Kuma
Kuma is a free, open-source control plane for managing service meshes and microservices.
What Kuma is
Kuma is a free, open-source control plane for managing service meshes and microservices. It supports Kubernetes, virtual machines, and bare-metal environments, with single-zone or multi-zone deployments spanning clouds, regions, and Kubernetes clusters. One control plane can serve multiple individual meshes. Traffic policies cover HTTP and TCP routing, health checks, circuit breaking, retries, timeouts, fault injection, and rate limiting. Security features include mutual TLS and mesh traffic permissions. For observability, Kuma provides service maps, traces, access logs, metrics, and OpenTelemetry, with integrations described for Prometheus, Grafana, Jaeger, and Datadog. Its interfaces include Kubernetes CRDs, a GUI, REST API, and CLI; Envoy is bundled as the data-plane proxy. Kuma is self-hosted. The Kubernetes quickstart describes its GUI as read-only, while production guidance addresses secrets, API controls and authentication, certificates, proxy membership, and Kubernetes RBAC.
Good
- Free open-source control plane.
- Supports Kubernetes, VMs, and bare metal.
- Single or multi-zone deployment options.
- Includes mutual TLS and mesh permissions.
- Offers CRDs, GUI, REST API, and CLI.
Watch out
- Self-hosted deployment model.
- Quickstart GUI is read-only.
- Production use involves security configuration.
Who it suits
Kuma suits teams managing service meshes across Kubernetes, VMs, or bare metal, including multi-zone or multi-mesh setups. It is aimed at teams comfortable with self-hosted software and its production security considerations.
Verdict
Kuma brings traffic management, security, and observability features into a control plane for varied infrastructure. Its self-hosted model and read-only GUI in the Kubernetes quickstart are important to weigh.
Plans and prices
From Kuma's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Kuma open-source | Free | self-hosted control plane · Kubernetes, VMs and bare metal · Envoy data plane |
| Open source | Free | Open-source control plane; supports Kubernetes, VMs, and bare metal |
The facts
Each one read from Kuma's own pages, with the date it was checked.
What it does
- API
- Kuma exposes a RESTful HTTP API for reading configuration and policies, and Universal mode also permits changes through that API.checked 15 Oct 2026
- API specification
- The project publishes a complete OpenAPI specification in its GitHub repository.checked 15 Oct 2026
- CLI
- The kumactl command-line interface manages Kuma and is included in production deployment guidance.checked 15 Oct 2026
- CNCF health
- The CNCF project page reports a health score of 76 and 334 contributors for Kuma.checked 15 Oct 2026
- CNCF status
- CNCF accepted Kuma as a Sandbox project on June 25, 2020.checked 15 Oct 2026
- Default exposure limitation
- The API server defaults to plain HTTP on 0.0.0.0:5681 without authentication, requiring operators to restrict network access themselves.checked 15 Oct 2026
- Deployment
- Kuma supports single-zone and multi-zone deployments across clouds, regions, and Kubernetes clusters.checked 2 Oct 2026
- Deployment security
- Production guidance covers secrets management, API access control, API server and proxy authentication, proxy membership, certificates, and Kubernetes RBAC.checked 2 Oct 2026
- External services
- The ExternalService resource applies Kuma observability, security and traffic policies to services outside the mesh.checked 15 Oct 2026
- Funding news
- Kong announced a $175 million Series E financing at a $2 billion valuation on November 19, 2024, bringing reported total capital raised to $345 million.checked 15 Oct 2026
- GitHub project description
- The public repository describes Kuma as a multi-zone service mesh for containers, Kubernetes and VMs built with Envoy and identifies it as a CNCF Sandbox project.checked 15 Oct 2026
- GUI limitation
- The Kubernetes quickstart describes Kuma's GUI as read-only.checked 2 Oct 2026
- Independent pricing comparison
- The buyer guide classifies Kuma as free open source and Kong Mesh as a moderate-to-premium enterprise subscription.checked 15 Oct 2026
- Ingress feature
- Ingress options include delegated gateway, built-in gateway and Kubernetes Gateway API support.checked 15 Oct 2026
- Install
- The installation guide provides Linux and macOS downloads and documents installing the CLI on macOS with Homebrew.checked 2 Oct 2026
- Installation
- Universal installation can download versioned archives with an installer script, while macOS users can install kumactl through Homebrew.checked 15 Oct 2026
- Integrations
- Kuma's observability documentation describes integrations with Prometheus, Grafana, Jaeger, and Datadog.checked 2 Oct 2026
- Interface
- Kuma provides native Kubernetes CRDs, a GUI, a REST API, and a CLI.checked 2 Oct 2026
- Kubernetes installation
- Kuma provides Helm charts through the kumahq.github.io/charts repository and documents Helm and Argo CD deployment.checked 15 Oct 2026
- Licence
- The main Kuma repository and Helm charts are distributed under the Apache-2.0 licence.checked 15 Oct 2026
- Limit: latency
- The same comparative study found Kuma nearly doubled latency in its tested scenario and performed worse than Linkerd and Traefik Mesh at the tested limits.checked 15 Oct 2026
- Maintainer
- The documentation identifies Kong as Kuma's core maintainer.checked 2 Oct 2026
Money
- Limit: operating cost
- An independent service-mesh buyer guide says free Kuma still carries operational costs for platform staff, control plane, data plane and certificate authority.checked 15 Oct 2026
The company
- Maker headquarters
- Kong's LinkedIn company page lists San Francisco, California as headquarters and 1,001–5,000 employees.checked 15 Oct 2026
The full review of Kuma
Kuma is an open-source service-mesh control plane for teams managing microservices across Kubernetes, virtual machines, or bare metal. It is a strong fit for operators who need multiple meshes and varied deployment environments under one control plane. Its breadth comes with a self-hosted operating burden, and the Kubernetes quickstart’s GUI is read-only.
