- {% include page_header.html %}
-
-
diff --git a/app/_layouts/policies.html b/app/_layouts/policies.html
new file mode 100644
index 000000000..ee3110606
--- /dev/null
+++ b/app/_layouts/policies.html
@@ -0,0 +1,55 @@
+---
+layout: default
+---
+
+
- {% for feature in page.features %}
-
-
-
-
-
- {% endfor %}
-
-
-{{ feature.sectionTitle }}
-{{ feature.sectionSubTitle }}
-
-
- -
- {% for item in feature.items %}
-
-
-
- -- -
- {% if item.title %}
- {{ item.title }}
- {% else %} -Please add a title for this policy.
- {% endif %} -
- {% endfor %}
-
-
- Would you like to submit or request a new feature? Please open an issue at the kuma-website repository.
-
-
-
+ {% include page_header.html %}
+
+
diff --git a/app/_plugins/blocks/mermaid.rb b/app/_plugins/blocks/mermaid.rb
new file mode 100644
index 000000000..78b36f85c
--- /dev/null
+++ b/app/_plugins/blocks/mermaid.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Jekyll
+ class RenderMermaid < Liquid::Block
+ def render(context)
+ text = super
+ mermaid_script = generate_mermaid_script
+ mermaid_pre = "
+
+ {% if page.policies.size > 0 %}
+ {% for policy in page.policies %}
+
+
+
+
+
+ {% endfor %}
+ {% else %}
+
+
+ {% endif %}
+
+
+
+{{ policy.sectionTitle }}
+{{ policy.sectionSubTitle }}
+
+
+ -
+ {% for item in policy.items %}
+
-
+
+ ++ +
+ {% if item.title %}
+
{{ item.title }}
+ {% else %} +Please add a title for this policy.
+ {% endif %} +
+ {% endfor %}
+
There are no Policies present.
+
+
+ Would you like to submit or request a new policy? Please open an issue at the kuma-website repository.
+
+
+ 
-You can then add a {% if_version lte:2.5.x inline:true %}[TrafficLog policy](/docs/{{ page.version }}/policies/traffic-log){% endif_version %}{% if_version gte:2.6.x inline:true %}[MeshAccessLog policy](/docs/{{ page.version }}/policies/meshaccesslog){% endif_version %} to your mesh to start emitting access logs. Loki will pick up logs that are sent to `stdout`. To send logs to `stdout` you can configure the logging backend as shown below:
+You can then add a [TrafficLog policy](/docs/{{ page.version }}/policies/traffic-log) to your mesh to start emitting access logs. Loki will pick up logs that are sent to `stdout`. To send logs to `stdout` you can configure the logging backend as shown below:
{% tabs visualizing-logs useUrlFragment=false %}
{% tab visualizing-logs Kubernetes %}
@@ -201,7 +193,7 @@ To make things simpler the datasource is installed and configured when using [`k
##### {{site.mesh_product_name}} Dataplane
-This dashboard lets you investigate the status of a single dataplane in the mesh. In order to see those metrics, you need to create {% if_version lte:2.5.x inline:true %}[Traffic Metrics policy](/docs/{{ page.version }}/policies/traffic-metrics){% endif_version %}{% if_version gte:2.6.x inline:true %}[MeshMetric policy](/docs/{{ page.version }}/policies/meshmetric){% endif_version %} first.
+This dashboard lets you investigate the status of a single dataplane in the mesh. In order to see those metrics, you need to create [Traffic Metrics policy](/docs/{{ page.version }}/policies/traffic-metrics/) first.
@@ -274,7 +266,7 @@ Checkout the [Datadog agent docs](https://docs.datadoghq.com/agent/basic_agent_u
### Metrics
-{{site.mesh_product_name}} exposes metrics with {% if_version lte:2.5.x inline:true %}[traffic metrics](/docs/{{ page.version }}/policies/traffic-metrics){% endif_version %}{% if_version gte:2.6.x inline:true %}[MeshMetric policy](/docs/{{ page.version }}/policies/meshmetric){% endif_version %} in Prometheus format.
+{{site.mesh_product_name}} exposes metrics with [traffic metrics](/docs/{{ page.version }}/policies/traffic-metrics) in Prometheus format.
You can add annotations to your pods to enable the Datadog agent to scrape metrics.
@@ -324,13 +316,13 @@ Checkout the [Datadog agent docs](https://docs.datadoghq.com/agent/basic_agent_u
{% endtab %}
{% endtabs %}
-Once the agent is configured to ingest traces you'll need to configure a {% if_version lte:2.5.x inline:true %}[TrafficTrace policy](/docs/{{ page.version }}/policies/traffic-trace){% endif_version %}{% if_version gte:2.6.x inline:true %}[MeshTrace policy](/docs/{{ page.version }}/policies/meshtrace){% endif_version %}.
+Once the agent is configured to ingest traces you'll need to configure a [TrafficTrace](/docs/{{ page.version }}/policies/traffic-trace).
### Logs
The best way to have {{site.mesh_product_name}} and Datadog work together is with [TCP ingest](https://docs.datadoghq.com/agent/logs/?tab=tcpudp#custom-log-collection).
-Once your agent is configured with TCP ingest you can configure a {% if_version lte:2.5.x inline:true %}[TrafficLog policy](/docs/{{ page.version }}/policies/traffic-log){% endif_version %}{% if_version gte:2.6.x inline:true %}[MeshAccessLog policy](/docs/{{ page.version }}/policies/meshaccesslog){% endif_version %} for data plane proxies to send logs.
+Once your agent is configured with TCP ingest you can configure a [TrafficLog](/docs/{{ page.version }}/policies/traffic-log) for data plane proxies to send logs.
## Observability in multi-zone
diff --git a/app/_src/introduction/kuma-requirements.md b/app/_src/introduction/kuma-requirements.md
index 77a42b948..5173cc245 100644
--- a/app/_src/introduction/kuma-requirements.md
+++ b/app/_src/introduction/kuma-requirements.md
@@ -51,7 +51,7 @@ resources:
cpu: 50m
memory: 64Mi
limits:
- cpu: 1000m
+ cpu: 500m
memory: 512Mi
```
diff --git a/app/_src/networking/dns.md b/app/_src/networking/dns.md
index d59cf4195..0e18fab21 100644
--- a/app/_src/networking/dns.md
+++ b/app/_src/networking/dns.md
@@ -58,106 +58,24 @@ This mode implements advanced networking techniques, so take special care for th
### Overriding the CoreDNS configuration
-In some cases it might be useful for you to configure the default CoreDNS configuration.
-
-{% if_version gte:2.6.x %}
-{{site.mesh_product_name}} supports overriding the CoreDNS configuration from control plane for both Kubernetes and Universal installations; for Universal installations, {{site.mesh_product_name}} also supports overriding from data planes. When overriding from control plane, all the data planes in the mesh will use the overridden DNS configuration.
-{% endif_version %}
+In some cases it might be useful for you to configure the default CoreDNS.
{% tabs override useUrlFragment=false %}
{% tab override Kubernetes %}
-{% if_version gte:2.6.x %}
-Only overriding from control plane is supported.
-
-To override, you can [configure](/docs/{{ page.version }}/reference/kuma-cp/) the bootstrap server in `kuma-cp`:
-
-```yaml
-bootstrapServer:
- corefileTemplatePath: "/path/to/mounted-corefile-template" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_COREFILE_TEMPLATE_PATH
-```
-
-You'll also need to mount the DNS configuration template file into the control plane by adding an extra configMap, here are the steps:
-
-Create a configmap in the namespace in which the control plane is installed:
-
-```sh
-# create the namespace if it does not exist
-kubectl create namespace {{site.mesh_namespace}}
-
-# create the configmap, make sure the file exist on disk
-kubectl create --namespace {{site.mesh_namespace}} configmap corefile-template \
- --from-file corefile-template=/path/to/corefile-template-on-disk
-```
-
-Point to this configmap when installing {{site.mesh_product_name}}:
-
-{% tabs install-control-plane useUrlFragment=false %}
-{% tab install-control-plane Kubernetes (kumactl) %}
-
-```sh
-kumactl install control-plane \
- --env-var "KUMA_BOOTSTRAP_SERVER_PARAMS_COREFILE_TEMPLATE_PATH=/path/to/mounted-corefile-template" \
- --set "{{site.set_flag_values_prefix}}controlPlane.extraConfigMaps[0].name=corefile-template" \
- --set "{{site.set_flag_values_prefix}}controlPlane.extraConfigMaps[0].mountPath=/path/to/mounted-corefile-template/corefile-template" \
- | kubectl apply -f -
-```
-{% endtab %}
-{% tab install-control-plane Kubernetes (HELM) %}
-
-```sh
-helm install --namespace {{site.mesh_namespace}} \
- --set "{{site.set_flag_values_prefix}}controlPlane.envVars.KUMA_BOOTSTRAP_SERVER_PARAMS_COREFILE_TEMPLATE_PATH=/path/to/mounted-corefile-template" \
- --set "{{site.set_flag_values_prefix}}controlPlane.extraConfigMaps[0].name=corefile-template" \
- --set "{{site.set_flag_values_prefix}}controlPlane.extraConfigMaps[0].mountPath=/path/to/mounted-corefile-template/corefile-template" \
- {{site.mesh_helm_install_name}} {{site.mesh_helm_repo}}
-```
-
-{% endtab %}
-{% endtabs %}
-{% endif_version %}
-
-{% if_version lte:2.5.x %}
At this moment, there is no builtin option to override CoreDNS configuration.
