Home / Kong Operator / Konnect / Konnect CRDs: Cloud Gateways
Edit
Report

Create a Transit Gateway with Kong Operator and AWS

Uses: Kong Operator
Incompatible with
on-prem
Related Documentation
Operator Documentation
Tags
#aws
Related Resources
AWS Transit Gateway peering
Azure peering
Dedicated Cloud Gateways
TL;DR

Create a transit gateway in AWS and create a resources share to share the transit gateway with the AWS account linked to your Konnect account. Then, create a KonnectCloudGatewayTransitGateway and accept the transit gateway attachment in AWS.

Prerequisites

AWS account

This tutorial requires an AWS account with permissions to create transit gateways and resource shares.

AWS CLI

For this tutorial, you need the AWS CLI installed and configured:

  1. Install the AWS CLI.

  2. After installing, configure and authenticate with AWS:

     aws configure

Kong Konnect

If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

  1. The following Konnect items are required to complete this tutorial:
    • Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

  2. Set the personal access token as an environment variable:

    export KONNECT_TOKEN='YOUR KONNECT TOKEN'

Kong Operator running

  1. Add the Kong Helm charts:

    helm repo add kong https://charts.konghq.com
helm repo update

  2. Install Kong Operator using Helm:

    helm upgrade --install kong-operator kong/kong-operator -n kong-system \
  --create-namespace \
  --set image.tag=2.3 \
  --set env.ENABLE_CONTROLLER_KONNECT=true
  kubectl -n kong-system wait --for=condition=Available=true --timeout=300s deployment/kong-operator-kong-operator-controller-manager

If you want cert-manager to issue and rotate the admission and conversion webhook certificates, install cert-manager to your cluster and enable cert-manager integration by passing the following argument while installing, in the next step:

   --set global.webhooks.options.certManager.enabled=true

If you do not enable this, the chart will generate and inject self-signed certificates automatically. We recommend enabling cert-manager to manage the lifecycle of these certificates. Kong Operator needs a certificate authority to sign the certificate for mTLS communication between the control plane and the data plane. This is handled automatically by the Helm chart. If you need to provide a custom CA certificate, refer to the certificateAuthority section in the values.yaml of the Helm chart to learn how to create and reference your own CA certificate.

Create a KonnectAPIAuthConfiguration resource

 
kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -
echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: konnect-api-auth
  namespace: kong
spec:
  type: token
  token: "'$KONNECT_TOKEN'"
  serverURL: us.api.konghq.com
' | kubectl apply -f -

Create a KonnectCloudGatewayNetwork resource

In order to manage Cloud Gateway Networks you need to have a Cloud Gateway Provider Account associated with your Konnect account. Export the ID of your provider account to your environment with the Cloud Gateways API:

export CLOUD_GATEWAY_PROVIDER_ID=$(curl -s -H 'Content-Type: application/json' -H "Authorization: Bearer $KONNECT_TOKEN" -XGET https://global.api.konghq.com/v2/cloud-gateways/provider-accounts | jq -r '.data[0].id')

Create the KonnectCloudGatewayNetwork resource: 

echo '
kind: KonnectCloudGatewayNetwork
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: konnect-network-1
  namespace: kong
spec:
  name: network1
  cloud_gateway_provider_account_id: "'$CLOUD_GATEWAY_PROVIDER_ID'"
  availability_zones:
  - euw1-az1
  - euw1-az2
  - euw1-az3
  cidr_block: 192.168.0.0/16
  region: eu-west-1
  konnect:
    authRef:
      name: konnect-api-auth
' | kubectl apply -f -

It can take some time for the network to finish initializing. Make sure the network is ready before moving on to the next step. You can got to the Konnect Networks page or use the following command to check the network state:

curl -s -H 'Content-Type: application/json' -H "Authorization: Bearer $KONNECT_TOKEN" -XGET https://global.api.konghq.com/v2/cloud-gateways/networks| jq

Create a KonnectGatewayControlPlane resource

Use the following command to create a Control Plane:

echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha2
metadata:
  name: gateway-control-plane
  namespace: kong
spec:
  createControlPlaneRequest:
    name: gateway-control-plane
    cloud_gateway: true
  konnect:
    authRef:
      name: konnect-api-auth
' | kubectl apply -f -

Create a transit gateway in AWS
  1. Use this command to create a transit gateway in AWS and save its output: 
    aws ec2 create-transit-gateway > tgw.json

    Notes:

    • If you have issues creating resources with AWS CLI, try using the env variables instead of the aws configure command for credentials. Make sure to include AWS_REGION or use the --region flag in every command.
    • The same Transit Gateway can be used in multiple networks, but they must be shared by different RAM shares.
  2. Export the transit gateway ID and ARN to your environment: 
    export TRANSIT_GATEWAY_ID=$(jq -r '.TransitGateway.TransitGatewayId' tgw.json)
export TRANSIT_GATEWAY_ARN=$(jq -r '.TransitGateway.TransitGatewayArn' tgw.json)

Create a resource share in AWS

Create a resource share to allow the AWS account associated with your Konnect account to access the AWS Transit Gateway.

