kong service mesh - setup and deploy to AKS manually for testing purposes

To install kong service mesh via helm run the following command in your cloud shell.

helm repo add kong-mesh https://kong.github.io/kong-mesh-charts

helm repo update

helm install --create-namespace --namespace kong-mesh-system kong-mesh kong-mesh/kong-mesh

Takes abit of time to spin this up. 

kubectl apply -f https://raw.githubusercontent.com/kumahq/kuma-counter-demo/refs/heads/main/k8s/000-with-kuma.yaml

kubectl wait -n kuma-demo --for=condition=ready pod --selector=app=demo-app --timeout=90s

And then you can see some of the pods being spined up.

Also notice we have our namespace labeled (kuma.io/sidecar-injection: enabled).

To turn on, mutual tls, we can use the following yaml.

apiVersion: kuma.io/v1alpha1

kind: Mesh

metadata:

  name: default

spec:

  meshServices:

    mode: Exclusive

  mtls:

    backends:

      - name: ca-1

        type: builtin

    enabledBackend: ca-1

And the enable application being able to talk to each other we need 'MeshTrafficPermission' instead of the mesh. MeshTrafficPermission defines which services are allowed to communicate with others. It's part of Kuma's Zero Trust security model — by default, no service can talk to another unless explicitly allowed.

The yaml for MeshTrafficPermission looks like this:- 

apiVersion: kuma.io/v1alpha1

kind: MeshTrafficPermission

metadata:

  namespace: kuma-demo

  name: kv

spec:

  targetRef:

    kind: Dataplane

    labels:

      app: kv

  from:

    - targetRef:

        kind: MeshSubset

        tags:

          app: demo-app

          k8s.kuma.io/namespace: kuma-demo

      default:

        action: Allow

The yaml below describe where the resource are being created. It is placed in the namespace - kuma-demo and called kv. 

kind: MeshTrafficPermission

metadata:

  namespace: kuma-demo

  name: kv

Let's break this yaml down. We need to tell kong/kuma where traffic is allowed which beings with targetRef. We have a pod label with "app: kv" which demo-app talks to. 

spec:

  targetRef:

    kind: Dataplane

    labels:

      app: kv

Then we need to tell it, who can connect. And in this case, app-demo which has the label "app: demo-app" and namespace "kuma-demo". It is abit confusing the targetRef appears again (could be named more meaningful).  The action is "allow" and traffic flows.

from:

    - targetRef:

        kind: MeshSubset

        tags:

          app: demo-app

          k8s.kuma.io/namespace: kuma-demo

FAQ

You might get some error here but don't worry too much about it. 

"ERROR   kube-manager    Reconciler error        {"controller": "kuma-mesh-controller", "controllerGroup": "kuma.io", "controllerKind": "Mesh", "Mesh": {"name":"default"}, "namespace": "", "name": "default", "reconcileID": "5bef11cd-021e-41f6-ab9a-aefc0a2b0f0f", "error": "could not create default mesh resources: could not create default MeshRetry \"mesh-retry-all-default.kong-mesh-system\": could not create a resource: resource already exists: type=\"MeshRetry\" name=\"mesh-retry-all-default.kong-mesh-system\" mesh=\"default\"", "errorVerbose": "resource already exists: type=\"MeshRetry\" name=\"mesh-retry-all-default.kong-mesh-system\" mesh=\"default\"\ncould not create a resource\ngithub.com/kumahq/kuma/pkg/defaults/mesh.ensureDefaultResource\n\tgithub.com/kumahq/kuma@v0.0.0-20250709045707-6c17bc74d42e/pkg/defaults/mesh/mesh.go:115\ngithub.com/kumahq/kuma/pkg/defaults/mesh.EnsureDefaultMeshResources\n\tgithub.com/kumahq/kuma@v0.0.0-20250709045707-6c17bc74d42e/pkg/defaults/mesh/mesh.go:88\ngithub.com/kumahq/kuma/pkg/plugins/runtime/k8s/controllers.(*MeshReconciler).ensureDefaultResources\n\tgithub.com/kumahq/kuma@v0.0.0-20250709045707-6c17bc74d42e/pkg/plugins/runtime/k8s/controllers/mesh_controller.go:62\ngithub.com/kumahq/kuma/pkg/plugins/runtime/k8s/controllers.(*MeshReconciler).Reconcile\n\tgithub.com/kumahq/kuma@v0.0.0-20250709045707-6c17bc74d42e/pkg/plugins/runtime/k8s/controllers/mesh_controller.go:48\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\tsigs.k8s.io/controller-runtime@v0.21.0/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/control"