-{% endif_version %}
{% endtab %}
{% tab override Universal %}
-{% if_version lte:2.5.x %}
-{{site.mesh_product_name}} supports overriding DNS from data planes.
-{% endif_version %}
-{% if_version gte:2.6.x %}
-Both overriding from the control plane and data planes are supported.
-{% endif_version %}
-
-{% if_version gte:2.6.x %}
-To override DNS configuration from the control plane, you can [configure](/docs/{{ page.version }}/reference/kuma-cp/) the bootstrap server in `kuma-cp`:
-
-```yaml
-bootstrapServer:
- corefileTemplatePath: "/path/to/mounted-corefile-template" # ENV: KUMA_BOOTSTRAP_SERVER_PARAMS_COREFILE_TEMPLATE_PATH
-```
-
-Please make sure the file path do exist on disk.
-{% endif_version %}
-
-To override DNS configuration from data planes, use `--dns-coredns-config-template-path` as an argument to `kuma-dp`. {% if_version gte:2.6.x %}When the data plane is connecting to a control plane that also has DNS configuration overridden, overridden from data plane will take precedence.{% endif_version %}
-
+Use `--dns-coredns-config-template-path` as an argument to `kuma-dp`.
{% endtab %}
{% endtabs %}
-Once supported, you'll need to prepare a DNS configuration file to be used for overriding. This file is a [CoreDNS configuration](https://coredns.io/manual/toc/) that is processed as a go-template.
-
-Editing should base on [the existing and default configuration](https://github.com/kumahq/kuma/blob/master/app/kuma-dp/pkg/dataplane/dnsserver/Corefile). For example, you may use the following configuration to make the DNS server not respond errors to IPv6 queries when your cluster has IPv6 disabled:
+This file is a [CoreDNS configuration](https://coredns.io/manual/toc/) that is processed as a go-template.
+If you edit this configuration you should base yourself on the default existing configuration, which looks like the following
{% raw %}
```
.:{{ .CoreDNSPort }} {
- # add a plugin to return NOERROR for IPv6 queries
- template IN AAAA . {
- rcode NOERROR
- fallthrough
- }
-
forward . 127.0.0.1:{{ .EnvoyDNSPort }}
# We want all requests to be sent to the Envoy DNS Filter, unsuccessful responses should be forwarded to the original DNS server.
# For example: requests other than A, AAAA and SRV will return NOTIMP when hitting the envoy filter and should be sent to the original DNS server.
@@ -178,7 +96,7 @@ Editing should base on [the existing and default configuration](https://github.c
## Configuration
-You can [configure](/docs/{{ page.version }}/reference/kuma-cp/) {{site.mesh_product_name}} DNS in `kuma-cp`:
+You can configure {{site.mesh_product_name}} DNS in `kuma-cp`:
```yaml
dnsServer:
@@ -249,7 +167,7 @@ The default listeners created on the VIP default to port `80`, so the port can b
},
"last_updated": "2020-07-06T14:32:59.732Z"
}
- }
+ },
```
{% tip %}
diff --git a/app/_src/policies/circuit-breaker.md b/app/_src/policies/circuit-breaker.md
index cb651854c..cdf707e63 100644
--- a/app/_src/policies/circuit-breaker.md
+++ b/app/_src/policies/circuit-breaker.md
@@ -1,11 +1,6 @@
---
title: Circuit Breaker
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? You don't need this policy, check [`MeshCircuitBreaker`](/docs/{{ page.version }}/policies/meshcircuitbreaker) instead.
-{% endwarning %}
-{% endif_version %}
{% tip %}
Circuit Breaker is an outbound policy. Dataplanes whose configuration is modified are in the `sources` matcher.
diff --git a/app/_src/policies/fault-injection.md b/app/_src/policies/fault-injection.md
index fe8512524..57cf103a6 100644
--- a/app/_src/policies/fault-injection.md
+++ b/app/_src/policies/fault-injection.md
@@ -1,11 +1,6 @@
---
title: Fault Injection
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? You need this policy, check [`MeshFaultInjection`](/docs/{{ page.version }}/policies/meshfaultinjection) instead.
-{% endwarning %}
-{% endif_version %}
{% tip %}
Fault Injection is an inbound policy. Dataplanes whose configuration is modified are in the `destinations` matcher.
diff --git a/app/_src/policies/general-notes-about-kuma-policies.md b/app/_src/policies/general-notes-about-kuma-policies.md
index bc9e26c52..9754e252e 100644
--- a/app/_src/policies/general-notes-about-kuma-policies.md
+++ b/app/_src/policies/general-notes-about-kuma-policies.md
@@ -1,17 +1,11 @@
---
title: General notes about Kuma policies
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? You don't need this, check [`TargetRef` policies](/docs/{{ page.version }}/policies/introduction) instead.
-{% endwarning %}
-{% endif_version %}
-{% if_version lte:2.5.x %}
+
{% tip %}
This only applies to source/destination policies.
If you are unfamiliar with these, checkout [introduction to policies](/docs/{{ page.version }}/policies/introduction).
{% endtip %}
-{% endif_version %}
Policies applied to data plane proxies all follow the same basic structure:
diff --git a/app/_src/policies/health-check.md b/app/_src/policies/health-check.md
index 794737788..50af52069 100644
--- a/app/_src/policies/health-check.md
+++ b/app/_src/policies/health-check.md
@@ -1,11 +1,6 @@
---
title: Health Check
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? You don't need this policy, check [`MeshHealthCheck`](/docs/{{ page.version }}/policies/meshhealthcheck) instead.
-{% endwarning %}
-{% endif_version %}
{% tip %}
Health Check is an outbound policy. Dataplanes whose configuration is modified are in the `sources` matcher.
diff --git a/app/_src/policies/how-kuma-chooses-the-right-policy-to-apply.md b/app/_src/policies/how-kuma-chooses-the-right-policy-to-apply.md
index 85ec723fa..db5895d2f 100644
--- a/app/_src/policies/how-kuma-chooses-the-right-policy-to-apply.md
+++ b/app/_src/policies/how-kuma-chooses-the-right-policy-to-apply.md
@@ -2,17 +2,10 @@
title: How Kuma chooses the right policy to apply
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? You don't need this, check [`TargetRef` policies](/docs/{{ page.version }}/policies/introduction) instead.
-{% endwarning %}
-{% endif_version %}
-{% if_version lte:2.5.x %}
{% tip %}
This only applies to source/destination policies.
If you are unfamiliar with these, checkout [introduction to policies](/docs/{{ page.version }}/policies/introduction).
{% endtip %}
-{% endif_version %}
At any single moment, there might be multiple policies (of the same type) that match a connection between `sources` and `destinations` `Dataplane`s.
diff --git a/app/_src/policies/introduction.md b/app/_src/policies/introduction.md
index dfd8aa686..b1fe7a00f 100644
--- a/app/_src/policies/introduction.md
+++ b/app/_src/policies/introduction.md
@@ -7,29 +7,22 @@ Going forward from version 2.0, {{site.mesh_product_name}} is transitioning from
The following table shows the equivalence between source/destination and `targetRef` policies:
-| source/destination policy | `targetRef` policy |
-|-----------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| [CircuitBreaker](/docs/{{ page.version }}/policies/circuit-breaker) | [MeshCircuitBreaker](/docs/{{ page.version }}/policies/meshcircuitbreaker) |
-| [FaultInjection](/docs/{{ page.version }}/policies/fault-injection) | [MeshFaultInjection](/docs/{{ page.version }}/policies/meshfaultinjection) |
-| [HealthCheck](/docs/{{ page.version }}/policies/health-check) | [MeshHealthCheck](/docs/{{ page.version }}/policies/meshhealthcheck) |
-| [RateLimit](/docs/{{ page.version }}/policies/rate-limit) | [MeshRateLimit](/docs/{{ page.version }}/policies/meshratelimit) |
-| [Retry](/docs/{{ page.version }}/policies/retry) | [MeshRetry](/docs/{{ page.version }}/policies/meshretry) |
-| [Timeout](/docs/{{ page.version }}/policies/timeout) | [MeshTimeout](/docs/{{ page.version }}/policies/meshtimeout) |
-| [TrafficLog](/docs/{{ page.version }}/policies/traffic-log) | [MeshAccessLog](/docs/{{ page.version }}/policies/meshaccesslog) |
-| [TrafficMetrics](/docs/{{ page.version }}/policies/traffic-metrics) | {% if_version lte:2.5.x inline:true %} N/A {% endif_version %} {% if_version inline:true gte:2.6.x %} [MeshMetric](/docs/{{ page.version }}/policies/meshmetric) {% endif_version %} |
-| [TrafficPermissions](/docs/{{ page.version }}/policies/traffic-permissions) | [MeshTrafficPermission](/docs/{{ page.version }}/policies/meshtrafficpermission) |
-| [TrafficRoute](/docs/{{ page.version }}/policies/traffic-route) | [MeshHTTPRoute](/docs/{{ page.version }}/policies/meshhttproute) |
-| [TrafficTrace](/docs/{{ page.version }}/policies/traffic-trace) | [MeshTrace](/docs/{{ page.version }}/policies/meshtrace) |
-| [ProxyTemplate](/docs/{{ page.version }}/policies/proxy-template) | [MeshProxyPatch](/docs/{{ page.version }}/policies/meshproxypatch) |
+| source/destination policy | `targetRef` policy |
+|-----------------------------------------------------------------------------|----------------------------------------------------------------------------------|
+| [CircuitBreaker](/docs/{{ page.version }}/policies/circuit-breaker) | [MeshCircuitBreaker](/docs/{{ page.version }}/policies/meshcircuitbreaker) |
+| [FaultInjection](/docs/{{ page.version }}/policies/fault-injection) | [MeshFaultInjection](/docs/{{ page.version }}/policies/meshfaultinjection) |
+| [HealthCheck](/docs/{{ page.version }}/policies/health-check) | [MeshHealthCheck](/docs/{{ page.version }}/policies/meshhealthcheck) |
+| [RateLimit](/docs/{{ page.version }}/policies/rate-limit) | [MeshRateLimit](/docs/{{ page.version }}/policies/meshratelimit) |
+| [Retry](/docs/{{ page.version }}/policies/retry) | [MeshRetry](/docs/{{ page.version }}/policies/meshretry) |
+| [Timeout](/docs/{{ page.version }}/policies/timeout) | [MeshTimeout](/docs/{{ page.version }}/policies/meshtimeout) |
+| [TrafficLog](/docs/{{ page.version }}/policies/traffic-log) | [MeshAccessLog](/docs/{{ page.version }}/policies/meshaccesslog) |
+| [TrafficMetrics](/docs/{{ page.version }}/policies/traffic-metrics) | N/A |
+| [TrafficPermissions](/docs/{{ page.version }}/policies/traffic-permissions) | [MeshTrafficPermission](/docs/{{ page.version }}/policies/meshtrafficpermission) |
+| [TrafficRoute](/docs/{{ page.version }}/policies/traffic-route) | [MeshHTTPRoute](/docs/{{ page.version }}/policies/meshhttproute) |
+| [TrafficTrace](/docs/{{ page.version }}/policies/traffic-trace) | [MeshTrace](/docs/{{ page.version }}/policies/meshtrace) |
+| [ProxyTemplate](/docs/{{ page.version }}/policies/proxy-template) | [MeshProxyPatch](/docs/{{ page.version }}/policies/meshproxypatch) |
{% warning %}
-{% if_version lte:2.5.x %}
`targetRef` policies are still beta and it is therefore not supported to mix source/destination and targetRef policies
together.
