Merge remote-tracking branch 'upstream/master' into feat/ignored-list…

…eners

Signed-off-by: Jakub Dyszkiewicz <[email protected]>

.github/commitlint.config.js

@@ -9,7 +9,7 @@ module.exports = {
     "header-max-length": [0],
     // Disable some common mistyped scopes and some that should be used
     "scope-enum": [2, "never", [
-      "kumacp", "kumadp", "kumacni", "kumainit", "*", "madr", "test", "ci", "perf", "policies"
+      "kumacp", "kumadp", "kumacni", "kumainit", "*", "madr", "test", "ci", "perf", "policies", "tests"
     ]],
     "scope-empty": [2, "never"]
   },

UPGRADE.md

@@ -6,6 +6,18 @@ with `x.y.z` being the version you are planning to upgrade to.
 If such a section does not exist, the upgrade you want to perform
 does not have any particular instructions.
 
+## Upgrade to `2.6.x`
+
+### Unifying Default Connection Timeout Values
+
+To simplify configuration and provide a more consistent user experience, we've unified the default connection timeout values. When no `MeshTimeout` or `Timeout` policy is specified, the connection timeout will now be the same as the default `connectTimeout` values for `MeshTimeout` and `Timeout` policies. This value is now `5s`, which is a decrease from the previous default of `10s`.
+
+The connection timeout specifies the amount of time Envoy will wait for an upstream TCP connection to be established.
+
+The only users who need to take action are those who are explicitly relying on the previous default connection timeout value of `10s`. These users will need to create a new `MeshTimeout` policy with the appropriate `connectTimeout` value to maintain their desired behavior.
+
+We encourage all users to review their configuration, but we do not anticipate that this change will require any action for most users.
+
 ## Upgrade to `2.5.x`
 
 ### Transparent-proxy and CNI v1 removal

app/kuma-cp/cmd/run.go

@@ -11,6 +11,7 @@ import (
 	kuma_cmd "github.com/kumahq/kuma/pkg/cmd"
 	"github.com/kumahq/kuma/pkg/config"
 	kuma_cp "github.com/kumahq/kuma/pkg/config/app/kuma-cp"
+	config_core "github.com/kumahq/kuma/pkg/config/core"
 	"github.com/kumahq/kuma/pkg/core/bootstrap"
 	"github.com/kumahq/kuma/pkg/defaults"
 	"github.com/kumahq/kuma/pkg/diagnostics"
@@ -52,6 +53,12 @@ func newRunCmdWithOpts(opts kuma_cmd.RunCmdOpts) *cobra.Command {
 				return err
 			}
 
+			// nolint:staticcheck
+			if cfg.Mode == config_core.Standalone {
+				runLog.Info(`[WARNING] "standalone" mode is deprecated. Changing it to "zone". Set KUMA_MODE to "zone" as "standalone" will be removed in the future.`)
+				cfg.Mode = config_core.Zone
+			}
+
 			kuma_cp.PrintDeprecations(&cfg, cmd.OutOrStdout())
 
 			gracefulCtx, ctx := opts.SetupSignalHandler()

app/kuma-dp/cmd/run.go

@@ -301,6 +301,7 @@ func newRunCmd(opts kuma_cmd.RunCmdOpts, rootCtx *RootContext) *cobra.Command {
 	cmd.PersistentFlags().StringVar(&cfg.DNS.CoreDNSConfigTemplatePath, "dns-coredns-config-template-path", cfg.DNS.CoreDNSConfigTemplatePath, "A path to a CoreDNS config template.")
 	cmd.PersistentFlags().StringVar(&cfg.DNS.ConfigDir, "dns-server-config-dir", cfg.DNS.ConfigDir, "Directory in which DNS Server config will be generated")
 	cmd.PersistentFlags().Uint32Var(&cfg.DNS.PrometheusPort, "dns-prometheus-port", cfg.DNS.PrometheusPort, "A port for exposing Prometheus stats")
+	cmd.PersistentFlags().BoolVar(&cfg.DNS.CoreDNSLogging, "dns-enable-logging", cfg.DNS.CoreDNSLogging, "If true then CoreDNS logging is enabled")
 	return cmd
 }
 

app/kuma-dp/pkg/dataplane/dnsserver/Corefile

@@ -5,11 +5,13 @@
     # Codes from: https://github.com/miekg/dns/blob/master/msg.go#L138
     alternate NOTIMP,FORMERR,NXDOMAIN,SERVFAIL,REFUSED . /etc/resolv.conf
     prometheus localhost:{{ .PrometheusPort }}
-    errors
+    errors{{ if .CoreDNSLogging}}
+    log{{end}}
 }
 
