Documentation
Documentation
https://kuma.io/docs/latest/reference/http-api/
GettingStarted
https://kuma.io/docs/latest/installation/
OpenAPI Specification
openapi: 3.1.0
info:
title: Kuma Dataplane KRI API
description: Kuma API
version: v1alpha1
x-ref-schema-name: DataplaneOverview
security:
- BasicAuth: []
- BearerAuth: []
- {}
tags:
- name: KRI
paths:
/_kri/{kri}:
get:
operationId: getByKri
summary: Returns a resource by KRI
tags:
- KRI
parameters:
- in: path
name: kri
schema:
type: string
required: true
description: KRI of the resource
responses:
'200':
description: The resource
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/DataplaneItem'
- $ref: '#/components/schemas/MeshItem'
- $ref: '#/components/schemas/MeshAccessLogItem'
- $ref: '#/components/schemas/MeshCircuitBreakerItem'
- $ref: '#/components/schemas/MeshFaultInjectionItem'
- $ref: '#/components/schemas/MeshGatewayItem'
- $ref: '#/components/schemas/MeshHTTPRouteItem'
- $ref: '#/components/schemas/MeshHealthCheckItem'
- $ref: '#/components/schemas/MeshLoadBalancingStrategyItem'
- $ref: '#/components/schemas/MeshMetricItem'
- $ref: '#/components/schemas/MeshPassthroughItem'
- $ref: '#/components/schemas/MeshProxyPatchItem'
- $ref: '#/components/schemas/MeshRateLimitItem'
- $ref: '#/components/schemas/MeshRetryItem'
- $ref: '#/components/schemas/MeshTCPRouteItem'
- $ref: '#/components/schemas/MeshTLSItem'
- $ref: '#/components/schemas/MeshTimeoutItem'
- $ref: '#/components/schemas/MeshTraceItem'
- $ref: '#/components/schemas/MeshTrafficPermissionItem'
- $ref: '#/components/schemas/ZoneEgressItem'
- $ref: '#/components/schemas/ZoneIngressItem'
'400':
$ref: '#/components/responses/BadRequest'
'404':
$ref: '#/components/responses/NotFound'
components:
schemas:
DataSource_File:
properties:
file:
description: 'Data source is a path to a file.
Deprecated, use other sources of a data.'
type: string
type: object
BuiltinCertificateAuthorityConfig:
properties:
caCert:
properties:
expiration:
type: string
rsaBits:
format: uint32
type: integer
type: object
type: object
MeshHealthCheckItem:
type: object
description: MeshHealthCheck enables active health checking of services in the mesh. It periodically probes service endpoints using TCP, HTTP, or gRPC health checks to detect and remove unhealthy instances from the load balancing pool, improving overall service reliability.
required:
- type
- name
- spec
properties:
type:
description: the type of the resource
type: string
enum:
- MeshHealthCheck
mesh:
description: Mesh is the name of the Kuma mesh this resource belongs to. It may be omitted for cluster-scoped resources.
type: string
default: default
kri:
description: A unique identifier for this resource instance used by internal tooling and integrations. Typically derived from resource attributes and may be used for cross-references or indexing
type: string
readOnly: true
example: kri_mhc_default_zone-east_kuma-demo_mypolicy1_
name:
description: Name of the Kuma resource
type: string
labels:
additionalProperties:
type: string
description: The labels to help identity resources
type: object
spec:
description: Spec is the specification of the Kuma MeshHealthCheck resource.
properties:
targetRef:
description: 'TargetRef is a reference to the resource the policy takes an effect on.
The resource could be either a real store object or virtual resource
defined inplace.'
properties:
kind:
description: Kind of the referenced resource
enum:
- Mesh
- MeshSubset
- MeshGateway
- MeshService
- MeshExternalService
- MeshMultiZoneService
- MeshServiceSubset
- MeshHTTPRoute
- Dataplane
type: string
labels:
additionalProperties:
type: string
description: 'Labels are used to select group of MeshServices that match labels. Either Labels or
Name and Namespace can be used.'
type: object
mesh:
description: Mesh is reserved for future use to identify cross mesh resources.
type: string
name:
description: 'Name of the referenced resource. Can only be used with kinds: `MeshService`,
`MeshServiceSubset` and `MeshGatewayRoute`'
type: string
namespace:
description: 'Namespace specifies the namespace of target resource. If empty only resources in policy namespace
will be targeted.'
type: string
proxyTypes:
description: 'ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
all data plane types are targeted by the policy.'
items:
enum:
- Sidecar
- Gateway
type: string
type: array
sectionName:
description: 'SectionName is used to target specific section of resource.