-{% endif_version %}
-{% if_version gte:2.6.x %}
-If you are new to Kuma you should only need to use `targetRef` policies.
-If you already use source/destination policies you can keep using them. Future versions of Kuma will provide a migration path.
-You can mix targetRef and source/destination policies as long as they are of different types. For example: You can use `MeshTrafficPermission` with `FaultInjection` but you can't use `MeshTrafficPermission` with `TrafficPermission`.
-{% endif_version %}
{% endwarning %}
diff --git a/app/_src/policies/locality-aware.md b/app/_src/policies/locality-aware.md
index d63c63f89..8ae13a3fe 100644
--- a/app/_src/policies/locality-aware.md
+++ b/app/_src/policies/locality-aware.md
@@ -4,7 +4,7 @@ title: Locality-aware Load Balancing
{% if_version gte:2.5.x %}
{% warning %}
-New to Kuma? You don't need this, Check the [`MeshLoadBalancingStrategy` policy](/docs/{{ page.version }}/policies/meshloadbalancingstrategy) instead.
+This mode of doing locality aware load balancing is being replaced by [MeshLoadBalancingStrategy](/docs/{{ page.version }}/policies/meshloadbalancingstrategy) which is more powerful and flexible.
{% endwarning %}
{% endif_version %}
diff --git a/app/_src/policies/meshaccesslog.md b/app/_src/policies/meshaccesslog.md
index 82203d0d8..e14cb3c4b 100644
--- a/app/_src/policies/meshaccesslog.md
+++ b/app/_src/policies/meshaccesslog.md
@@ -19,30 +19,24 @@ If you haven't, see the [observability docs](/docs/{{ page.version }}/explore/ob
{% if_version gte:2.4.x %}
{% tabs targetRef useUrlFragment=false %}
{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-| `from[].targetRef.kind` | `Mesh` |
+| `targetRef.kind` | top level | to | from |
+| ------------------- | --------- | --- | ---- |
+| `Mesh` | ✅ | ✅ | ✅ |
+| `MeshSubset` | ✅ | ❌ | ❌ |
+| `MeshService` | ✅ | ✅ | ❌ |
+| `MeshServiceSubset` | ✅ | ❌ | ❌ |
{% endtab %}
{% tab targetRef Builtin Gateway %}
-{% if_version lte:2.5.x %}
-| `targetRef` | Allowed kinds |
-| --------------------- | ----------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService` |
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-{% endif_version %}
-{% if_version gte:2.6.x %}
-| `targetRef` | Allowed kinds |
-| --------------------- | ------------------------------------------------ |
-| `targetRef.kind` | `Mesh`, `MeshGateway`, `MeshGateway` with `tags` |
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-{% endif_version %}
+| `targetRef.kind` | top level | to |
+| ------------------- | --------- | --- |
+| `Mesh` | ✅ | ✅ |
+| `MeshGateway` | ✅ | ❌ |
+| `MeshService` | ✅ | ❌ |
{% endtab %}
{% endtabs %}
-{% endif_version %}
+{% endif_version %}
{% if_version lte:2.3.x %}
| `targetRef.kind` | top level | to | from |
diff --git a/app/_src/policies/meshcircuitbreaker.md b/app/_src/policies/meshcircuitbreaker.md
index b71a53bae..35b777dda 100644
--- a/app/_src/policies/meshcircuitbreaker.md
+++ b/app/_src/policies/meshcircuitbreaker.md
@@ -38,35 +38,12 @@ target proxies are healthy or not.
## TargetRef support matrix
-{% if_version gte:2.6.x %}
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-| `from[].targetRef.kind` | `Mesh` |
-{% endtab %}
-
-{% tab targetRef Builtin Gateway %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshGateway`, `MeshGateway` with listener `tags`|
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-{% endtab %}
-{% endtabs %}
-
-{% endif_version %}
-{% if_version lte:2.5.x %}
-
-| `targetRef.kind` | top level | to | from |
-| ------------------- | --------- | --- | ---- |
-| `Mesh` | ✅ | ✅ | ✅ |
-| `MeshSubset` | ✅ | ❌ | ❌ |
-| `MeshService` | ✅ | ✅ | ❌ |
-| `MeshServiceSubset` | ✅ | ❌ | ❌ |
-
-{% endif_version %}
+| TargetRef type | top level | to | from |
+|-------------------|-----------|-----|------|
+| Mesh | ✅ | ✅ | ✅ |
+| MeshSubset | ✅ | ❌ | ❌ |
+| MeshService | ✅ | ✅ | ❌ |
+| MeshServiceSubset | ✅ | ❌ | ❌ |
To learn more about the information in this table, see the [matching docs](/docs/{{ page.version }}/policies/targetref).
diff --git a/app/_src/policies/meshfaultinjection.md b/app/_src/policies/meshfaultinjection.md
index 7934fd421..d2d9b1e60 100644
--- a/app/_src/policies/meshfaultinjection.md
+++ b/app/_src/policies/meshfaultinjection.md
@@ -11,26 +11,6 @@ Do **not** combine with [FaultInjection](/docs/{{ page.version }}/policies/fault
## `targetRef` support matrix
-{% if_version gte:2.6.x %}
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-| `from[].targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-{% endtab %}
-
-{% tab targetRef Builtin Gateway %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshGateway`, `MeshGateway` with listener `tags`|
-| `to[].targetRef.kind` | `Mesh` |
-{% endtab %}
-{% endtabs %}
-
-{% endif_version %}
-{% if_version lte:2.5.x %}
-
| `targetRef.kind` | top level | to | from |
| ------------------- | --------- | --- | ---- |
| `Mesh` | ✅ | ❌ | ✅ |
@@ -38,8 +18,6 @@ Do **not** combine with [FaultInjection](/docs/{{ page.version }}/policies/fault
| `MeshService` | ✅ | ❌ | ✅ |
| `MeshServiceSubset` | ✅ | ❌ | ✅ |
-{% endif_version %}
-
To learn more about the information in this table, see the [matching docs](/docs/{{ page.version }}/policies/targetref).
## Configuration
diff --git a/app/_src/policies/meshgatewayinstance.md b/app/_src/policies/meshgatewayinstance.md
index 829e8f984..99984a5b6 100644
--- a/app/_src/policies/meshgatewayinstance.md
+++ b/app/_src/policies/meshgatewayinstance.md
@@ -11,11 +11,6 @@ instances that listen and serve traffic.
Kuma offers `MeshGatewayInstance` to manage a Kubernetes `Deployment` and `Service`
that together provide service capacity for the `MeshGateway` with the matching `kuma.io/service` tag.
-{% tip %}
-If you're not using the `default` `Mesh`, you'll need to _label_ the
-`MeshGatewayInstance` using `kuma.io/mesh`.
-{% endtip %}
-
Consider the following example:
```yaml
@@ -24,8 +19,6 @@ kind: MeshGatewayInstance
metadata:
name: edge-gateway
namespace: default
- labels:
- kuma.io/mesh: default # only necessary if not using default Mesh
spec:
replicas: 2
serviceType: LoadBalancer
@@ -38,6 +31,11 @@ This `Deployment` deploys 2 replicas of `kuma-dp` and corresponding builtin gate
The control plane also creates a new `Service` to send network traffic to the builtin `Dataplane` pods.
The `Service` is of type `LoadBalancer`, and its ports are automatically adjusted to match the listeners on the corresponding `MeshGateway`.
+{% tip %}
+If you're not using the `default` `Mesh`, you'll need to _label_ the
+`MeshGatewayInstance` using `kuma.io/mesh`.
