echo $DP_CERT > dp.crt
diff -u tls.crt dp.crt
Copied!
Check the return code of the command to make sure it completed successfully:
if [[ $? -ne 0 ]]; then
echo "Did not receive the expected return code"
fi
Copied!
Use a Custom CA Certificate
Uses:
Kong Gateway Operator
Related Documentation
Incompatible with
on-prem
TL;DR
Provide the spec.clientAuth.certificateSecret field when defining your KonnectExtension resource
Prerequisites
Kong Konnect
If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.
- The following Konnect items are required to complete this tutorial:
- Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.
-
Set the personal access token as an environment variable:
export KONNECT_TOKEN='YOUR KONNECT TOKEN'Copied!
Kong Gateway Operator running
-
Add the Kong Helm charts:
helm repo add kong https://charts.konghq.com helm repo updateCopied! -
Create a
kongnamespace:kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -Copied! -
Install Kong Ingress Controller using Helm:
helm upgrade --install kgo kong/gateway-operator -n kong-system --create-namespace \ --set image.tag=1.6.1 \ --set kubernetes-configuration-crds.enabled=true \ --set env.ENABLE_CONTROLLER_KONNECT=trueCopied!
Kong Gateway Operator running
-
Add the Kong Helm charts:
helm repo add kong https://charts.konghq.com helm repo updateCopied! -
Create a
kongnamespace:kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -Copied! -
Install Kong Ingress Controller using Helm:
helm upgrade --install kgo kong/gateway-operator -n kong-system --create-namespace \ --set image.tag=1.6.1 \ --set kubernetes-configuration-crds.enabled=true \ --set env.ENABLE_CONTROLLER_KONNECT=trueCopied!
Create a KonnectAPIAuthConfiguration resource
kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -
echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: konnect-api-auth
namespace: kong
spec:
type: token
token: "'$KONNECT_TOKEN'"
serverURL: us.api.konghq.com
' | kubectl apply -f -
Copied!
Create a KonnectGatewayControlPlane resource
echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: gateway-control-plane
namespace: kong
spec:
name: gateway-control-plane
konnect:
authRef:
name: konnect-api-auth
' | kubectl apply -f -
Copied!
Use a custom CA certificate
Kong Gateway Operator generates TLS certificates to enable Kong Gateway to authenticate with Konnect. By default, Kong Gateway Operator will act as its own CA. If you would prefer to use your own CA, upload the CA certificate as a Kubernetes secret.
Generate a certificate
-
Generate a new certificate and key:
openssl req -new -x509 -nodes -newkey rsa:2048 -subj "/CN=kongdp/C=US" -keyout ./tls.key -out ./tls.crtCopied! -
Create a Kubernetes secret that contains the certificate:
kubectl create -n kong secret tls konnect-client-tls --cert=./tls.crt --key=./tls.keyCopied! -
Label the secret to tell Kong Gateway Operator to reconcile it:
kubectl label -n kong secret konnect-client-tls konghq.com/konnect-dp-cert=trueCopied!
Create a KonnectExtension
Kong Gateway Operator inspects the spec.clientAuth.certificateSecret to decide how to provision certificates. Create a KonnectExtension with spec.clientAuth.certificateSecret.provisioning: Manual:
echo '
kind: KonnectExtension
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: my-konnect-config
namespace: kong
spec:
clientAuth:
certificateSecret:
provisioning: Manual
secretRef:
name: konnect-client-tls
konnect:
controlPlane:
ref:
type: konnectNamespacedRef
konnectNamespacedRef:
name: gateway-control-plane' | kubectl apply -f -
Copied!
Validate your configuration
To ensure that the correct certificate has been used, fetch the Data Plane certificate from the Konnect API.
Fetch the Control Plane ID:
CONTROL_PLANE_ID=$(kubectl get -n kong konnectgatewaycontrolplanes.konnect.konghq.com gateway-control-plane -o yaml | yq .status.id)
Copied!
Fetch the client certificate:
DP_CERT=$( curl -X GET "https://us.api.konghq.com/v2/control-planes/$CONTROL_PLANE_ID/dp-client-certificates" \
-H "Authorization: Bearer $KONNECT_TOKEN" | jq -r '.items[].cert')
Copied!
To validate that the correct CA certificate has been used, you can diff the local certificate with the one from the API: