Home / Kong Ingress Controller / Routing
Edit
Report

Configure Gateway API resources across namespaces

Uses: Kong Ingress Controller
Deployment Platform
Related Documentation
All KIC Documentation
TL;DR

Set allowedRoutes: All on your Gateway resource and create a ReferenceGrant that allows HTTPRoute instances from a specific namespace to access Services in the current namespace.

Prerequisites

Kong Konnect

If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

  1. The following Konnect items are required to complete this tutorial:
    • Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

  2. Set the personal access token as an environment variable:

    export KONNECT_TOKEN='YOUR KONNECT TOKEN'

Enable the Gateway API

  1. Install the Gateway API CRDs before installing Kong Ingress Controller.

    kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml

  2. Create a Gateway and GatewayClass instance to use.

echo "
apiVersion: v1
kind: Namespace
metadata:
  name: kong
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: kong
  annotations:
    konghq.com/gatewayclass-unmanaged: 'true'
spec:
  controllerName: konghq.com/kic-gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: kong
spec:
  gatewayClassName: kong
  listeners:
  - name: proxy
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
         from: Same
" | kubectl apply -n kong -f -

Create a KIC Control Plane

Use the Konnect API to create a new CLUSTER_TYPE_K8S_INGRESS_CONTROLLER Control Plane:

CONTROL_PLANE_DETAILS=$( curl  -X POST "https://us.api.konghq.com/v2/control-planes" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "name": "My KIC CP",
       "cluster_type": "CLUSTER_TYPE_K8S_INGRESS_CONTROLLER"
     }')

We’ll need the id and telemetry_endpoint for the values.yaml file later. Save them as environment variables:

CONTROL_PLANE_ID=$(echo $CONTROL_PLANE_DETAILS | jq -r .id)
CONTROL_PLANE_TELEMETRY=$(echo $CONTROL_PLANE_DETAILS | jq -r '.config.telemetry_endpoint | sub("https://";"")')

Create mTLS certificates

Kong Ingress Controller talks to Konnect over a connected secured with TLS certificates.

Generate a new certificate using openssl:

openssl req -new -x509 -nodes -newkey rsa:2048 -subj "/CN=kongdp/C=US" -keyout ./tls.key -out ./tls.crt

The certificate needs to be a single line string to send it to the Konnect API with curl. Use awk to format the certificate:

export CERT=$(awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' tls.crt);

Next, upload the certificate to Konnect:

 curl  -X POST "https://us.api.konghq.com/v2/control-planes/$CONTROL_PLANE_ID/dp-client-certificates" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "cert": "'$CERT'"
     }'

Finally, store the certificate in a Kubernetes secret so that Kong Ingress Controller can read it:

kubectl create namespace kong -o yaml --dry-run=client | kubectl apply -f -
kubectl create secret tls konnect-client-tls -n kong --cert=./tls.crt --key=./tls.key

Kong Ingress Controller running (attached to Konnect)

  1. Add the Kong Helm charts:

    helm repo add kong https://charts.konghq.com
helm repo update

  2. Create a values.yaml file:

    cat <<EOF > values.yaml
controller:
  ingressController:
    image:
      tag: "3.5"
    env:
      feature_gates: "FillIDs=true"
    konnect:
      license:
        enabled: true
      enabled: true
      controlPlaneID: "$CONTROL_PLANE_ID"
      tlsClientCertSecretName: konnect-client-tls
      apiHostname: "us.kic.api.konghq.com"
gateway:
  image:
    repository: kong
    tag: "3.9.1"
  env:
    konnect_mode: 'on'
    vitals: "off"
    cluster_mtls: pki
    cluster_telemetry_endpoint: "$CONTROL_PLANE_TELEMETRY:443"
    cluster_telemetry_server_name: "$CONTROL_PLANE_TELEMETRY"
    cluster_cert: /etc/secrets/konnect-client-tls/tls.crt
    cluster_cert_key: /etc/secrets/konnect-client-tls/tls.key
    lua_ssl_trusted_certificate: system
    proxy_access_log: "off"
    dns_stale_ttl: "3600"
  secretVolumes:
     - konnect-client-tls
EOF