+{% endtip %}
+
## Customization
{% if_version lte:2.1.x %}
diff --git a/app/_src/policies/meshgatewayroute.md b/app/_src/policies/meshgatewayroute.md
index 5d04174b3..3de2cfc3e 100644
--- a/app/_src/policies/meshgatewayroute.md
+++ b/app/_src/policies/meshgatewayroute.md
@@ -1,11 +1,6 @@
---
title: MeshGatewayRoute
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? Don't use this, check the [`MeshHTTPRoute` policy](/docs/{{ page.version }}/policies/meshhttproute) or [`MeshTCPRoute` policy](/docs/{{ page.version }}/policies/meshtcproute) instead.
-{% endwarning %}
-{% endif_version %}
`MeshGatewayRoute` is a policy used to configure [{{site.mesh_product_name}}'s builtin gateway](/docs/{{ page.version }}/explore/gateway#builtin).
It is used in combination with [`MeshGateway`](/docs/{{ page.version }}/policies/meshgateway).
@@ -13,9 +8,9 @@ It is used in combination with [`MeshGateway`](/docs/{{ page.version }}/policies
`MeshGatewayRoute` is a new {{site.mesh_product_name}} dataplane policy that replaces TrafficRoute for {{site.mesh_product_name}} Gateway.
It configures how a gateway should process network traffic.
At the moment, it targets HTTP routing use cases.
-`MeshGatewayRoutes` are attached to gateways by matching their selector to the [`MeshGateway`](/docs/{{ page.version }}/policies/meshgateway) listener tags. This requires the `kuma.io/service` tag and, optionally, additional tags to match specific `MeshGateway` listeners.
+`MeshGatewayRoutes` are attached to gateways by matching their selector to the [`MeshGateway`](/docs/{{ page.version }}/policies/meshgateway) listener tags.
-The following `MeshGatewayRoute` routes traffic to the `backend` service and attaches to any listeners tagged with `vhost=foo.example.com` that attach to builtin gateways with `kuma.io/service: edge-gateway`.
+To define `MeshGatewayRoute` that attaches a route to a listener with a tag: `vhost=foo.example.com` and routes traffic to the backend service do:
{% tabs usage useUrlFragment=false %}
{% tab usage Universal %}
diff --git a/app/_src/policies/meshhealthcheck.md b/app/_src/policies/meshhealthcheck.md
index 59dd51116..49457b54f 100644
--- a/app/_src/policies/meshhealthcheck.md
+++ b/app/_src/policies/meshhealthcheck.md
@@ -24,26 +24,6 @@ This mode generates extra traffic to other proxies and services as described in
## TargetRef support matrix
-{% if_version gte:2.6.x %}
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| --------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-{% endtab %}
-
-{% tab targetRef Builtin Gateway %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshGateway`, `MeshGateway` with listener `tags`|
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-{% endtab %}
-{% endtabs %}
-
-{% endif_version %}
-{% if_version lte:2.5.x %}
-
| TargetRef type | top level | to | from |
| ----------------- | --------- | --- | ---- |
| Mesh | ✅ | ✅ | ❌ |
@@ -51,7 +31,6 @@ This mode generates extra traffic to other proxies and services as described in
| MeshService | ✅ | ✅ | ❌ |
| MeshServiceSubset | ✅ | ❌ | ❌ |
-{% endif_version %}
To learn more about the information in this table, see the [matching docs](/docs/{{ page.version }}/policies/targetref).
diff --git a/app/_src/policies/meshhttproute.md b/app/_src/policies/meshhttproute.md
index f1ce9fb31..e17403444 100644
--- a/app/_src/policies/meshhttproute.md
+++ b/app/_src/policies/meshhttproute.md
@@ -4,7 +4,7 @@ title: Mesh HTTP Route
{% warning %}
This policy uses new policy matching algorithm.
-Do **not** combine with [TrafficRoute](/docs/{{ page.version }}/policies/traffic-route) except for the default `route-all` route, which should be kept..
+Do **not** combine with [TrafficRoute](/docs/{{ page.version }}/policies/traffic-route).
{% endwarning %}
The `MeshHTTPRoute` policy allows altering and redirecting HTTP requests
@@ -114,10 +114,6 @@ them in a `MeshHTTPRoute`!
- **`weight`** - when a request matches the route, the choice of an upstream cluster
is determined by its weight. Total weight is a sum of all weights in `backendRefs` list.
-## Interactions with `MeshTCPRoute`
-
-`MeshHTTPRoute` takes priority over [`MeshTCPRoute`](../meshtcproute) when both are defined for the same service, and the matching `MeshTCPRoute` is ignored.
-
## Examples
### Traffic split
diff --git a/app/_src/policies/meshloadbalancingstrategy.md b/app/_src/policies/meshloadbalancingstrategy.md
index 3aa6c0906..276353549 100644
--- a/app/_src/policies/meshloadbalancingstrategy.md
+++ b/app/_src/policies/meshloadbalancingstrategy.md
@@ -6,31 +6,12 @@ title: MeshLoadBalancingStrategy
This policy uses new policy matching algorithm.
{% endwarning %}
-This policy enables {{site.mesh_product_name}} to configure the load balancing strategy for traffic between services in the mesh.
-When using this policy, the [localityAwareLoadBalancing](/docs/{{ page.version }}/policies/locality-aware) flag is ignored.
+This policy enables {{site.mesh_product_name}} to configure the load balancing strategy
+for traffic between services in the mesh. Also, [localityAwareLoadBalancing](/docs/{{ page.version }}/policies/locality-aware)
+flag is going to be replaced by the current policy and will be deprecated in the future releases.
## TargetRef support matrix
-{% if_version gte:2.6.x %}
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| --------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-{% endtab %}
-
-{% tab targetRef Builtin Gateway %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshGateway`, `MeshGateway` with listener `tags`|
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-{% endtab %}
-{% endtabs %}
-
-{% endif_version %}
-{% if_version lte:2.5.x %}
-
| TargetRef type | top level | to | from |
| ----------------- | --------- | --- | ---- |
| Mesh | ✅ | ✅ | ❌ |
@@ -38,8 +19,6 @@ When using this policy, the [localityAwareLoadBalancing](/docs/{{ page.version }
| MeshService | ✅ | ✅ | ❌ |
| MeshServiceSubset | ✅ | ❌ | ❌ |
-{% endif_version %}
-
To learn more about the information in this table, see the [matching docs](/docs/{{ page.version }}/policies/targetref).
## Configuration
@@ -97,7 +76,7 @@ Advanced locality-aware load balancing provides a powerful means of defining how
- **`AnyExcept`** - traffic will be load balanced to every available zone except those specified in zones list.
- **`None`** - traffic will not be load balanced to any zone.
- **`zones`** - list of zone names
- - **`failoverThreshold.percentage`** - (optional) defines the percentage of live destination dataplane proxies below which load balancing to the next priority starts. .e.g: If you have this set to 70 and you have 10 dataplane proxies it will start load balancing to the next priority when the number of healthy destinations falls under 7. The value to be in (0.0 - 100.0] range (Default 50). If the value is a double number, put it in quotes.
+ - **`failoverThreshold.percentage`** - (optional) defines the percentage of live destination dataplane proxies below which load balancing to the next priority starts. Has to be in (0.0 - 100.0] range. If the value is a double number, put it in quotes.
#### Zone Egress support
diff --git a/app/_src/policies/meshmetric.md b/app/_src/policies/meshmetric.md
deleted file mode 100644
index 4dc6e43cf..000000000
--- a/app/_src/policies/meshmetric.md
+++ /dev/null
@@ -1,283 +0,0 @@
----
-title: MeshMetric
----
-
-{% warning %}
-This policy uses new policy matching algorithm.
-Do **not** combine with [Traffic Metrics](/docs/{{ page.version }}/policies/traffic-metrics).
-{% endwarning %}
-
-{{site.mesh_product_name}} facilitates consistent traffic metrics across all data plane proxies in your mesh.
-
-You can define metrics configuration for a whole Mesh, and optionally tweak certain parts for individual data plane proxies.
-For example, you might need to override the default metrics port if it's already in use on the specified machine.
-
-{{site.mesh_product_name}} provides full integration with Prometheus:
-
-* Each proxy can expose its metrics in [Prometheus format](https://prometheus.io/docs/instrumenting/exposition_formats/#text-based-format).
-* {{site.mesh_product_name}} exposes an API called the monitoring assignment service (MADS) which exposes proxies configured by `MeshMetric`.
-
-To collect metrics from {{site.mesh_product_name}}, you need to expose metrics from proxies and applications.
-
-{% tip %}
-In the rest of this page we assume you have already configured your observability tools to work with {{site.mesh_product_name}}.
-If you haven't already read the [observability docs](/docs/{{ page.version }}/explore/observability).
-{% endtip %}
-
-## TargetRef support matrix
-
-| TargetRef type | top level | to | from |
-|-------------------|-----------|----|------|
-| Mesh | ✅ | ❌ | ❌ |
-| MeshSubset | ✅ | ❌ | ❌ |
-| MeshService | ✅ | ❌ | ❌ |
-| MeshServiceSubset | ✅ | ❌ | ❌ |
-
-To learn more about the information in this table, see the [matching docs](/docs/{{ page.version }}/policies/targetref).
-
-## Configuration
-
-There are three main sections of the configuration: `sidecar`, `applications`, `backends`.
-The first two define how to scrape parts of the mesh (sidecar and underlying applications), the third one defines what to do with the data (in case of Prometheus instructs to scrape specific address, in case of OpenTelemetry defines where to push data).
-
-{% tip %}
-In contrast to [Traffic Metrics](/docs/{{ page.version }}/policies/traffic-metrics) all configuration is dynamic and no restarts of the Data Plane Proxies are needed.
-You can define configuration refresh interval by using `KUMA_DATAPLANE_RUNTIME_DYNAMIC_CONFIGURATION_REFRESH_INTERVAL` env var or `{{site.set_flag_values_prefix}}dataplaneRuntime.dynamicConfiguration.refreshInterval` Helm value.
-{% endtip %}
-
-### Sidecar
-
-This part of the configuration applies to the data plane proxy scraping.
-
-In case you don't want to retrieve all Envoy's metrics, it's possible to filter them.
-You are able to specify [`regex`](https://www.envoyproxy.io/docs/envoy/latest/operations/admin#get--stats?filter=regex) which causes the metrics endpoint to return only matching metrics.
-Also, you can set flag [`usedOnly`](https://www.envoyproxy.io/docs/envoy/latest/operations/admin#get--stats?usedonly) that returns only metrics updated by Envoy.
-
-Example section of the configuration:
-
-```yaml
- sidecar:
- regex: http2_act.*
- usedOnly: true
-```
-
-### Applications
-
-In addition to exposing metrics from the data plane proxies, you might want to expose metrics from applications running next to the proxies.
-{{site.mesh_product_name}} allows scraping Prometheus metrics from the applications endpoint running in the same `Pod` or `VM`.
-Later those metrics are aggregated and exposed at the same `port/path` as data plane proxy metrics.
-It is possible to configure it at the `Mesh` level, for all the applications in the `Mesh`, or just for specific applications.
-
-Here are reasons where you'd want to use this feature:
-- Application metrics are labelled with your mesh parameters (tags, mesh, data plane name...), this means that in mixed Universal and Kubernetes mode metrics are reported with the same types of labels.
-- Both application and sidecar metrics are scraped at the same time. This makes sure they are coherent (with 2 different scrapers they can end up scraping at different intervals and make metrics harder to correlate).
-- If you disable [passthrough](/docs/{{ page.version }}/networking/non-mesh-traffic#outgoing) and your mesh uses mTLS and Prometheus is outside the mesh this is the only way to retrieve these metrics as the app is completely hidden behind the sidecar.
-
-Example section of the configuration:
-
-```yaml
- applications:
- - path: "/metrics/prometheus"
- address: # optional custom address if the underlying application listens on a different address than the Data Plane Proxy
- port: 8888
-```
-
-### Backends
-
-```yaml
- backends:
- - type: Prometheus
- prometheus:
- port: 5670
- path: /metrics
-```
-
-This tells {{site.mesh_product_name}} to expose an HTTP endpoint with Prometheus metrics on port `5670` and URI path `/metrics`.
-
-The metrics endpoint is forwarded to the standard Envoy [Prometheus metrics endpoint](https://www.envoyproxy.io/docs/envoy/latest/operations/admin#get--stats?format=prometheus) and supports the same query parameters.
-You can pass the `filter` query parameter to limit the results to metrics whose names match a given regular expression.
-By default, all available metrics are returned.
-
-#### Secure metrics with TLS
-
-{{site.mesh_product_name}} allows configuring metrics endpoint with TLS.
-
-```yaml
- backends:
- - type: Prometheus
- prometheus:
- port: 5670
- path: /metrics
- tls:
- mode: ProvidedTLS
-```
-
-In addition to the `MeshMetric` configuration, `kuma-sidecar` requires a provided certificate and key for its operation.
-
-{% tabs expose-mesh-metrics-data-plane-proxies-tls useUrlFragment=false %}
-{% tab expose-mesh-metrics-data-plane-proxies-tls Kubernetes %}
-
-When the certificate and key are available within the container, `kuma-sidecar` needs the paths to provided files as the following environment variables:
-
-* `KUMA_DATAPLANE_RUNTIME_METRICS_CERT_PATH`
-* `KUMA_DATAPLANE_RUNTIME_METRICS_KEY_PATH`
-
-It's possible to use a [`ContainerPatch`](/docs/{{ page.version }}/production/dp-config/dpp-on-kubernetes/#custom-container-configuration) to add variables to `kuma-sidecar`:
-
-```yaml
-apiVersion: kuma.io/v1alpha1
-kind: ContainerPatch
-metadata:
- name: container-patch-1
- namespace: kuma-system
-spec:
- sidecarPatch:
- - op: add
- path: /env/-
- value: '{
- "name": "KUMA_DATAPLANE_RUNTIME_METRICS_CERT_PATH",
- "value": "/kuma/server.crt"
- }'
- - op: add
- path: /env/-
- value: '{
- "name": "KUMA_DATAPLANE_RUNTIME_METRICS_KEY_PATH",
- "value": "/kuma/server.key"
- }'
-```
-
-{% endtab %}
-{% tab expose-mesh-metrics-data-plane-proxies-tls Universal %}
-
-Please upload the certificate and the key to the machine, and then define the following environment variables with the correct paths:
-
- * `KUMA_DATAPLANE_RUNTIME_METRICS_CERT_PATH`
- * `KUMA_DATAPLANE_RUNTIME_METRICS_KEY_PATH`
-
-{% endtab %}
-{% endtabs %}
-
-#### activeMTLSBackend
-
-We no longer support activeMTLSBackend, if you need to encrypt and authorize the metrics use [Secure metrics with TLS](#secure-metrics-with-tls) with a combination of [one of the authorization methods](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config).
-
-#### Running multiple prometheus instances
-
-If you need to run multiple instances of Prometheus and want to target different set of Data Plane Proxies you can do this by using Client ID setting on both `MeshMetric` (`clientId`) and [Prometheus configuration](https://github.com/prometheus/prometheus/pull/13278/files#diff-17f1012e0c2fbd9bcd8dff3c23b18ff4b6676eef3beca6f8a3e72e6a36633334R2233) (`client_id`).
-
-{% warning %}
-To use `clientId` setting you need to be running at least Prometheus `2.49.0`.
-{% endwarning %}
-
-Example configurations differentiated by `prometheus` tag:
-
-{% policy_yaml first %}
-```yaml
-type: MeshMetric
-name: prometheus-one
-mesh: default
-spec:
- targetRef:
- kind: MeshSubset
- tags:
- prometheus: "one"
- backends:
- - type: Prometheus
- prometheus:
- clientId: "prometheus-one"
- port: 5670
- path: /metrics
-```
-{% endpolicy_yaml %}
-
-{% policy_yaml second %}
-```yaml
-type: MeshMetric
-name: prometheus-two
-mesh: default
-spec:
- targetRef:
- kind: MeshSubset
- tags:
- prometheus: "two"
- backends:
- - type: Prometheus
- prometheus:
- clientId: "prometheus-two"
- port: 5670
- path: /metrics
-```
-{% endpolicy_yaml %}
-
-And the Prometheus configurations:
-
-```yaml
-scrape_configs:
- - job_name: 'kuma-dataplanes'
- # ...
- kuma_sd_configs:
- - server: http://localhost:5676
- refresh_interval: 60s # different from prometheus-two
- client_id: "prometheus-one"
-```
-
-```yaml
-scrape_configs:
- - job_name: 'kuma-dataplanes'
- # ...
- kuma_sd_configs:
- - server: http://localhost:5676
- refresh_interval: 20s # different from prometheus-one
- client_id: "prometheus-two"
-```
-
-## Examples
-
-### With custom port, path, clientId, application aggregation and service override
-
-The first policy defines a default `MeshMetric` policy for the `default` mesh.
-The second policy creates an override for workloads tagged with `framework: example-web-framework`.
-That web framework exposes metrics under `/metrics/prometheus` and port `8888`.
-
-{% policy_yaml customone %}
-```yaml
-type: MeshMetric
-mesh: default
-name: metrics-default
-spec:
- targetRef:
- kind: Mesh
- default:
- sidecar:
- usedOnly: true
- backends:
- - type: Prometheus
- prometheus:
- clientId: main-backend
- port: 5670
- path: /metrics
- tls:
- mode: "ProvidedTLS"
-```
-{% endpolicy_yaml %}
-
-{% policy_yaml customtwo %}
-```yaml
-type: MeshMetric
-mesh: default
-name: metrics-for-mesh-service
-spec:
- targetRef:
- kind: MeshSubset
- tags:
- framework: "example-web-framework"
- default:
- applications:
- - path: "/metrics/prometheus"
- port: 8888
-```
-{% endpolicy_yaml %}
-
-## All policy options
-
-{% json_schema MeshMetrics %}
diff --git a/app/_src/policies/meshproxypatch.md b/app/_src/policies/meshproxypatch.md
index a9355a238..b9028289f 100644
--- a/app/_src/policies/meshproxypatch.md
+++ b/app/_src/policies/meshproxypatch.md
@@ -34,23 +34,7 @@ Do **not** combine with [Proxy Template](/docs/{{ page.version }}/policies/proxy
{% endif_version %}
{% if_version gte:2.5.x %}
-{% if_version gte:2.6.x %}
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| --------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-{% endtab %}
-
-{% tab targetRef Builtin Gateway %}
-| `targetRef` | Allowed kinds |
-| ---------------- | --------------------- |
-| `targetRef.kind` | `Mesh`, `MeshGateway` |
-{% endtab %}
-{% endtabs %}
-{% endif_version %}
-{% if_version lte:2.5.x %}
| `targetRef.kind` | top level |
|---------------------|-----------|
| `Mesh` | ✅ |
@@ -59,7 +43,6 @@ Do **not** combine with [Proxy Template](/docs/{{ page.version }}/policies/proxy
| `MeshServiceSubset` | ✅ |
| `MeshGateway` | ✅ |
-{% endif_version %}
{% endif_version %}
To learn more about the information in this table, see the [matching docs](/docs/{{ page.version }}/policies/targetref).
diff --git a/app/_src/policies/meshratelimit.md b/app/_src/policies/meshratelimit.md
index 83382197f..9d2bc1870 100644
--- a/app/_src/policies/meshratelimit.md
+++ b/app/_src/policies/meshratelimit.md
@@ -22,26 +22,6 @@ Rate limiting supports an [ExternalService](/docs/{{ page.version }}/policies/ex
## TargetRef support matrix
-{% if_version gte:2.6.x %}
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-| `from[].targetRef.kind` | `Mesh` |
-{% endtab %}
-
-{% tab targetRef Builtin Gateway %}
-| `targetRef` | Allowed kinds |
-| --------------------- | --------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshGateway`, `MeshGateway` with listener `tags` |
-| `to[].targetRef.kind` | `Mesh` |
-{% endtab %}
-{% endtabs %}
-
-{% endif_version %}
-{% if_version lte:2.5.x %}
-
| TargetRef type | top level | to | from |
| ----------------- | --------- | --- | ---- |
| Mesh | ✅ | ❌ | ✅ |
@@ -49,8 +29,6 @@ Rate limiting supports an [ExternalService](/docs/{{ page.version }}/policies/ex
| MeshService | ✅ | ❌ | ❌ |
| MeshServiceSubset | ✅ | ❌ | ❌ |
-{% endif_version %}
-
To learn more about the information in this table, see the [matching docs](/docs/{{ page.version }}/policies/targetref).
## Configuration
diff --git a/app/_src/policies/meshretry.md b/app/_src/policies/meshretry.md
index efc25dd0f..b349a281f 100644
--- a/app/_src/policies/meshretry.md
+++ b/app/_src/policies/meshretry.md
@@ -14,37 +14,21 @@ This policy enables {{site.mesh_product_name}} to know how to behave if there is
{% if_version gte:2.4.x %}
{% tabs targetRef useUrlFragment=false %}
{% tab targetRef Sidecar %}
-{% if_version gte:2.6.x %}
-| `targetRef` | Allowed kinds |
-| --------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-{% endif_version %}
-{% if_version lte:2.5.x %}
| `targetRef.kind` | top level | to | from |
| ------------------- | --------- | --- | ---- |
| `Mesh` | ✅ | ✅ | ❌ |
| `MeshSubset` | ✅ | ❌ | ❌ |
| `MeshService` | ✅ | ✅ | ❌ |
| `MeshServiceSubset` | ✅ | ❌ | ❌ |
-{% endif_version %}
{% endtab %}
{% tab targetRef Builtin Gateway %}
-{% if_version gte:2.6.x %}
-| `targetRef` | Allowed kinds |
-| --------------------- | --------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshGateway`, `MeshGateway` with listener `tags` |
-| `to[].targetRef.kind` | `Mesh` |
-{% endif_version %}
-{% if_version lte:2.5.x %}
| `targetRef.kind` | top level | to |
| ------------------- | --------- | --- |
| `Mesh` | ✅ | ✅ |
| `MeshGateway` | ✅ | ❌ |
| `MeshService` | ✅ | ❌ |
| `MeshServiceSubset` | ✅ | ❌ |
-{% endif_version %}
{% endtab %}
{% endtabs %}
diff --git a/app/_src/policies/meshtcproute.md b/app/_src/policies/meshtcproute.md
index 38539c2bc..8bb64e59a 100644
--- a/app/_src/policies/meshtcproute.md
+++ b/app/_src/policies/meshtcproute.md
@@ -4,18 +4,12 @@ title: MeshTCPRoute
{% warning %}
This policy uses a new policy matching algorithm.
-Do **not** combine with [TrafficRoute](/docs/{{ page.version }}/policies/traffic-route) except for the default `route-all` route, which should be kept.
+Do **not** combine with [TrafficRoute](/docs/{{ page.version }}/policies/traffic-route).
{% endwarning %}
The `MeshTCPRoute` policy allows you to alter and redirect TCP requests
depending on where the request is coming from and where it's going to.
-{% if_version lte:2.5.x %}
-{% warning %}
-`MeshTCPRoute` doesn't support cross zone traffic before version 2.6.0.
-{% endwarning %}
-{% endif_version %}
-
## TargetRef support matrix
| TargetRef type | top level | to | from |
@@ -59,9 +53,6 @@ The following describes the default configuration settings of the `MeshTCPRoute`
cluster is determined by its weight. Total weight is a sum of all weights
in the `backendRefs` list.
-## Interactions with `MeshHTTPRoute`
-
-[`MeshHTTPRoute`](../meshhttproute) takes priority over `MeshTCPRoute` when both are defined for the same service, and the matching `MeshTCPRoute` is ignored.
## Examples
diff --git a/app/_src/policies/meshtimeout.md b/app/_src/policies/meshtimeout.md
index 5f30e56a8..d5093f1e0 100644
--- a/app/_src/policies/meshtimeout.md
+++ b/app/_src/policies/meshtimeout.md
@@ -9,26 +9,6 @@ Do **not** combine with [Timeout policy](/docs/{{ page.version }}/policies/timeo
## TargetRef support matrix
-{% if_version gte:2.6.x %}
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | ------------------------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset`, `MeshHTTPRoute` |
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-| `from[].targetRef.kind` | `Mesh` |
-{% endtab %}
-
-{% tab targetRef Builtin Gateway %}
-| `targetRef` | Allowed kinds |
-| --------------------- | --------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshGateway`, `MeshGateway` with listener `tags` |
-| `to[].targetRef.kind` | `Mesh` |
-{% endtab %}
-{% endtabs %}
-
-{% endif_version %}
-{% if_version lte:2.5.x %}
{% if_version gte:2.3.x %}
| TargetRef type | top level | to | from |
@@ -50,7 +30,6 @@ Do **not** combine with [Timeout policy](/docs/{{ page.version }}/policies/timeo
| MeshService | ✅ | ✅ | ❌ |
| MeshServiceSubset | ✅ | ❌ | ❌ |
-{% endif_version %}
{% endif_version %}
To learn more about the information in this table, see the [matching docs](/docs/{{ page.version }}/policies/targetref).
diff --git a/app/_src/policies/meshtrace.md b/app/_src/policies/meshtrace.md
index 5807dbb2e..073e52f38 100644
--- a/app/_src/policies/meshtrace.md
+++ b/app/_src/policies/meshtrace.md
@@ -33,24 +33,6 @@ For HTTP you can also manually forward the following headers:
## TargetRef support matrix
-{% if_version gte:2.6.x %}
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| --------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-{% endtab %}
-
-{% tab targetRef Builtin Gateway %}
-| `targetRef` | Allowed kinds |
-| ---------------- | --------------------- |
-| `targetRef.kind` | `Mesh`, `MeshGateway` |
-{% endtab %}
-{% endtabs %}
-
-{% endif_version %}
-{% if_version lte:2.5.x %}
-
| TargetRef type | top level | to | from |
| ----------------- | --------- | --- | ---- |
| Mesh | ✅ | ❌ | ❌ |
@@ -58,8 +40,6 @@ For HTTP you can also manually forward the following headers:
| MeshService | ✅ | ❌ | ❌ |
| MeshServiceSubset | ✅ | ❌ | ❌ |
-{% endif_version %}
-
To learn more about the information in this table, see the [matching docs](/docs/{{ page.version }}/policies/targetref).
## Configuration
diff --git a/app/_src/policies/meshtrafficpermission.md b/app/_src/policies/meshtrafficpermission.md
index beff82f2a..1a7e07636 100644
--- a/app/_src/policies/meshtrafficpermission.md
+++ b/app/_src/policies/meshtrafficpermission.md
@@ -9,18 +9,12 @@ Do **not** combine with [TrafficPermission](/docs/{{ page.version }}/policies/tr
## TargetRef support matrix
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-| `from[].targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-{% endtab %}
-{% tab targetRef Builtin Gateway %}
-`MeshTrafficPermission` isn't supported on builtin gateways. If applied via
-`spec.targetRef.kind: MeshService`, it has no effect.
-{% endtab %}
-{% endtabs %}
+| TargetRef type | top level | to | from |
+| ----------------- | --------- | --- | ---- |
+| Mesh | ✅ | ❌ | ✅ |
+| MeshSubset | ✅ | ❌ | ✅ |
+| MeshService | ✅ | ❌ | ✅ |
+| MeshServiceSubset | ✅ | ❌ | ✅ |
If you don't understand this table you should read [matching docs](/docs/{{ page.version }}/policies/targetref).
diff --git a/app/_src/policies/rate-limit.md b/app/_src/policies/rate-limit.md
index 1efbcc018..bf6837e12 100644
--- a/app/_src/policies/rate-limit.md
+++ b/app/_src/policies/rate-limit.md
@@ -1,11 +1,6 @@
---
title: Rate Limit
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? Don't use this policy, check [`MeshRateLimit`](/docs/{{ page.version }}/policies/meshratelimit) instead.
