By default, the network is insecure and unencrypted. With Kong Mesh, you can enable the Mutual TLS (mTLS) policy to secure the network. This works by setting up a Certificate Authority (CA) that automatically provides TLS certificates to your services (specifically to the data plane proxies running next to each service).
To enable Mutual TLS using a builtin CA backend, run the following command:
echo 'type: Mesh
name: default
meshServices:
mode: Exclusive
mtls:
enabledBackend: ca-1
backends:
- name: ca-1
type: builtin' | kumactl apply -f -
After enabling mTLS, all traffic is encrypted and secure. However, you can no longer access the demo-app directly, meaning http://127.0.0.1:25050 will no longer work. This happens for two reasons:
-
When mTLS is enabled, Kong Mesh doesn’t create traffic permissions by default. This means no traffic will flow until you define a MeshTrafficPermission policy to allow demo-app to communicate with kv.
-
When you try to call demo-app using a browser or other HTTP client, you are essentially acting as an external client without a valid TLS certificate. Since all services are now required to present a certificate signed by the ca-1 Certificate Authority, the connection is rejected. Only services within the default mesh, which are assigned valid certificates, can communicate with each other.
To address the first issue, you need to apply an appropriate MeshTrafficPermission policy:
echo 'type: MeshTrafficPermission
name: allow-kv-from-demo-app
mesh: default
spec:
targetRef:
kind: Dataplane
labels:
app: kv
from:
- targetRef:
kind: MeshSubset
tags:
kuma.io/service: demo-app
default:
action: Allow' | kumactl apply -f -
The second issue is a bit more challenging. You can’t just get the necessary certificate and set up your web browser to act as part of the mesh. To handle traffic from outside the mesh, you need a gateway proxy. You can use tools like Kong, or you can use the Built-in Gateway that Kong Mesh provides.
Note: For more information, see the Managing incoming traffic with gateways section in the documentation.
In this guide, we’ll use the built-in gateway. It allows you to configure a data plane proxy to act as a gateway and manage external traffic securely.
The built-in gateway works like the data plane proxy for a regular service, but it requires its own configuration. Here’s how to set it up step by step.
-
Create a Dataplane resource
For regular services, we reused a single Dataplane configuration file and provided dynamic values (like names and addresses) when starting the data plane proxy. This made it easier to scale or deploy multiple instances. However, since we’re deploying only one instance of the gateway, we can simplify things by hardcoding all the values directly into the file, as shown below:
echo 'type: Dataplane
mesh: default
name: edge-gateway-instance-1
networking:
gateway:
type: BUILTIN
tags:
kuma.io/service: edge-gateway
address: 172.57.78.4' > "$KONG_MESH_DEMO_TMP/dataplane-edge-gateway.yaml"
If you prefer to keep the flexibility of dynamic values, you can use the same template mechanisms for the gateway’s Dataplane configuration as you did for regular services.
-
Generate a data plane token
The gateway proxy requires a data plane token to securely register with the control plane. You can generate the token using the following command:
kumactl generate dataplane-token \
--tag kuma.io/service=edge-gateway \
--valid-for 720h \
> "$KONG_MESH_DEMO_TMP/token-edge-gateway"
-
Start the gateway container
With the configuration and token in place, you can start the gateway proxy as a container:
docker run \
--detach \
--name kong-mesh-demo-edge-gateway \
--hostname gateway \
--network kong-mesh-demo \
--ip 172.57.78.4 \
--publish 28080:8080 \
--volume "$KONG_MESH_DEMO_TMP:/demo" \
kong/kuma-dp: run \
--cp-address https://control-plane:5678 \
--dataplane-token-file /demo/token-edge-gateway \
--dataplane-file /demo/dataplane-edge-gateway.yaml \
--dns-enabled=false
This command starts the gateway proxy and registers it with the control plane. However, the gateway is not yet ready to route traffic.
-
Configure the gateway with MeshGateway
To enable the gateway to accept external traffic, configure it with a MeshGateway. This setup defines listeners that specify the port, protocol, and tags for incoming traffic, allowing policies like MeshHTTPRoute or MeshTCPRoute to route traffic to services.
Apply the configuration:
echo 'type: MeshGateway
mesh: default
name: edge-gateway
selectors:
- match:
kuma.io/service: edge-gateway
conf:
listeners:
- port: 8080
protocol: HTTP
tags:
port: http-8080' | kumactl apply -f -
This sets up the gateway to listen on port 8080 using the HTTP protocol and adds a tag (port: http-8080) to identify this listener in routing policies.
You can test the gateway by visiting http://127.0.0.1:28080. You should see a message saying no routes match this MeshGateway. This means the gateway is running, but no routes are set up yet to handle traffic.
-
Create a route to connect the gateway to demo-app
To route traffic from the gateway to the service, create a MeshHTTPRoute policy:
echo 'type: MeshHTTPRoute
name: edge-gateway-demo-app-route
mesh: default
spec:
targetRef:
kind: MeshGateway
name: edge-gateway
tags:
port: http-8080
to:
- targetRef:
kind: Mesh
rules:
- matches:
- path:
type: PathPrefix
value: "/"
default:
backendRefs:
- kind: MeshService
name: demo-app' | kumactl apply -f -
This route connects the gateway and its listener (port: http-8080) to the demo-app service. It forwards any requests with the path prefix / to demo-app.
After setting up this route, the gateway will try to send traffic to demo-app. However, if you test it by visiting http://127.0.0.1:28080, you’ll see:
This happens because there is no MeshTrafficPermission policy allowing traffic from the gateway to demo-app. You’ll need to create one in the next step.
-
Allow traffic from the gateway to demo-app
To fix the RBAC: access denied error, create a MeshTrafficPermission policy to allow the gateway to send traffic to demo-app:
echo 'type: MeshTrafficPermission
name: allow-demo-app-from-edge-gateway
mesh: default
spec:
targetRef:
kind: Dataplane
labels:
app: demo-app
from:
- targetRef:
kind: MeshSubset
tags:
kuma.io/service: edge-gateway
default:
action: Allow' | kumactl apply -f -
This policy allows traffic from the gateway to demo-app. After applying it, you can access http://127.0.0.1:28080, and the traffic will reach the demo-app service successfully.