Gateway Discovery

Gateway Discovery is a deployment topology in which Kong Ingress Controller and Kong Gateway are separate deployments in the Kubernetes cluster. Kong Ingress Controller uses Kubernetes service discovery to discover the Kong Gateway Pods.

It allows you to manage many Kong Gateway instances with one Kong Ingress Controller, providing lower resource usage compared to Sidecar deployments.

You don’t need to configure this manually due to the default value of gatewayDiscovery.generateAdminApiService=true in the Helm chart. The following information is for educational purposes only.

When Kong Ingress Controller starts running it looks for services that match the name in the --kong-admin-svc flag. This value is controlled by the gatewayDiscovery.adminApiService.namespace and gatewayDiscovery.adminApiService.name values in the Helm chart. Once the service is found, Kong Ingress Controller fetches a list of EndpointSlices containing all Kong Gateway instances.

Kong Ingress Controller proceeds to send configuration to all detected Kong Gateway instances using the POST /config endpoint on each running Data Plane. Once the Data Plane has loaded configuration, it is marked as ready and can start proxying traffic.

Starting from version 3.0.3, the Kong Ingress Controller has deprecated plain HTTP connections to the Admin API service. This change affects deployments that communicate with Kong’s Admin API without TLS encryption (GitHub Pull Request: https://github.com/Kong/kubernetes-ingress-controller/pull/5043/).

flowchart LR

A[fa:fa-kubernetes API Server]
KIC1[fa:fa-gateway KIC 
(Active)]
KIC2[fa:fa-gateway KIC
(Standby)]
KIC3[fa:fa-gateway KIC
(Standby)]
DP1[fa:fa-gateway Data Plane]
DP2[fa:fa-gateway Data Plane]
DP3[fa:fa-gateway Data Plane]
DP4[fa:fa-gateway Data Plane]

A-.KIC watches 
API server.- KIC1

subgraph B["Deployment with
leader election"]
subgraph C[" "]
  KIC1
end
  KIC2
  KIC3
end

KIC1 ----> DP1 & DP2 & DP3 & DP4

style B stroke-dasharray: 5 5
style C stroke:none,fill:none

Figure 1: In a Gateway discovery deployment, one active Kong Ingress Controller instance sends configuration to many Kong Gateways, which are scaled independently. Multiple KIC instances can be run for high availability requirements.