 .:{{ .CoreDNSEmptyPort }} {
     template ANY ANY . {
       rcode NXDOMAIN
-    }
+    }{{ if .CoreDNSLogging}}
+    log{{end}}
 }

app/kuma-dp/pkg/dataplane/dnsserver/dnsserver_test.go

@@ -187,5 +187,88 @@ var _ = Describe("DNS Server", func() {
 			})
 			Expect(err).To(HaveOccurred())
 		}))
+
+		It("should enable logging if requested", test.Within(10*time.Second, func() {
+			// given
+			cfg := kuma_dp.Config{
+				DNS: kuma_dp.DNS{
+					Enabled:           true,
+					CoreDNSPort:       16001,
+					CoreDNSEmptyPort:  16002,
+					EnvoyDNSPort:      16002,
+					PrometheusPort:    16003,
+					CoreDNSBinaryPath: filepath.Join("testdata", "binary-mock.exit-0.sh"),
+					ConfigDir:         configDir,
+					CoreDNSLogging:    true,
+				},
+			}
+
+			By("starting a mock DNS Server")
+			// when
+			dnsServer, err := New(&Opts{
+				Config: cfg,
+				Stdout: outWriter,
+				Stderr: errWriter,
+			})
+			Expect(err).ToNot(HaveOccurred())
+			// and
+			go func() {
+				errCh <- dnsServer.Start(stopCh)
+			}()
+
+			expectedConfigFile := filepath.Join(configDir, "Corefile")
+
+			By("waiting for mock DNS Server to complete")
+			// then
+			Eventually(func() bool {
+				select {
+				case err := <-errCh:
+					Expect(err).ToNot(HaveOccurred())
+					return true
+				default:
+					return false
+				}
+			}, "5s", "10ms").Should(BeTrue())
+
+			By("closing the write side of the pipe")
+			// when
+			err = outWriter.Close()
+			// then
+			Expect(err).ToNot(HaveOccurred())
+
+			By("verifying the output of mock DNS Server")
+			// when
+			var buf bytes.Buffer
+			_, err = buf.ReadFrom(outReader)
+			// then
+			Expect(err).ToNot(HaveOccurred())
+			// and
+			Expect(strings.TrimSpace(buf.String())).To(Equal(fmt.Sprintf("-conf %s -quiet", expectedConfigFile)))
+
+			By("verifying the contents DNS Server config file")
+			// when
+			actual, err := os.ReadFile(expectedConfigFile)
+			// then
+			Expect(err).ToNot(HaveOccurred())
+			// and
+			Expect(string(actual)).To(Equal(`.:16001 {
+    forward . 127.0.0.1:16002
+    # We want all requests to be sent to the Envoy DNS Filter, unsuccessful responses should be forwarded to the original DNS server.
+    # For example: requests other than A, AAAA and SRV will return NOTIMP when hitting the envoy filter and should be sent to the original DNS server.
+    # Codes from: https://github.com/miekg/dns/blob/master/msg.go#L138
+    alternate NOTIMP,FORMERR,NXDOMAIN,SERVFAIL,REFUSED . /etc/resolv.conf
+    prometheus localhost:16003
+    errors
+    log
+}
+
+.:16002 {
+    template ANY ANY . {
+      rcode NXDOMAIN
+    }
+    log
+}
+`))
+		}))
 	})
 })

app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap.go

@@ -93,7 +93,7 @@ func (b *remoteBootstrap) Generate(ctx context.Context, url string, cfg kuma_dp.
 		case DpNotFoundErr:
 			log.Info("Dataplane entity is not yet found in the Control Plane. If you are running on Kubernetes, the control plane is most likely still in the process of converting Pod to Dataplane. If it takes too long, check pod events and control plane logs to see possible cause. Retrying.", "backoff", cfg.ControlPlane.Retry.Backoff)
 		default:
-			log.Info("could not fetch bootstrap configuration, make sure you are not trying to connect to global-cp. retrying (this could help only if you're connecting to zone-cp or standalone).", "backoff", cfg.ControlPlane.Retry.Backoff, "err", err.Error())
+			log.Info("could not fetch bootstrap configuration, make sure you are not trying to connect to global-cp. retrying (this could help only if you're connecting to zone-cp).", "backoff", cfg.ControlPlane.Retry.Backoff, "err", err.Error())
 		}
 		return retry.RetryableError(err)
 	})

