Home / Kong Operator / Gateway Deployment / How-To
Edit
Report

Proxy HTTPS traffic with TLS termination

Uses: Kong Operator
Deployment Platform
Related Documentation
Operator Documentation
TL;DR

Add an HTTPS protocol listener to your Gateway resource and reference a Kubernetes Secret containing your TLS certificate and key.

Prerequisites

Kong Konnect

If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

  1. The following Konnect items are required to complete this tutorial:
    • Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

  2. Set the personal access token as an environment variable:

    export KONNECT_TOKEN='YOUR KONNECT TOKEN'

Kong Operator running

  1. Add the Kong Helm charts:

    helm repo add kong https://charts.konghq.com
helm repo update

  2. Install Kong Operator using Helm:

    helm upgrade --install kong-operator kong/kong-operator -n kong-system \
  --create-namespace \
  --set image.tag=2.3 \
  --set env.ENABLE_CONTROLLER_KONNECT=true
  kubectl -n kong-system wait --for=condition=Available=true --timeout=300s deployment/kong-operator-kong-operator-controller-manager
    helm upgrade --install kong-operator kong/kong-operator -n kong-system \
  --create-namespace \
   --set image.tag=2.3
  kubectl -n kong-system wait --for=condition=Available=true --timeout=300s deployment/kong-operator-kong-operator-controller-manager

If you want cert-manager to issue and rotate the admission and conversion webhook certificates, install cert-manager to your cluster and enable cert-manager integration by passing the following argument while installing, in the next step:

   --set global.webhooks.options.certManager.enabled=true

If you do not enable this, the chart will generate and inject self-signed certificates automatically. We recommend enabling cert-manager to manage the lifecycle of these certificates. Kong Operator needs a certificate authority to sign the certificate for mTLS communication between the control plane and the data plane. This is handled automatically by the Helm chart. If you need to provide a custom CA certificate, refer to the certificateAuthority section in the values.yaml of the Helm chart to learn how to create and reference your own CA certificate.

Apply a KongLicense. This assumes that your license is available in ./license.json

echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongLicense
metadata:
 name: kong-license
rawLicenseString: '$(cat ./license.json)'
" | kubectl apply -f -

Create a KonnectAPIAuthConfiguration resource

 
kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -
echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: konnect-api-auth
  namespace: kong
spec:
  type: token
  token: "'$KONNECT_TOKEN'"
  serverURL: us.api.konghq.com
' | kubectl apply -f -

Configuring TLS termination at the Gateway level allows Kong Operator to manage SSL/TLS certificates and decrypt incoming traffic before it reaches your services. This guide shows how to set up an HTTPS listener using the standard Kubernetes Gateway API.

Create the kong namespace

Create the kong namespace in your Kubernetes cluster, which is where the demo will run:

kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -

Create a certificate

  1. Create a self-signed certificate:

    openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=demo.example.com"

  2. Create a Kubernetes secret containing the certificate and key:

    echo "apiVersion: v1
kind: Secret
metadata:
  name: my-certificate
  namespace: kong
type: kubernetes.io/tls
data:
  tls.crt: "$(cat tls.crt | base64 | tr -d '\n')"
  tls.key: "$(cat tls.key | base64 | tr -d '\n')"" | kubectl apply -f -

Configure the Gateway

Create the following resources:

  • A GatewayConfiguration and a GatewayClass to configure your gateway with the latest Kong Gateway version and Kong Operator as the controller.
  • A Gateway with a listener on port 443 with the HTTPS protocol and a reference to the Secret we created.