Overview
Kuma combines mesh management with traffic policy, security, and observability capabilities. A single control plane can support multiple individual meshes and run in single-zone or multi-zone deployments across clouds, regions, and Kubernetes clusters. That flexibility suits infrastructure spread across environments, while self-hosting means teams must own production operations and security configuration.
Kuma uses Envoy as its data-plane proxy and a sidecar architecture. Kong is identified as its core maintainer.
Key features
Traffic and security controls
HTTP and TCP routing, health checks, circuit breaking, retries, timeouts, fault injection, and rate limiting cover a wide range of service-traffic needs. Mutual TLS and mesh traffic permissions add service-to-service security controls. This is useful for teams that want policy and security features within the mesh control plane, but production guidance also puts responsibility on operators to address secrets, API access, authentication, proxy membership, certificates, and Kubernetes RBAC.
Observability and interfaces
Service maps, traces, access logs, metrics, and OpenTelemetry provide several ways to inspect mesh behavior. Documented integrations with Prometheus, Grafana, Jaeger, and Datadog let teams connect telemetry to those tools. Kuma also offers Kubernetes CRDs, a REST API, a CLI, and a GUI, so operators have multiple interaction paths; the GUI is read-only in the Kubernetes quickstart, making it a poor fit for teams expecting to manage changes entirely through a visual interface.
Pricing
Kuma is open source and free. Its Open source plan costs nothing and supports Kubernetes, VMs, and bare metal. There are no paid tiers or plan-based caps stated for this plan; the tradeoff is that the control plane is self-hosted, so teams take on deployment, maintenance, and production security responsibilities themselves.
Platforms
Kuma supports Kubernetes, OpenShift, VMs through its Universal option, and bare metal. Linux and macOS downloads are provided, and the CLI can be installed on macOS with Homebrew. The listed platforms also include API, Linux, macOS, self-hosted, and web, making Kuma relevant to teams operating across those environments rather than seeking a managed service.
Who it's for
Kuma is best for infrastructure and platform teams that need to govern multiple service meshes across Kubernetes clusters, clouds, regions, and non-Kubernetes workloads. Its policy range and telemetry options will matter most to teams with established operational practices and a need for control through CRDs, APIs, or CLI. It is less suitable for teams that want a hosted control plane or depend on a writable GUI for routine Kubernetes management.
Pros and cons
- Pro: Supports Kubernetes, VMs, and bare metal, with single-zone and multi-zone deployment options for varied infrastructure.
- Pro: One control plane can manage multiple meshes, alongside traffic policies, mutual TLS, and mesh permissions.
- Pro: Service maps, traces, logs, metrics, OpenTelemetry, and documented integrations support different observability setups.
- Con: Self-hosting leaves deployment and production security controls to the operating team.
- Con: The GUI is read-only in the Kubernetes quickstart, limiting its usefulness for teams that want to make changes through the interface.
Alternatives
Service Mesh Platforms is the broader category directory for comparing options.
- AWS App Mesh is another free option; its proxy consumes AWS resources that incur separate costs.
- Buoyant Enterprise for Linkerd is worth considering for a freemium option with a free trial and an always-free open-source offering for production use at companies with fewer than 50 employees.
- Kong Gateway is a separate option for readers considering a gateway product with a 30-day free trial.
- VMware Workstation Pro is a free alternative for running virtual machines on Windows or Linux hosts, rather than a direct service-mesh substitute.
- Flomesh Service Mesh is another free, open-source service-mesh option for Kubernetes.
- Istio is another free, open-source service mesh.
- Traefik Mesh is a free open-source option with requirements including Kubernetes 1.11 or later, CoreDNS or KubeDNS, and Helm v3.
- Linkerd is a free, Apache 2.0-licensed open-source option that requires Kubernetes.
Verdict
Choose Kuma if your team needs a free, self-hosted control plane for multiple meshes across Kubernetes and non-Kubernetes infrastructure, with substantial traffic controls and observability options. Look elsewhere if you need a managed service or a writable GUI for Kubernetes operations.
Alternatives to Kuma
- 1
AWS App Mesh
Free planWebAPILinuxmacOS7.1Free plan - 2
Network Service Mesh
Free planOpen sourceAPILinuxSelf-hosted7.0Free plan - 3
Oracle Cloud Infrastructure Container Registry
Free planWebAPILinux7.0Free plan - 4
Traefik Mesh
Free planAPILinuxSelf-hosted6.5Free plan - 5
Buoyant Enterprise for Linkerd
Free planWebLinuxSelf-hostedWindows6.3Free plan - 6
Istio
Free planLinuxmacOSSelf-hosted6.2Free plan