app/kumactl/cmd/install/context/install_control_plane_context.go

@@ -106,7 +106,7 @@ func DefaultInstallCpContext() InstallCpContext {
 			Cni_image_registry:                      "",
 			Cni_image_repository:                    "kuma-cni",
 			Cni_image_tag:                           kuma_version.Build.Version,
-			ControlPlane_mode:                       core.Standalone,
+			ControlPlane_mode:                       core.Zone,
 			ControlPlane_zone:                       "",
 			ControlPlane_globalZoneSyncService_type: "LoadBalancer",
 			Image_registry:                          "docker.io/kumahq",

app/kumactl/cmd/install/install_control_plane_test.go

@@ -353,14 +353,6 @@ controlPlane:
 			extraArgs: []string{"--kds-global-address", "grpcs://192.168.0.1:5685", "--mode", "zone", "--zone", "zone-1", "--set", "controlPlane.environment=universal", "--set", "egress.enabled=true"},
 			errorMsg:  "Can't have egress.enabled when running controlPlane.mode=='universal'",
 		}),
-		Entry("--kds-global-address is missing when installing zone", errTestCase{
-			extraArgs: []string{"--mode", "zone", "--zone", "zone-1"},
-			errorMsg:  "controlPlane.kdsGlobalAddress can't be empty when controlPlane.mode=='zone'",
-		}),
-		Entry("--zone is missing when installing zone", errTestCase{
-			extraArgs: []string{"--kds-global-address", "grpcs://192.168.0.1:5685", "--mode", "zone"},
-			errorMsg:  "Can't have controlPlane.zone to be empty when controlPlane.mode=='zone'",
-		}),
 		Entry("--zone is more than 253 characters", errTestCase{
 			extraArgs: []string{"--kds-global-address", "grpcs://192.168.0.1:5685", "--mode", "zone", "--zone", "takryywlpeftgnlwuwmwwfwohwzqxqlofjfsuuldtatoxlmnniytycvdnduwplvgnpnjwvzmbkqrvgnlovpynrtuyhhrqibdzwbfjrmhvwkkryzfnudghaxmegfvacjlytuyeikuawquolrykwwldjiynaxrpqgxmvwashrkigadzhxdeihcbjurhpmdrnulajpaspqcgzqxsnjrdenhruaawooojpyoprgnnoqiqdhncuztbgfsvhparjlippv"},
 			errorMsg:  "controlPlane.zone must be no more than 253 characters",

app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml

@@ -624,7 +624,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml

@@ -6562,7 +6562,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml

@@ -36,8 +36,8 @@ controlPlane:
   # -- Kuma CP log output path: Defaults to /dev/stdout
   logOutputPath: ""
 
-  # -- Kuma CP modes: one of standalone,zone,global
-  mode: "standalone"
+  # -- Kuma CP modes: one of zone,global
+  mode: "zone"
 
   # -- (string) Kuma CP zone, if running multizone
   zone:
@@ -383,6 +383,8 @@ cni:
     runAsGroup: 0
 
 dataPlane:
+  # -- If true, then turn on CoreDNS query logging
+  dnsLogging: false
   image:
     # -- The Kuma DP image repository
     repository: "kuma-dp"

app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present-not-enabled.yaml

@@ -6562,7 +6562,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml

@@ -6770,7 +6770,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml

@@ -410,7 +410,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-control-plane.registry.golden.yaml

@@ -410,7 +410,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "gcr.io/octo/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml

@@ -410,7 +410,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-control-plane.with-egress.golden.yaml

@@ -441,7 +441,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-control-plane.with-helm-values.yaml

@@ -410,7 +410,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-cp-helm/doNotChangeTlsChecksum.golden.yaml

@@ -409,7 +409,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-cp-helm/empty.golden.yaml

@@ -410,7 +410,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-cp-helm/fix4485.golden.yaml

@@ -433,7 +433,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-cp-helm/fix7724.golden.yaml

@@ -413,7 +413,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-cp-helm/minReadySeconds.golden.yaml

