How to: Configure Gateway API resources across namespaces

Prerequisites

Kong Konnect

If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

The following Konnect items are required to complete this tutorial:
- Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.
Set the personal access token as an environment variable:
```
export KONNECT_TOKEN='YOUR KONNECT TOKEN'
```

Enable the Gateway API

Install the Gateway API CRDs before installing Kong Ingress Controller.

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml

Create a Gateway and GatewayClass instance to use.

echo "
apiVersion: v1
kind: Namespace
metadata:
  name: kong
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: kong
  annotations:
    konghq.com/gatewayclass-unmanaged: 'true'
spec:
  controllerName: konghq.com/kic-gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: kong
spec:
  gatewayClassName: kong
  listeners:
  - name: proxy
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
         from: Same
" | kubectl apply -n kong -f -

Create a KIC Control Plane

Use the Konnect API to create a new CLUSTER_TYPE_K8S_INGRESS_CONTROLLER Control Plane:

CONTROL_PLANE_DETAILS=$(curl -X POST "https://us.api.konghq.com/v2/control-planes" \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "name": "My KIC CP",
       "cluster_type": "CLUSTER_TYPE_K8S_INGRESS_CONTROLLER"
     }')

We’ll need the id and telemetry_endpoint for the values.yaml file later. Save them as environment variables:

CONTROL_PLANE_ID=$(echo $CONTROL_PLANE_DETAILS | jq -r .id)
CONTROL_PLANE_TELEMETRY=$(echo $CONTROL_PLANE_DETAILS | jq -r '.config.telemetry_endpoint | sub("https://";"")')

Create mTLS certificates

Kong Ingress Controller talks to Konnect over a connected secured with TLS certificates.

Generate a new certificate using openssl:

openssl req -new -x509 -nodes -newkey rsa:2048 -subj "/CN=kongdp/C=US" -keyout ./tls.key -out ./tls.crt

The certificate needs to be a single line string to send it to the Konnect API with curl. Use awk to format the certificate:

export CERT=$(awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' tls.crt);

Next, upload the certificate to Konnect:

curl -X POST "https://us.api.konghq.com/v2/control-planes/$CONTROL_PLANE_ID/dp-client-certificates" \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "cert": "'$CERT'"
     }'

Finally, store the certificate in a Kubernetes secret so that Kong Ingress Controller can read it:

kubectl create namespace kong -o yaml --dry-run=client | kubectl apply -f -
kubectl create secret tls konnect-client-tls -n kong --cert=./tls.crt --key=./tls.key

Kong Ingress Controller running

Add the Kong Helm charts:

helm repo add kong https://charts.konghq.com
helm repo update

Install Kong Ingress Controller using Helm:

helm install kong kong/ingress -n kong --create-namespace

Set $PROXY_IP as an environment variable for future commands:

export PROXY_IP=$(kubectl get svc --namespace kong kong-gateway-proxy -o jsonpath='{range .status.loadBalancer.ingress[0]}{@.ip}{@.hostname}{end}')
echo $PROXY_IP

Create namespaces and allow references

Create separate namespaces to hold the HTTPRoute and target Service:

kubectl create namespace test-source
kubectl create namespace test-destination

Create a ReferenceGrant resource in the destination namespace:

echo 'kind: ReferenceGrant
apiVersion: gateway.networking.k8s.io/v1beta1    
metadata:                                    
  name: test-grant
  namespace: test-destination
spec:                        
  from:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute                 
    namespace: test-source
  to:                     
  - group: ""
    kind: Service
' | kubectl apply -f -

ReferenceGrants allow namespaces to opt in to references from other resources. They reside in the namespace of the target resource and list resources and namespaces that can talk to specific resources in the ReferenceGrant’s namespace.

In this case, the example configuration allows HTTPRoutes in the test-source namespace to reference Services in the test-destination namespace.

Using a Gateway resource in a different namespace

Gateway resources may also allow references from resources (HTTPRoute, TCPRoute, etc.) in other namespaces. However, these references do not use ReferenceGrants, as they are defined per listener in the Gateway resource, not for the entire Gateway. A listener’s allowedRoutes field lets you define which routing resources can bind to that listener.

The default Gateway in this guide only allows Routes from its same namespace (kong). You’ll need to expand its scope to allow Routes from the test-source namespace:

kubectl patch -n kong --type=json gateways.gateway.networking.k8s.io kong -p='[{"op":"replace","path": "/spec/listeners/0/allowedRoutes/namespaces/from","value":"All"}]'

This results in a Gateway resource with the following configuration:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: kong
  namespace: kong
spec:
  gatewayClassName: kong
  listeners:
  - name: proxy
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All

Listeners can allow Routes in their own namespace (from: Same), all namespaces (from: All), or a labeled set of namespaces (from: Selector).

Deploy a Service and HTTPRoute

Deploy an echo Service to the test-destination resource.

kubectl apply -f https://developer.konghq.com/manifests/kic/echo-service.yaml -n test-destination

Deploy an HTTPRoute that sends traffic to the Service:

echo 'apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: echo
  namespace: test-source
  annotations:
    konghq.com/strip-path: "true"
spec:
  parentRefs:
  - name: kong
    namespace: kong
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /echo
    backendRefs:
    - name: echo
      kind: Service
      port: 1027
      namespace: test-destination
' | kubectl apply -f -

Note the namespace fields in both the parent and backend references. By default, entries here attempt to use the same namespace as the HTTPRoute if you don’t specify a namespace.

Validate the configuration by sending requests through the Route:

curl -s "$PROXY_IP/echo"

The results should look like this:

Welcome, you are connected to node kind-control-plane.
Running on Pod echo-965f7cf84-z9jv2.
In namespace test-destination.
With IP address 10.244.0.6.

Cleanup

Uninstall KIC from your cluster

helm uninstall kong -n kong

Configure Gateway API resources across namespaces