helm upgrade --install kong-operator kong/kong-operator -n kong-system \
--create-namespace \
--set image.tag=2.3 \
--set env.ENABLE_CONTROLLER_KONNECT=true
kubectl -n kong-system wait --for=condition=Available=true --timeout=300s deployment/kong-operator-kong-operator-controller-managerSet timeouts and retries for a Service
Annotate the Kubernetes Service with konghq.com/connect-timeout, konghq.com/read-timeout, konghq.com/write-timeout, and konghq.com/retries. Kong Gateway applies these settings when forwarding requests to the upstream service.
Prerequisites
Kong Konnect
If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.
- The following Konnect items are required to complete this tutorial:
- Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.
-
Set the personal access token as an environment variable:
export KONNECT_TOKEN='YOUR KONNECT TOKEN'
Kong Operator running
If you want cert-manager to issue and rotate the admission and conversion webhook certificates, install cert-manager to your cluster and enable cert-manager integration by passing the following argument while installing, in the next step:
--set global.webhooks.options.certManager.enabled=trueIf you do not enable this, the chart will generate and inject self-signed certificates automatically. We recommend enabling cert-manager to manage the lifecycle of these certificates.
Kong Operator needs a certificate authority to sign the certificate for mTLS communication between the control plane and the data plane.
This is handled automatically by the Helm chart. If you need to provide a custom CA certificate, refer to the certificateAuthority section
in the values.yaml of the Helm chart to learn how to create and reference your own CA certificate.
Apply a KongLicense. This assumes that your license is available in ./license.json
echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongLicense
metadata:
name: kong-license
rawLicenseString: '$(cat ./license.json)'
" | kubectl apply -f -Create a KonnectAPIAuthConfiguration resource
kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -
echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: konnect-api-auth
namespace: kong
spec:
type: token
token: "'$KONNECT_TOKEN'"
serverURL: us.api.konghq.com
' | kubectl apply -f -Create Gateway resources
Create the kong namespace:
kubectl create namespace kongCreate the kong namespace:
kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -Create the GatewayConfiguration, GatewayClass, and Gateway resources with basic configuration:
Setting spec.konnect.authRef attaches the data plane to Konnect, which manages its configuration:
echo '
apiVersion: gateway-operator.konghq.com/v2beta1
kind: GatewayConfiguration
metadata:
name: gateway-configuration
namespace: kong
spec:
konnect:
authRef:
name: konnect-api-auth
namespace: kong
dataPlaneOptions:
deployment:
podTemplateSpec:
spec:
containers:
- image: kong/kong-gateway:3.16
name: proxy
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: gateway-class
spec:
controllerName: konghq.com/gateway-operator
parametersRef:
group: gateway-operator.konghq.com
kind: GatewayConfiguration
name: gateway-configuration
namespace: kong
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: kong
namespace: kong
annotations:
gateway-operator.konghq.com/static-naming: "true"
spec:
gatewayClassName: gateway-class
listeners:
- name: http
port: 80
protocol: HTTP' | kubectl apply -f -The gateway-operator.konghq.com/static-naming: "true" annotation gives the resources Kong Operator generates for the Gateway static, predictable names: the KonnectGatewayControlPlane it creates for the Gateway is named after the Gateway, in this case kong. You can reference that control plane from other resources before it exists, and its name in Konnect is derived from the Gateway name.
echo '
apiVersion: gateway-operator.konghq.com/v2beta1
kind: GatewayConfiguration
metadata:
name: gateway-configuration
namespace: kong
spec:
dataPlaneOptions:
deployment:
podTemplateSpec:
spec:
containers:
- image: kong/kong-gateway:3.16
name: proxy
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: gateway-class
spec:
controllerName: konghq.com/gateway-operator
parametersRef:
group: gateway-operator.konghq.com
kind: GatewayConfiguration
name: gateway-configuration
namespace: kong
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: kong
namespace: kong
spec:
gatewayClassName: gateway-class
listeners:
- name: http
port: 80
protocol: HTTP' | kubectl apply -f -Create a Service and a Route
-
Run the following command to create a sample httpbin Service:
kubectl apply -f https://developer.konghq.com/manifests/kic/httpbin-service.yaml -n kong -
Create an
HTTPRouteresource:echo ' apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: httpbin-route namespace: kong annotations: konghq.com/strip-path: "true" konghq.com/preserve-host: "false" spec: parentRefs: - name: kong rules: - matches: - path: type: PathPrefix value: /httpbin backendRefs: - name: httpbin kind: Service port: 80' | kubectl apply -f -
Timeout and retry settings control how long Kong Gateway waits for responses from your upstream services and how many times it retries failed requests. You configure these settings by annotating the Kubernetes Service that your HTTPRoute routes traffic to.
Annotate the Service
Annotate the httpbin Service with timeout and retry values:
kubectl annotate service httpbin -n kong \
konghq.com/connect-timeout="3000" \
konghq.com/read-timeout="5000" \
konghq.com/write-timeout="5000" \
konghq.com/retries="3"The annotations have the following effects:
|
Annotation |
Value |
Effect |
|---|---|---|
konghq.com/connect-timeout
|
3000
|
Kong Gateway waits up to 3 seconds to establish a TCP connection |
konghq.com/read-timeout
|
5000
|
Kong Gateway waits up to 5 seconds for the upstream to send a response |
konghq.com/write-timeout
|
5000
|
Kong Gateway waits up to 5 seconds when sending data upstream |
konghq.com/retries
|
3
|
Failed requests are retried up to 3 times before returning an error |
All timeout values are in milliseconds.
Validate
-
Wait for the
Gatewayto be programmed:kubectl wait --for=condition=Programmed gateway/kong -n kong --timeout=5m -
Get the Gateway’s external IP address:
export PROXY_IP=$(kubectl get gateway kong -n kong -o jsonpath='{.status.addresses[0].value}') -
Send a request that completes within the read timeout. The
/delay/1endpoint waits 1 second before responding:curl -s -o /dev/null -w "%{http_code}" $PROXY_IP/httpbin/delay/1The response code should be
200. -
Send a request that exceeds the read timeout. The
/delay/10endpoint waits 10 seconds:curl -s -o /dev/null -w "%{http_code}" $PROXY_IP/httpbin/delay/10The response code should be
504, indicating that the upstream did not respond within the configuredread-timeout.
Cleanup
Delete the resources created in this guide
Deleting the Gateway also deletes the control plane and data plane resources Kong Operator created for it. Deleting the kong-system namespace removes the operator:
kubectl delete -n kong --ignore-not-found \
httproute/httpbin-route \
service/httpbin \
gateway/kong \
gatewayconfiguration/gateway-configuration
kubectl delete --ignore-not-found gatewayclass/gateway-class
kubectl delete --ignore-not-found namespace kong
helm uninstall kong-operator -n kong-system
kubectl delete --ignore-not-found namespace kong-system