Kuma is an open-source control plane for managing service meshes and microservices. It supports Kubernetes, virtual machines and bare-metal environments, with single-zone or multi-zone deployments across clouds, regions and Kubernetes clusters. One control plane can serve multiple separate meshes. Its traffic policies include HTTP and TCP routing, health checks, circuit breaking, retries, timeouts, fault injection and rate limiting. Security capabilities include mutual TLS and mesh traffic permissions. For observability, Kuma provides service maps, traces, access logs, metrics and OpenTelemetry, with integrations documented for Prometheus, Grafana, Jaeger and Datadog. Its interfaces include Kubernetes CRDs, a GUI, REST API and CLI, and Envoy is bundled as the data-plane proxy. Kuma is self-hosted and available under a free open-source plan. The Kubernetes quickstart describes the GUI as read-only. Production guidance addresses secrets management, API controls and authentication, certificates, proxy membership and Kubernetes RBAC.
Who it is for
It suits teams running service meshes across Kubernetes, virtual machines or bare metal that need a self-hosted control plane. Its policy and observability options may also suit teams operating multiple meshes.
What is good
- Supports Kubernetes, virtual machines and bare metal.
- One control plane can support multiple meshes.
- Traffic policies include retries and rate limiting.
- Observability includes traces, logs and metrics.
- Free open-source plan.
What to know first
- Kuma is self-hosted.
- Kubernetes quickstart describes the GUI as read-only.
- Production deployment guidance covers several security controls.
Verdict
Kuma brings traffic policy, security and observability functions together for service mesh deployments across several environment types. Teams should account for its self-hosted model and the read-only GUI described in the Kubernetes quickstart.
Kuma plans and pricing
All plansCompared on service mesh platforms
- Deployment model
- self_hosted
- Proxy architecture
- sidecar
- mTLS support
- Yes
- Traffic policies
- Yes
- Multi-cluster support
- Yes
- Supported platforms
- Kubernetes, OpenShift, Universal (VMs), bare metal
