources.
      • 5682: HTTPS version of the services available under 5681
    • UDP
      • 5653: the Kuma DNS server

    kuma-dp ports

    In addition to the service traffic ports, the data-plane automatically also opens the envoy listener on the following addresses:

    • On Universal, by default on the first available port greater or equal than 30001, like 127.0.01:30001.

    The Envoy administration interface can also be manually configured to listen on any arbitraty port by specifying the --admin-port argument when running .