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.'
type: string
tags:
additionalProperties:
type: string
description: 'Tags used to select a subset of proxies by tags. Can only be used with kinds
`MeshSubset` and `MeshServiceSubset`'
type: object
required:
- kind
type: object
to:
description: To list makes a match between the consumed services and corresponding configurations
items:
properties:
default:
description: 'Default is a configuration specific to the group of destinations referenced in
''targetRef'''
properties:
alwaysLogHealthCheckFailures:
description: 'If set to true, health check failure events will always be logged. If set
to false, only the initial health check failure event will be logged. The
default value is false.'
type: boolean
eventLogPath:
description: 'Specifies the path to the file where Envoy can log health check events.
If empty, no event log will be written.'
type: string
failTrafficOnPanic:
description: 'If set to true, Envoy will not consider any hosts when the cluster is in
''panic mode''. Instead, the cluster will fail all requests as if all hosts
are unhealthy. This can help avoid potentially overwhelming a failing
service.'
type: boolean
grpc:
description: 'GrpcHealthCheck defines gRPC configuration which will instruct the service
the health check will be made for is a gRPC service.'
properties:
authority:
description: 'The value of the :authority header in the gRPC health check request,
by default name of the cluster this health check is associated with'
type: string
disabled:
description: If true the GrpcHealthCheck is disabled
type: boolean
serviceName:
description: Service name parameter which will be sent to gRPC service
type: string
type: object
healthyPanicThreshold:
anyOf:
- type: integer
- type: string
description: 'Allows to configure panic threshold for Envoy cluster. If not specified,
the default is 50%. To disable panic mode, set to 0%.
Either int or decimal represented as string.
Deprecated: the setting has been moved to MeshCircuitBreaker policy,
please use MeshCircuitBreaker policy instead.'
x-kubernetes-int-or-string: true
healthyThreshold:
description: 'Number of consecutive healthy checks before considering a host healthy.
If not specified then the default value is 1'
format: int32
type: integer
http:
description: 'HttpHealthCheck defines HTTP configuration which will instruct the service
the health check will be made for is an HTTP service.'
properties:
disabled:
description: If true the HttpHealthCheck is disabled
type: boolean
expectedStatuses:
description: List of HTTP response statuses which are considered healthy
items:
format: int32
type: integer
type: array
path:
description: 'The HTTP path which will be requested during the health check
(ie. /health)
If not specified then the default value is "/"'
type: string
requestHeadersToAdd:
description: 'The list of HTTP headers which should be added to each health check
request'
properties:
add:
items:
properties:
name:
maxLength: 256
minLength: 1
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
type: string
value:
type: string
required:
- name
- value
type: object
maxItems: 16
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
set:
items:
properties:
name:
maxLength: 256
minLength: 1
pattern: ^[a-z0-9!#$%&'*+\-.^_\x60|~]+$
type: string
value:
type: string
required:
- name
- value
type: object
maxItems: 16
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
type: object
type: object
initialJitter:
description: 'If specified, Envoy will start health checking after a random time in
ms between 0 and initialJitter. This only applies to the first health
check.'
type: string
interval:
description: 'Interval between consecutive health checks.
If not specified then the default value is 1m'
type: string
intervalJitter:
description: 'If specified, during every interval Envoy will add IntervalJitter to the
wait time.'
type: string
intervalJitterPercent:
description: 'If specified, during every interval Envoy will add IntervalJitter *
IntervalJitterPercent / 100 to the wait time. If IntervalJitter and
IntervalJitterPercent are both set, both of them will be used to
increase the wait time.'
format: int32
type: integer
noTrafficInterval:
description: 'The "no traffic interval" is a special health check interval that is used
when a cluster has never had traffic routed to it. This lower interval
allows cluster information to be kept up to date, without sending a
potentially large amount of active health checking traffic for no reason.
Once a cluster has been used for traffic routing, Envoy will shift back
to using the standard health check interval that is defined. Note that
this interval takes precedence over any other. The default value for "no
traffic interval" is 60 seconds.'
type: string
reuseConnection:
description: Reuse health check connection between health checks. Default is true.
type: boolean
tcp:
description: 'TcpHealthCheck defines configuration for specifying bytes to send and
expected response during the health check'
properties:
disabled:
description: If true the TcpHealthCheck is disabled
type: boolean
receive:
description: 'List of Base64 encoded blocks of strings expected as a response. When checking the response,
"fuzzy" matching is performed such that each block must be found, and
in the order specified, but not necessarily contiguous.
