Kuma

Kuma is an open-source service mesh (service networking) project that provides traffic management, security, and observability for microservices and APIs across multiple clusters and platforms.

• Service mesh for managing service-to-service traffic and policies (service networking)
• Supports multi-zone and multi-cluster deployments across clouds and data centers (multi-cluster networking)
• Provides mTLS, traffic routing, retries, and rate limiting for services (security and traffic management)
• Integrates with Kubernetes and virtual machines for hybrid environments (platform integration)
• Built on Envoy as the data plane with a policy-driven control plane (service mesh architecture)

More About Kuma

Kuma is an open-source service mesh (service networking) hosted by the Cloud Native Computing Foundation (CNCF) and designed to provide a control plane for service-to-service communication across Kubernetes clusters, virtual machines, and hybrid environments. It addresses the problem space of managing connectivity, security, and observability for distributed applications, particularly microservices, by centralizing policy configuration and delegating traffic handling to a programmable data plane.

The project uses Envoy (proxy/data plane) as its sidecar or gateway component, while Kuma itself operates as the control plane (service mesh control plane) that exposes high-level policies. These policies cover capabilities such as mutual Transport Layer Security (TLS) (mTLS) for encryption and identity (network security), traffic routing, retries, timeouts, and rate limiting (traffic management), and logging and metrics (observability). Kuma defines resources such as Mesh, TrafficRoute, TrafficPermission, TrafficLog, and others, which allow platform and application teams to configure behavior declaratively through APIs or configuration files.

Kuma supports multi-zone and multi-cluster topologies (multi-cluster networking), enabling a central control plane to manage multiple clusters or data centers while keeping data plane traffic local to each zone when appropriate. This design allows enterprises to apply consistent policies across heterogeneous infrastructure, including multiple Kubernetes clusters and Virtual Machine (VM) workloads, and to use features like locality-aware routing and cross-zone communication where required. Kuma can run in “universal” mode for non-Kubernetes environments and “Kubernetes” mode when integrated with Kubernetes APIs.

In enterprise environments, Kuma is used to standardize service connectivity, offload security and resilience concerns from application code, and enforce organization-wide policies. Platform engineering teams deploy Kuma as part of an internal platform to manage east-west traffic, implement zero-trust networking patterns via mTLS and fine-grained permissions (security and compliance), and collect telemetry for monitoring tools (observability). Kuma supports multi-tenancy through logical meshes, allowing different teams or environments to run isolated configurations on shared infrastructure.

From an architectural perspective, Kuma relies on a control plane that stores configuration and distributes it to Envoy data plane proxies via xDS APIs (control plane and API-based configuration). It exposes both a Representational State Transfer (REST) Application Programming Interface (API) and Kubernetes custom resources for configuration, aligning with Infrastructure-as-Code (IaC) practices (platform automation). The project’s association with CNCF places it in the broader cloud-native ecosystem alongside container orchestration platforms, ingress gateways, and observability systems, while its technical role is focused on service mesh, service discovery, and policy-based traffic management for distributed applications.