@@ -410,7 +410,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

app/kumactl/cmd/install/testdata/install-cp-helm/securityContext.golden.yaml

@@ -411,7 +411,7 @@ spec:
             - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
               value: "docker.io/kumahq/kuma-init:0.0.1"
             - name: KUMA_MODE
-              value: "standalone"
+              value: "zone"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_CERT_DIR
               value: "/var/run/secrets/kuma.io/tls-cert"
             - name: KUMA_RUNTIME_KUBERNETES_ADMISSION_SERVER_PORT

deployments/charts/kuma/README.md

@@ -22,7 +22,7 @@ A Helm chart for the Kuma Control Plane
 | controlPlane.extraLabels | object | `{}` | Labels to add to resources in addition to default labels |
 | controlPlane.logLevel | string | `"info"` | Kuma CP log level: one of off,info,debug |
 | controlPlane.logOutputPath | string | `""` | Kuma CP log output path: Defaults to /dev/stdout |
-| controlPlane.mode | string | `"standalone"` | Kuma CP modes: one of standalone,zone,global |
+| controlPlane.mode | string | `"zone"` | Kuma CP modes: one of zone,global |
 | controlPlane.zone | string | `nil` | Kuma CP zone, if running multizone |
 | controlPlane.kdsGlobalAddress | string | `""` | Only used in `zone` mode |
 | controlPlane.replicas | int | `1` | Number of replicas of the Kuma CP. Ignored when autoscaling is enabled |
@@ -117,6 +117,7 @@ A Helm chart for the Kuma Control Plane
 | cni.resources.limits.memory | string | `"100Mi"` |  |
 | cni.podSecurityContext | object | `{}` | Security context at the pod level for cni |
 | cni.containerSecurityContext | object | `{"readOnlyRootFilesystem":true,"runAsGroup":0,"runAsNonRoot":false,"runAsUser":0}` | Security context at the container level for cni |
+| dataPlane.dnsLogging | bool | `false` | If true, then turn on CoreDNS query logging |
 | dataPlane.image.repository | string | `"kuma-dp"` | The Kuma DP image repository |
 | dataPlane.image.pullPolicy | string | `"IfNotPresent"` | Kuma DP ImagePullPolicy |
 | dataPlane.image.tag | string | `nil` | Kuma DP Image Tag. When not specified, the value is copied from global.tag |

deployments/charts/kuma/templates/_helpers.tpl

@@ -217,6 +217,10 @@ env:
   value: {{ include "kuma.formatImage" (dict "image" .Values.dataPlane.image "root" $) | quote }}
 - name: KUMA_INJECTOR_INIT_CONTAINER_IMAGE
   value: {{ include "kuma.formatImage" (dict "image" .Values.dataPlane.initImage "root" $) | quote }}
+{{- if .Values.dataPlane.dnsLogging }}
+- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_BUILTIN_DNS_LOGGING
+  value: "true"
+{{- end }}
 - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CA_CERT_FILE
   value: /var/run/secrets/kuma.io/tls-cert/ca.crt
 - name: KUMA_DEFAULTS_SKIP_MESH_CREATION

deployments/charts/kuma/templates/cp-deployment.yaml

@@ -19,9 +19,7 @@
   {{ fail $msg }}
 {{ end }}
 {{ if eq .Values.controlPlane.mode "zone" }}
-  {{ if empty .Values.controlPlane.zone }}
-    {{ fail "Can't have controlPlane.zone to be empty when controlPlane.mode=='zone'" }}
-  {{ else }}
+  {{ if not (empty .Values.controlPlane.zone) }}
     {{ if gt (len .Values.controlPlane.zone) 253 }}
       {{ fail "controlPlane.zone must be no more than 253 characters" }}
     {{ else }}
@@ -30,9 +28,7 @@
       {{ end }}
     {{ end }}
   {{ end }}
-  {{ if empty .Values.controlPlane.kdsGlobalAddress }}
-    {{ fail "controlPlane.kdsGlobalAddress can't be empty when controlPlane.mode=='zone', needs to be the global control-plane address" }}
-  {{ else }}
+  {{ if not (empty .Values.controlPlane.kdsGlobalAddress) }}
     {{ $url := urlParse .Values.controlPlane.kdsGlobalAddress }}
     {{ if not (or (eq $url.scheme "grpcs") (eq $url.scheme "grpc")) }}
       {{ $msg := printf "controlPlane.kdsGlobalAddress must be a url with scheme grpcs:// or grpc:// got:'%s'" .Values.controlPlane.kdsGlobalAddress }}