If not provided or empty, checks will be performed as "connect only" and be marked as successful when TCP connection is successfully established.'
items:
type: string
type: array
send:
description: Base64 encoded content of the message which will be sent during the health check to the target
type: string
type: object
timeout:
description: 'Maximum time to wait for a health check response.
If not specified then the default value is 15s'
type: string
unhealthyThreshold:
description: 'Number of consecutive unhealthy checks before considering a host
unhealthy.
If not specified then the default value is 5'
format: int32
type: integer
type: object
targetRef:
description: 'TargetRef is a reference to the resource that represents a group of
destinations.'
properties:
kind:
description: Kind of the referenced resource
enum:
- Mesh
- MeshSubset
- MeshGateway
- MeshService
- MeshExternalService
- MeshMultiZoneService
- MeshServiceSubset
- MeshHTTPRoute
- Dataplane
type: string
labels:
additionalProperties:
type: string
description: 'Labels are used to select group of MeshServices that match labels. Either Labels or
Name and Namespace can be used.'
type: object
mesh:
description: Mesh is reserved for future use to identify cross mesh resources.
type: string
name:
description: 'Name of the referenced resource. Can only be used with kinds: `MeshService`,
`MeshServiceSubset` and `MeshGatewayRoute`'
type: string
namespace:
description: 'Namespace specifies the namespace of target resource. If empty only resources in policy namespace
will be targeted.'
type: string
proxyTypes:
description: 'ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
all data plane types are targeted by the policy.'
items:
enum:
- Sidecar
- Gateway
type: string
type: array
sectionName:
description: 'SectionName is used to target specific section of resource.
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.'
type: string
tags:
additionalProperties:
type: string
description: 'Tags used to select a subset of proxies by tags. Can only be used with kinds
`MeshSubset` and `MeshServiceSubset`'
type: object
required:
- kind
type: object
required:
- targetRef
type: object
type: array
type: object
creationTime:
readOnly: true
type: string
description: Time at which the resource was created
format: date-time
example: '0001-01-01T00:00:00Z'
modificationTime:
readOnly: true
type: string
description: Time at which the resource was updated
format: date-time
example: '0001-01-01T00:00:00Z'
MeshTLSItem:
type: object
description: MeshTLS configures TLS and mutual TLS (mTLS) settings for secure communication between services in the mesh. It allows you to enforce encryption, configure TLS versions and cipher suites, and control whether mTLS is required (strict mode) or optional (permissive mode) for inbound traffic.
required:
- type
- name
- spec
properties:
type:
description: the type of the resource
type: string
enum:
- MeshTLS
mesh:
description: Mesh is the name of the Kuma mesh this resource belongs to. It may be omitted for cluster-scoped resources.
type: string
default: default
kri:
description: A unique identifier for this resource instance used by internal tooling and integrations. Typically derived from resource attributes and may be used for cross-references or indexing
type: string
readOnly: true
example: kri_mtls_default_zone-east_kuma-demo_mypolicy1_
name:
description: Name of the Kuma resource
type: string
labels:
additionalProperties:
type: string
description: The labels to help identity resources
type: object
spec:
description: Spec is the specification of the Kuma MeshTLS resource.
properties:
from:
description: From list makes a match between clients and corresponding configurations
items:
properties:
default:
description: 'Default is a configuration specific to the group of clients referenced in
''targetRef'''
properties:
mode:
description: Mode defines the behavior of inbound listeners with regard to traffic encryption.
enum:
- Permissive
- Strict
type: string
tlsCiphers:
description: TlsCiphers section for providing ciphers specification.
items:
enum:
- ECDHE-ECDSA-AES128-GCM-SHA256
- ECDHE-ECDSA-AES256-GCM-SHA384
- ECDHE-ECDSA-CHACHA20-POLY1305
- ECDHE-RSA-AES128-GCM-SHA256
- ECDHE-RSA-AES256-GCM-SHA384
- ECDHE-RSA-CHACHA20-POLY1305
type: string
type: array
tlsVersion:
description: Version section for providing version specification.