-{% endwarning %}
-{% endif_version %}
{% tip %}
Rate Limit is an inbound policy. Dataplanes whose configuration is modified are in the `destinations` matcher.
diff --git a/app/_src/policies/retry.md b/app/_src/policies/retry.md
index 16f54fa82..58a498c38 100644
--- a/app/_src/policies/retry.md
+++ b/app/_src/policies/retry.md
@@ -1,11 +1,6 @@
---
title: Retry
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? Don't use this policy, check [`MeshRetry`](/docs/{{ page.version }}/policies/meshretry) instead.
-{% endwarning %}
-{% endif_version %}
{% tip %}
Retry is an outbound policy. Dataplanes whose configuration is modified are in the `sources` matcher.
diff --git a/app/_src/policies/targetref.md b/app/_src/policies/targetref.md
index f77e58d3e..5b8341b9b 100644
--- a/app/_src/policies/targetref.md
+++ b/app/_src/policies/targetref.md
@@ -9,23 +9,28 @@ A policy is a set of configuration that will be used to generate the proxy confi
## What do `targetRef` policies look like?
-There are two parts to a policy:
+There are two parts in a policy:
1. The metadata
2. The spec
### Metadata
-Metadata identifies the policies by its `name`, `type` and what `mesh` it's part of:
+Metadata identifies the policies by its `name`, `type` and what `mesh` it is part of.
+
+This is how it looks:
{% tabs metadata %}
{% tab metadata Universal %}
+A policy metadata looks like:
+
```yaml
type: ExamplePolicy
name: my-policy-name
mesh: default
-spec: ... # spec data specific to the policy kind
+spec:
+ ... # spec data specific to the policy kind
```
{% endtab %}
@@ -33,13 +38,16 @@ spec: ... # spec data specific to the policy kind
In Kubernetes all our policies are implemented as [custom resource definitions (CRD)](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) in the group `kuma.io/v1alpha1`.
+A policy metadata looks like:
+
```yaml
apiVersion: kuma.io/v1alpha1
kind: ExamplePolicy
metadata:
name: my-policy-name
- namespace: {{ site.mesh_namespace }}
-spec: ... # spec data specific to the policy kind
+ namespace: {{site.mesh_namespace}}
+spec:
+ ... # spec data specific to the policy kind
```
By default the policy is created in the `default` mesh.
@@ -52,10 +60,11 @@ apiVersion: kuma.io/v1alpha1
kind: ExamplePolicy
metadata:
name: my-policy-name
- namespace: {{ site.mesh_namespace }}
+ namespace: {{site.mesh_namespace}}
labels:
kuma.io/mesh: "my-mesh"
-spec: ... # spec data specific to the policy kind
+spec:
+ ... # spec data specific to the policy kind
```
{% warning %}
@@ -67,7 +76,7 @@ Policies are namespaced scope and currently the namespace must be the one the co
### Spec
-The `spec` field contains the actual configuration of the policy.
+The spec contains the actual configuration of the policy.
All specs have a **top level `targetRef`** which identifies which proxies this policy applies to.
In particular, it defines which proxies have their Envoy configuration modified.
@@ -129,10 +138,10 @@ It looks like:
```yaml
targetRef:
- kind: Mesh | MeshSubset | MeshService | MeshServiceSubset | MeshGateway
- name: "my-name" # For kinds MeshService, MeshServiceSubset and MeshGateway a name has to be defined
+ kind: Mesh | MeshSubset | MeshService | MeshServiceSubset | MeshGatewayRoute
+ name: "my-name" # For kinds MeshService, MeshServiceSubset and MeshGatewayRoute a name has to be defined
tags:
- key: value # For kinds MeshServiceSubset, MeshSubset and MeshGateway a list of matching tags can be used
+ key: value # For kinds MeshServiceSubset and MeshSubset a list of matching tags can be used
```
Here's an explanation of each kinds and their scope:
@@ -141,9 +150,7 @@ Here's an explanation of each kinds and their scope:
- MeshSubset: same as Mesh but filters only proxies who have matching `targetRef.tags`
- MeshService: all proxies with a tag `kuma.io/service` equal to `targetRef.name`
- MeshServiceSubset: same as `MeshService` but further refine to proxies that have matching `targetRef.tags`
-- MeshGateway: targets proxies matched by the named MeshGateway
- - Note that it's very strongly recommended to target MeshGateway proxies using this
- kind, as opposed to MeshService/MeshServiceSubset.
+- MeshGatewayRoute: gateway using `MeshGatewayRoute` that have a name equal to `targetRef.name`
Consider the example below:
@@ -152,7 +159,7 @@ apiVersion: kuma.io/v1alpha1
kind: MeshAccessLog
metadata:
name: example
- namespace: {{ site.mesh_namespace }}
+ namespace: {{site.mesh_namespace}}
labels:
kuma.io/mesh: default
spec:
@@ -192,68 +199,19 @@ Not every policy supports `to` and `from` levels. Additionally, not every resour
appear at every supported level. The specified top level resource can also affect which
resources can appear in `to` or `from`.
-{% if_version gte:2.6.x %}
-To help users, each policy documentation includes tables indicating which `targetRef` kinds is supported at each level.
-For each type of proxy, sidecar or builtin gateway, the table indicates for each
-`targetRef` level, which kinds are supported.
-
-The tables look like:
-
-{% tabs targetRef useUrlFragment=false %}
-{% tab targetRef Sidecar %}
-| `targetRef` | Allowed kinds |
-| ----------------------- | -------------------------------------------------------- |
-| `targetRef.kind` | `Mesh`, `MeshSubset`, `MeshService`, `MeshServiceSubset` |
-| `to[].targetRef.kind` | `Mesh`, `MeshService` |
-| `from[].targetRef.kind` | `Mesh` |
-{% endtab %}
-
-{% tab targetRef Builtin Gateway %}
-| `targetRef` | Allowed kinds |
-| --------------------- | ------------------------------------------------ |
-| `targetRef.kind` | `Mesh`, `MeshGateway`, `MeshGateway` with `tags` |
-| `to[].targetRef.kind` | `Mesh` |
-{% endtab %}
-{% endtabs %}
-
-#### Sidecar
-
-We see that we can select sidecar proxies via any of the kinds that select
-sidecars and we can set both `to` and `from`.
-
-We can apply policy to:
-* all traffic originating at the sidecar _to_ anywhere (`to[].targetRef.kind: Mesh`)
-* traffic _to_ a specific `kuma.io/service` (`to[].targetRef.kind: MeshService`)
-
-We can also apply policy to:
-* traffic terminating at the sidecar _from_ anywhere in the mesh (`from[].targetRef.kind: Mesh`)
-
-#### Builtin gateways
-
-We see that we can select gateway proxies via any of the kinds that select
-gateways as well as specific gateway listeners and we can set only `to`.
-
-We can only apply policy to:
-* all traffic originating at the gateway _to_ anywhere (`to[].targetRef.kind: Mesh`)
-{% endif_version %}
-{% if_version lte:2.5.x %}
-To help users, each policy documentation includes a table indicating which
-`targetRef` kinds is supported at each level.
+To help users, each policy documentation includes a table indicating which `targetRef` kinds is supported at each level.
This table looks like:
| `targetRef.kind` | top level | to | from |
-| ------------------- | --------- | --- | ---- |
+|---------------------| --------- | --- | ---- |
| `Mesh` | ✅ | ✅ | ❌ |
| `MeshSubset` | ✅ | ❌ | ❌ |
| `MeshService` | ✅ | ❌ | ✅ |
| `MeshServiceSubset` | ✅ | ❌ | ❌ |
-| `MeshGateway` | ✅ | ❌ | ❌ |
+| `MeshGatewayRoute` | ✅ | ❌ | ❌ |
-Here it indicates that the top level can use any targetRef kinds. But in
-`targetRef.to` only kind `Mesh` can be used and in `targetRef.from`
-only kind `MeshService`.
-{% endif_version %}
+Here it indicates that the top level can use any targetRef kinds. But in `targetRef.to` only kind `Mesh` can be used and in `targetRef.from` only kind `MeshService`.
### Merging configuration
@@ -262,7 +220,7 @@ because a proxy can be targeted by multiple `targetRef`'s.
We define a total order of policies:
-- Mesh > MeshSubset > MeshService > MeshServiceSubset (the more a `targetRef` is focused the higher priority it has)
+- Mesh > MeshSubset > MeshService > MeshServiceSubset > MeshGatewayRoute (the more a `targetRef` is focused the higher priority it has)
- If levels are equal the lexicographic order of policy names is used
For `to` and `from` policies we concatenate the array for each matching policies.
@@ -287,7 +245,6 @@ default:
```
The merge result is:
-
```yaml
default:
conf: 1
diff --git a/app/_src/policies/timeout.md b/app/_src/policies/timeout.md
index ce22d2136..7c53e7221 100644
--- a/app/_src/policies/timeout.md
+++ b/app/_src/policies/timeout.md
@@ -1,11 +1,6 @@
---
title: Timeout
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? Don't use this policy, check [`MeshTimeout`](/docs/{{ page.version }}/policies/meshtimeout) instead.
-{% endwarning %}
-{% endif_version %}
{% tip %}
Timeout is an outbound policy. Dataplanes whose configuration is modified are in the `sources` matcher.
diff --git a/app/_src/policies/traffic-log.md b/app/_src/policies/traffic-log.md
index 109c5bd69..dbe8ac463 100644
--- a/app/_src/policies/traffic-log.md
+++ b/app/_src/policies/traffic-log.md
@@ -1,11 +1,6 @@
---
title: Traffic Log
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? Don't use this, check the [`MeshAccessLog` policy](/docs/{{ page.version }}/policies/meshaccesslog) instead.