  1. Fetch the information about the AWS account associated with your Konnect:

    curl -s -H 'Content-Type: application/json' -H "Authorization: Bearer $KONNECT_TOKEN" -XGET https://global.api.konghq.com/v2/cloud-gateways/provider-accounts | jq

  2. Export the value of the provider_account_id field to your environment:

    export CLOUD_AWS_ACCOUNT_ID=$(curl -s -H 'Content-Type: application/json' -H "Authorization: Bearer $KONNECT_TOKEN" -XGET https://global.api.konghq.com/v2/cloud-gateways/provider-accounts | jq -r '.data[0].provider_account_id')

  3. Use this command to create a resource share and save its output:

    aws ram create-resource-share --name transit-gateway-resource-share --resource-arns $TRANSIT_GATEWAY_ARN --principals $CLOUD_AWS_ACCOUNT_ID > resource-share.json

  4. Export the resource share ARN to your environment:

    export RESOURCE_SHARE_ARN=$(jq -r '.resourceShare.resourceShareArn' resource-share.json)

Create the KonnectCloudGatewayTransitGateway resource

Create your Transit Gateway in Konnect with the KonnectCloudGatewayTransitGateway resource:

echo '
kind: KonnectCloudGatewayTransitGateway
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: konnect-aws-transit-gateway-1
  namespace: kong
spec:
  networkRef:
    type: namespacedRef
    namespacedRef:
      name: konnect-network-1
  type: AWSTransitGateway
  awsTransitGateway:
    name: aws-transit-gateway-1
    cidr_blocks:
    - 10.10.0.0/24
    attachment_config:
      transit_gateway_id: "'$TRANSIT_GATEWAY_ID'"
      ram_share_arn: "'$RESOURCE_SHARE_ARN'"
' | kubectl apply -f -

Accept the transit gateway attachment in AWS

  1. Fetch the list of transit gateway VPC attachments:

    aws ec2 describe-transit-gateway-vpc-attachments

  2. Accept the transit gateway attachment. The command finds the attachment for the transit gateway you created and accepts it:

    aws ec2 accept-transit-gateway-vpc-attachment --transit-gateway-attachment-id $(aws ec2 describe-transit-gateway-vpc-attachments | jq -r --arg tgw "$TRANSIT_GATEWAY_ID" '.TransitGatewayVpcAttachments[] | select(.TransitGatewayId==$tgw) | .TransitGatewayAttachmentId')

Validation

You can verify the KonnectCloudGatewayTransitGateway was reconciled successfully by checking its Programmed condition.

kubectl get -n kong konnectcloudgatewaytransitgateway konnect-aws-transit-gateway-1 \
  -o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jq

The output should look similar to this:

{
  "observedGeneration": 1,
  "reason": "Programmed",
  "status": "True",
  "type": "Programmed"
}

Cleanup

Clean up AWS resources

Delete the KonnectCloudGatewayTransitGateway, the resource share, and the transit gateway you created:

kubectl delete -n kong konnectcloudgatewaytransitgateway konnect-aws-transit-gateway-1 --ignore-not-found
aws ram delete-resource-share --resource-share-arn $RESOURCE_SHARE_ARN
aws ec2 wait transit-gateway-available --transit-gateway-ids $TRANSIT_GATEWAY_ID
aws ec2 delete-transit-gateway --transit-gateway-id $TRANSIT_GATEWAY_ID

FAQs

Can I create a Konnect Transit Gateway linked to an Azure virtual network?

Yes, refer to Azure peering to learn how to configure your VNET Peering App on Azure, then configure the KonnectCloudGatewayTransitGateway resource with the azureTransitGateway field.

I’m getting a unable to create transit gateway with cidr block 10.10.0.0/24 because it overlaps with cidr blocks from an existing attachment error when I try to validate my transit gateway resource, how do I fix it?

This is caused by a CIDR block overlap. To resolve this, contact Kong Support by navigating to the ? icon on the top right menu and clicking Create support case or from the Kong Support portal.

Something wrong?
Report an Issue | Edit this Page
View all Kong documentation

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!
Contribute

Still need help?

Ask in our Slack Community
Contact Support