  3. Install Kong Ingress Controller using Helm:

    helm install kong kong/ingress -n kong --create-namespace --values ./values.yaml

  4. Set $PROXY_IP as an environment variable for future commands:

    export PROXY_IP=$(kubectl get svc --namespace kong kong-gateway-proxy -o jsonpath='{range .status.loadBalancer.ingress[0]}{@.ip}{@.hostname}{end}')
echo $PROXY_IP

Kong Ingress Controller running

  1. Add the Kong Helm charts:

    helm repo add kong https://charts.konghq.com
helm repo update

  2. Install Kong Ingress Controller using Helm:

    helm install kong kong/ingress -n kong --create-namespace

  3. Set $PROXY_IP as an environment variable for future commands:

    export PROXY_IP=$(kubectl get svc --namespace kong kong-gateway-proxy -o jsonpath='{range .status.loadBalancer.ingress[0]}{@.ip}{@.hostname}{end}')
echo $PROXY_IP

Create namespaces and allow references

  1. Create separate namespaces to hold the HTTPRoute and target Service:

    kubectl create namespace test-source
kubectl create namespace test-destination

  2. Create a ReferenceGrant resource in the destination namespace:

    echo 'kind: ReferenceGrant
apiVersion: gateway.networking.k8s.io/v1beta1    
metadata:                                    
  name: test-grant
  namespace: test-destination
spec:                        
  from:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute                 
    namespace: test-source
  to:                     
  - group: ""
    kind: Service
' | kubectl apply -f -

ReferenceGrants allow namespaces to opt in to references from other resources. They reside in the namespace of the target resource and list resources and namespaces that can talk to specific resources in the ReferenceGrant’s namespace.

In this case, the example configuration allows HTTPRoutes in the test-source namespace to reference Services in the test-destination namespace.

Using a Gateway resource in a different namespace

Gateway resources may also allow references from resources (HTTPRoute, TCPRoute, etc.) in other namespaces. However, these references do not use ReferenceGrants, as they are defined per listener in the Gateway resource, not for the entire Gateway. A listener’s allowedRoutes field lets you define which routing resources can bind to that listener.

The default Gateway in this guide only allows Routes from its same namespace (kong). You’ll need to expand its scope to allow Routes from the test-source namespace:

kubectl patch -n kong --type=json gateways.gateway.networking.k8s.io kong -p='[{"op":"replace","path": "/spec/listeners/0/allowedRoutes/namespaces/from","value":"All"}]'

This results in a Gateway resource with the following configuration:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: kong
  namespace: kong
spec:
  gatewayClassName: kong
  listeners:
  - name: proxy
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All

Listeners can allow Routes in their own namespace (from: Same), all namespaces (from: All), or a labeled set of namespaces (from: Selector).

Deploy a Service and HTTPRoute

  1. Deploy an echo Service to the test-destination resource.

    kubectl apply -f https://developer.konghq.com/manifests/kic/echo-service.yaml -n test-destination

  2. Deploy an HTTPRoute that sends traffic to the Service:

    echo 'apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: echo
  namespace: test-source
  annotations:
    konghq.com/strip-path: "true"
spec:
  parentRefs:
  - name: kong
    namespace: kong
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /echo
    backendRefs:
    - name: echo
      kind: Service
      port: 1027
      namespace: test-destination
' | kubectl apply -f -

    Note the namespace fields in both the parent and backend references. By default, entries here attempt to use the same namespace as the HTTPRoute if you don’t specify a namespace.

  3. Validate the configuration by sending requests through the Route:

    curl -s "$PROXY_IP/echo"

    The results should look like this:

    Welcome, you are connected to node kind-control-plane.
Running on Pod echo-965f7cf84-z9jv2.
In namespace test-destination.
With IP address 10.244.0.6.

Cleanup

Uninstall KIC from your cluster

 
helm uninstall kong -n kong
Something wrong?
Report an Issue | Edit this Page

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!
Contribute

Still need help

Ask in our Forum
Contact Support