-{% endwarning %}
-{% endif_version %}
With the Traffic Log policy you can easily set up access logs on every data plane in a mesh.
diff --git a/app/_src/policies/traffic-metrics.md b/app/_src/policies/traffic-metrics.md
index ac45377cf..2cd6b4c4d 100644
--- a/app/_src/policies/traffic-metrics.md
+++ b/app/_src/policies/traffic-metrics.md
@@ -1,11 +1,6 @@
---
title: Traffic Metrics
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? Don't use this, check the [`MeshMetric` policy](/docs/{{ page.version }}/policies/meshmetric) instead.
-{% endwarning %}
-{% endif_version %}
{{site.mesh_product_name}} facilitates consistent traffic metrics across all data plane proxies in your mesh.
diff --git a/app/_src/policies/traffic-permissions.md b/app/_src/policies/traffic-permissions.md
index bff39d50e..1140be07c 100644
--- a/app/_src/policies/traffic-permissions.md
+++ b/app/_src/policies/traffic-permissions.md
@@ -1,12 +1,6 @@
---
title: Traffic Permissions
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? Don't use this, check the [`MeshTrafficPermission` policy](/docs/{{ page.version }}/policies/meshtrafficpermission) instead.
-{% endwarning %}
-{% endif_version %}
-
{% tip %}
Traffic Permissions is an inbound policy. Dataplanes whose configuration is modified are in the `destinations` matcher.
diff --git a/app/_src/policies/traffic-route.md b/app/_src/policies/traffic-route.md
index dd81a225f..b0b62a2b6 100644
--- a/app/_src/policies/traffic-route.md
+++ b/app/_src/policies/traffic-route.md
@@ -1,11 +1,6 @@
---
title: Traffic Route
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? Don't use this, check the [`MeshHTTPRoute`](/docs/{{ page.version }}/policies/meshhttproute) or [`MeshTCPRoute` policy](/docs/{{ page.version }}/policies/meshtcproute) policies instead.
-{% endwarning %}
-{% endif_version %}
{% tip %}
Traffic Route is an outbound policy. Dataplanes whose configuration is modified are in the `sources` matcher.
diff --git a/app/_src/policies/traffic-trace.md b/app/_src/policies/traffic-trace.md
index c79a1401d..c099e670a 100644
--- a/app/_src/policies/traffic-trace.md
+++ b/app/_src/policies/traffic-trace.md
@@ -1,11 +1,6 @@
---
title: Traffic Trace
---
-{% if_version gte:2.6.x %}
-{% warning %}
-New to Kuma? Don't use this, check the [`MeshTrace` policy](/docs/{{ page.version }}/policies/meshtrace) instead.
-{% endwarning %}
-{% endif_version %}
This policy enables tracing logging to a third party tracing solution.
diff --git a/app/_src/policies/virtual-outbound.md b/app/_src/policies/virtual-outbound.md
index 551f692e6..c53d19ef4 100644
--- a/app/_src/policies/virtual-outbound.md
+++ b/app/_src/policies/virtual-outbound.md
@@ -6,10 +6,10 @@ This policy lets you customize hostnames and ports for communicating with data p
Possible use cases are:
-1. Preserving hostnames when migrating to service mesh.
-2. Providing multiple hostnames for reaching the same service, for example when renaming or for usability.
-3. Providing specific routes, for example to reach a specific pod in a service with StatefulSets on Kubernetes, or to add a URL to reach a specific version of a service.
-4. Expose multiple inbounds on different ports.
+1) Preserving hostnames when migrating to service mesh.
+2) Providing multiple hostnames for reaching the same service, for example when renaming or for usability.
+3) Providing specific routes, for example to reach a specific pod in a service with StatefulSets on Kubernetes, or to add a URL to reach a specific version of a service.
+4) Expose multiple inbounds on different ports.
Limitations:
@@ -41,33 +41,6 @@ inbound:
and a virtual outbound with this definition:
-{% tabs default-test-virtualoutbound useUrlFragment=false %}
-{% tab default-test-virtualoutbound Kubernetes %}
-{% raw %}
-```yaml
-apiVersion: kuma.io/v1alpha1
-kind: VirtualOutbound
-mesh: default
-metadata:
- name: test
-spec:
- selectors:
- - match:
- kuma.io/service: "*"
- conf:
- host: "{{.v}}.{{.service}}.mesh"
- port: "{{.port}}"
- parameters:
- - name: service
- tagKey: "kuma.io/service"
- - name: port
- tagKey: "k8s.kuma.io/service-port"
- - name: v
- tagKey: version
-```
-{% endraw %}
-{% endtab %}
-{% tab default-test-virtualoutbound Universal %}
{% raw %}
```yaml
type: VirtualOutbound
@@ -88,20 +61,16 @@ conf:
tagKey: version
```
{% endraw %}
-{% endtab %}
-{% endtabs %}
produce the hostname: `v1.backend.mesh` with port: `1800`.
-Additional Requirements:
+Additional requirements:
-- {% if_version lte:2.1.x %}[Transparent proxying](/docs/{{ page.version }}/networking/transparent-proxying){% endif_version %}{% if_version gte:2.2.x %}[Transparent proxying](/docs/{{ page.version }}/production/dp-config/transparent-proxying/){% endif_version %} must be enabled.
-- Either:
- - [Data plane proxy DNS](/docs/{{ page.version }}/networking/dns) must be enabled.
- - Or, the value of `conf.host` must end with the value of `dns_server.domain`, which defaults to `.mesh`.
-- Parameter names must be alphanumeric. These names are used as Go template keys.
-- Parameter names must be unique. This ensures that each parameter can be referenced unambiguously.
-- Parameter with the `kuma.io/service` tagKey must be specified even if it is not used in the template. This prevents hostnames from being defined that could span multiple services.
+- {% if_version lte:2.1.x %}[Transparent proxy](/docs/{{ page.version }}/networking/transparent-proxying){% endif_version %}{% if_version gte:2.2.x %}[Transparent proxy](/docs/{{ page.version }}/production/dp-config/transparent-proxying/){% endif_version %}.
+- Either [data plane proxy DNS](/docs/{{ page.version }}/networking/dns), or else the value of `conf.host` must end with the value of `dns_server.domain` (default value `.mesh`).
+- `name` must be alphanumeric. (Used as a go template key).
+- Each value of `name` must be unique.
+- `kuma.io/service` must be specified even if it's unused in the template. (Prevents defining hostnames that spans services).
The default value of `tagKey` is the value of `name`.
@@ -158,8 +127,8 @@ conf:
### One hostname per version
-{% tabs one-hostname-per-version useUrlFragment=false %}
-{% tab one-hostname-per-version Kubernetes %}
+{% tabs one-hostanme-per-version useUrlFragment=false %}
+{% tab one-hostanme-per-version Kubernetes %}
{% raw %}
```yaml
apiVersion: kuma.io/v1alpha1
@@ -182,7 +151,7 @@ spec:
```
{% endraw %}
{% endtab %}
-{% tab one-hostname-per-version Universal %}
+{% tab one-hostanme-per-version Universal %}
{% raw %}
```yaml
type: VirtualOutbound
diff --git a/app/_src/production/cp-deployment/kubernetes.md b/app/_src/production/cp-deployment/kubernetes.md
index 033d1e46d..8a8c00d34 100644
--- a/app/_src/production/cp-deployment/kubernetes.md
+++ b/app/_src/production/cp-deployment/kubernetes.md
@@ -52,7 +52,7 @@ This feature is tracked in [#7541](https://github.com/kumahq/kuma/issues/7541).
## OpenShift
-### Transparent proxy
+## Transparent proxy
Starting from version 4.1 OpenShift uses `nftables` instead of `iptables`.
So using init container for redirecting traffic to the proxy no longer works and you should use the [`kuma-cni`](/docs/{{ page.version }}/production/dp-config/cni/) instead.
@@ -78,24 +78,3 @@ admissionConfig:
```
After updating `master-config.yaml` restart the cluster and install `control-plane`.
-
-## GKE Autopilot
-
-By default, GKE Autopilot forbids the use of the `NET_ADMIN` linux capability. This is required by Kuma to set up the iptables rules in order to intercept inbound and outbound traffic.
-
-It is possible to configure a GKE cluster in autopilot mode so that the `NET_ADMIN` capability is authorized with the following option in your gcloud command: `--workload-policies=allow-net-admin`
-
-Full example:
-```shell
-gcloud beta container \
- --project ${GCP_PROJECT} \
- clusters create-auto ${CLUSTER_NAME} \
- --region ${REGION} \
- --release-channel "regular" \
- --scopes "https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append" \
- --network "projects/${GCP_PROJECT}/global/networks/default" \
- --subnetwork "projects/${GCP_PROJECT}/regions/${REGION}/subnetworks/default" \
- --no-enable-master-authorized-networks \
- --cluster-ipv4-cidr=/20 \
- --workload-policies=allow-net-admin
-```
diff --git a/app/_src/production/cp-deployment/multi-zone.md b/app/_src/production/cp-deployment/multi-zone.md
index 6235dfcb4..3430e50d7 100644
--- a/app/_src/production/cp-deployment/multi-zone.md
+++ b/app/_src/production/cp-deployment/multi-zone.md
@@ -44,6 +44,7 @@ NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP
```
By default, it's exposed on [port 5685]{% if_version lte:2.1.x %}(/docs/{{ page.version }}/networking/networking){% endif_version %}{% if_version gte:2.2.x %}(/docs/{{ page.version }}/production/use-mesh#control-plane-ports){% endif_version %}. In this example the value is `35.226.196.103:5685`. You pass this as the value of `