Setting spec.konnect.authRef attaches the data plane to Konnect, which manages its configuration:

echo '
apiVersion: gateway-operator.konghq.com/v2beta1
kind: GatewayConfiguration
metadata:
  name: kong-gateway-configuration
  namespace: kong
spec:
  konnect:
    authRef:
      name: konnect-api-auth
      namespace: kong
  dataPlaneOptions:
    deployment:
      podTemplateSpec:
        spec:
          containers:
            - image: kong/kong-gateway:3.16
              name: proxy
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: kong-tls
spec:
  controllerName: konghq.com/gateway-operator
  parametersRef:
    group: gateway-operator.konghq.com
    kind: GatewayConfiguration
    name: kong-gateway-configuration
    namespace: kong
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: kong-tls-gateway
  namespace: kong
  annotations:
    gateway-operator.konghq.com/static-naming: "true"
spec:
  gatewayClassName: kong-tls
  listeners:
    - name: http
      port: 80
      protocol: HTTP
    - name: https
      port: 443
      protocol: HTTPS
      hostname: demo.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: my-certificate' | kubectl apply -f -

The gateway-operator.konghq.com/static-naming: "true" annotation gives the control plane Kong Operator creates for the Gateway a predictable name: it is named after the Gateway, kong-tls-gateway.

echo '
apiVersion: gateway-operator.konghq.com/v2beta1
kind: GatewayConfiguration
metadata:
  name: kong-gateway-configuration
  namespace: kong
spec:
  dataPlaneOptions:
    deployment:
      podTemplateSpec:
        spec:
          containers:
            - image: kong/kong-gateway:3.16
              name: proxy
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: kong-tls
spec:
  controllerName: konghq.com/gateway-operator
  parametersRef:
    group: gateway-operator.konghq.com
    kind: GatewayConfiguration
    name: kong-gateway-configuration
    namespace: kong
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: kong-tls-gateway
  namespace: kong
spec:
  gatewayClassName: kong-tls
  listeners:
    - name: http
      port: 80
      protocol: HTTP
    - name: https
      port: 443
      protocol: HTTPS
      hostname: demo.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - group: ""
            kind: Secret
            name: my-certificate' | kubectl apply -f -

Label the Secret

Kong Operator requires a specific label on Secrets to recognize them for use in gateways:

kubectl label secret my-certificate -n kong konghq.com/secret="true"

For more information about how Kong Operator handles secrets, see the Secrets reference.

Create an echo Service

Run the following command to create a sample echo Service:

kubectl apply -f https://developer.konghq.com/manifests/kic/echo-service.yaml -n kong

Create a Route

Deploy a sample HTTPRoute to verify that TLS termination is working:

echo '
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: echo-route
  namespace: kong
spec:
  parentRefs:
    - name: kong-tls-gateway
  hostnames:
    - demo.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /echo
      backendRefs:
        - name: echo
          kind: Service
          port: 1027' | kubectl apply -f -

Validate

  1. Check the status of the gateway to ensure the listeners are programmed:

    kubectl get gateway kong-tls-gateway -n kong -o jsonpath='{.status.listeners}'

  2. Wait for the Gateway to be programmed:

     kubectl wait --for=condition=Programmed gateway/kong-tls-gateway -n kong --timeout=5m

  3. Wait for the HTTPRoute to be ready:

     kubectl wait --for=jsonpath='{.status.parents[0].conditions[?(@.type=="Programmed")].status}'=True httproute/echo-route -n kong --timeout=5m
     kubectl wait --for=jsonpath='{.status.parents[0].conditions[?(@.type=="Accepted")].status}'=True httproute/echo-route -n kong --timeout=5m

  4. Get the Gateway’s external IP:

     export PROXY_IP=$(kubectl get gateway kong-tls-gateway -n kong -o jsonpath='{.status.addresses[0].value}')

  5. Test the connection:

    curl -ivk --resolve demo.example.com:443:$PROXY_IP https://demo.example.com/echo

    You should get TLS handshake and a 200 response.

Cleanup

Delete the resources created in this guide

Deleting the Gateway also deletes the control plane and data plane resources Kong Operator created for it. Deleting the kong-system namespace removes the operator:

kubectl delete -n kong --ignore-not-found \
  httproute/echo-route \
  service/echo \
  secret/my-certificate \
  gateway/kong-tls-gateway \
  gatewayconfiguration/kong-gateway-configuration
kubectl delete --ignore-not-found gatewayclass/kong-tls
kubectl delete --ignore-not-found namespace kong
helm uninstall kong-operator -n kong-system
kubectl delete --ignore-not-found namespace kong-system
Something wrong?
Report an Issue | Edit this Page
View all Kong documentation

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!
Contribute

Still need help?

Ask in our Slack Community
Contact Support