properties:
max:
default: TLSAuto
description: Max defines maximum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
enum:
- TLSAuto
- TLS10
- TLS11
- TLS12
- TLS13
type: string
min:
default: TLSAuto
description: Min defines minimum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
enum:
- TLSAuto
- TLS10
- TLS11
- TLS12
- TLS13
type: string
type: object
type: object
targetRef:
description: 'TargetRef is a reference to the resource that represents a group of
clients.'
properties:
kind:
description: Kind of the referenced resource
enum:
- Mesh
- MeshSubset
- MeshGateway
- MeshService
- MeshExternalService
- MeshMultiZoneService
- MeshServiceSubset
- MeshHTTPRoute
- Dataplane
type: string
labels:
additionalProperties:
type: string
description: 'Labels are used to select group of MeshServices that match labels. Either Labels or
Name and Namespace can be used.'
type: object
mesh:
description: Mesh is reserved for future use to identify cross mesh resources.
type: string
name:
description: 'Name of the referenced resource. Can only be used with kinds: `MeshService`,
`MeshServiceSubset` and `MeshGatewayRoute`'
type: string
namespace:
description: 'Namespace specifies the namespace of target resource. If empty only resources in policy namespace
will be targeted.'
type: string
proxyTypes:
description: 'ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
all data plane types are targeted by the policy.'
items:
enum:
- Sidecar
- Gateway
type: string
type: array
sectionName:
description: 'SectionName is used to target specific section of resource.
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.'
type: string
tags:
additionalProperties:
type: string
description: 'Tags used to select a subset of proxies by tags. Can only be used with kinds
`MeshSubset` and `MeshServiceSubset`'
type: object
required:
- kind
type: object
required:
- targetRef
type: object
type: array
rules:
description: 'Rules defines inbound tls configurations. Currently limited to
selecting all inbound traffic, as L7 matching is not yet implemented.'
items:
properties:
default:
description: Default contains configuration of the inbound tls
properties:
mode:
description: Mode defines the behavior of inbound listeners with regard to traffic encryption.
enum:
- Permissive
- Strict
type: string
tlsCiphers:
description: TlsCiphers section for providing ciphers specification.
items:
enum:
- ECDHE-ECDSA-AES128-GCM-SHA256
- ECDHE-ECDSA-AES256-GCM-SHA384
- ECDHE-ECDSA-CHACHA20-POLY1305
- ECDHE-RSA-AES128-GCM-SHA256
- ECDHE-RSA-AES256-GCM-SHA384
- ECDHE-RSA-CHACHA20-POLY1305
type: string
type: array
tlsVersion:
description: Version section for providing version specification.
properties:
max:
default: TLSAuto
description: Max defines maximum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
enum:
- TLSAuto
- TLS10
- TLS11
- TLS12
- TLS13
type: string
min:
default: TLSAuto
description: Min defines minimum supported version. One of `TLSAuto`, `TLS10`, `TLS11`, `TLS12`, `TLS13`.
enum:
- TLSAuto
- TLS10
- TLS11
- TLS12
- TLS13
type: string
type: object
type: object
type: object
type: array
targetRef:
description: 'TargetRef is a reference to the resource the policy takes an effect on.
The resource could be either a real store object or virtual resource
defined in-place.'
properties:
kind:
description: Kind of the referenced resource
enum:
- Mesh
- MeshSubset
- MeshGateway
- MeshService
- MeshExternalService
- MeshMultiZoneService
- MeshServiceSubset
- MeshHTTPRoute
- Dataplane
type: string
labels:
additionalProperties:
type: string
description: 'Labels are used to select group of MeshServices that match labels. Either Labels or
Name and Namespace can be used.'
type: object
mesh:
description: Mesh is reserved for future use to identify cross mesh resources.
type: string
name:
description: 'Name of the referenced resource. Can only be used with kinds: `MeshService`,
`MeshServiceSubset` and `MeshGatewayRoute`'
type: string
namespace:
description: 'Namespace specifies the namespace of target resource. If empty only resources in policy namespace
will be targeted.'
type: string
proxyTypes:
description: 'ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
all data plane types are targeted by the policy.'
items:
enum:
- Sidecar
- Gateway
type: string
type: array
sectionName:
description: 'SectionName is used to target specific section of resource.
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.'
type: string
tags:
additionalProperties:
type: string
description: 'Tags used to select a subset of proxies by tags. Can only be used with kinds
`MeshSubset` and `MeshServiceSubset`'
type: object
required
# --- truncated at 32 KB (435 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kuma/refs/heads/main/openapi/kuma-kri-api-openapi.yml