Home / Kong Operator / Gateway Deployment / Get Started
Edit
Report

Provision a Gateway

Uses: Kong Operator
Deployment Platform
Related Documentation
Operator Documentation
In This Series
  1. Install Kong Operator
  2. Provision a Gateway
  3. Configure route and service
Minimum Version
Kong Operator - 2.1
TL;DR

Use Gateway API constructs GatewayConfiguration, GatewayClass and Gateway to provision a Kong Gateway on Kubernetes.

Prerequisites

Series Prerequisites

This page is part of the Get started with Kong Operator and Gateway API series.

Complete the previous page, Install Kong Operator before completing this page.

Kong Konnect

If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

  1. The following Konnect items are required to complete this tutorial:
    • Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

  2. Set the personal access token as an environment variable:

    export KONNECT_TOKEN='YOUR KONNECT TOKEN'

Create a KonnectAPIAuthConfiguration resource

 
kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -
echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: konnect-api-auth
  namespace: kong
spec:
  type: token
  token: "'$KONNECT_TOKEN'"
  serverURL: us.api.konghq.com
' | kubectl apply -f -

Create a GatewayConfiguration resource

First, let’s create a GatewayConfiguration resource to specify our Hybrid Gateway parameters. Set spec.konnect.authRef.name to the name of the KonnectAPIAuthConfiguration resource we created in the prerequisites and specify your data plane configuration.

New control plane

To create a new control plane managed with Kubernetes, use the following command:

echo '
kind: GatewayConfiguration
apiVersion: gateway-operator.konghq.com/v2beta1
metadata:
  name: kong-configuration
  namespace: kong
spec:
  konnect:
    authRef:
      name: konnect-api-auth
  dataPlaneOptions:
    deployment:
      podTemplateSpec:
        spec:
          containers:
          - name: proxy
            image: kong/kong-gateway:3.14' | kubectl apply -f -

Existing Konnect control plane

To use a control plane previously created in Konnect, export the control plane ID:

export KONNECT_CONTROL_PLANE_ID="YOUR KONNECT CONTROL PLANE ID"

Run the following command:

echo '
kind: GatewayConfiguration
apiVersion: gateway-operator.konghq.com/v2beta1
metadata:
  name: kong-configuration
  namespace: kong
spec:
  konnect:
    authRef:
      name: konnect-api-auth
    source: Mirror
    mirror:
      konnect:
        id: "'$KONNECT_CONTROL_PLANE_ID'"
  dataPlaneOptions:
    deployment:
      podTemplateSpec:
        spec:
          containers:
          - name: proxy
            image: kong/kong-gateway:3.14' | kubectl apply -f -

First, let’s create a GatewayConfiguration resource to specify our Gateway parameters:

kubectl create namespace kong

echo '
kind: GatewayConfiguration
apiVersion: gateway-operator.konghq.com/v2beta1
metadata:
  name: kong-configuration
  namespace: kong
spec:
  dataPlaneOptions:
    deployment:
      podTemplateSpec:
        spec:
          containers:
          - name: proxy
            image: kong/kong-gateway:3.9' | kubectl apply -f -

Create a GatewayClass

Next, configure a GatewayClass resource to use the GatewayConfiguration we just created:

echo 'kind: GatewayClass
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: kong
spec:
  controllerName: konghq.com/gateway-operator
  parametersRef:
    group: gateway-operator.konghq.com
    kind: GatewayConfiguration
    name: kong-configuration
    namespace: kong
' | kubectl apply -f -

Create a Gateway Resource

Finally, create a Gateway resource that references the GatewayClass we just created:

echo '
kind: Gateway
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: kong
  namespace: kong
spec:
  gatewayClassName: kong
  listeners:
  - name: http
    protocol: HTTP
    port: 80
' | kubectl apply -f -

Kong Operator will automatically create the DataPlane and KonnectGatewayControlPlane resources.

Kong Operator will automatically create the DataPlane and ControlPlane resources.

Validation

You can verify the Gateway was reconciled successfully by checking its Programmed condition.

kubectl get -n kong gateway kong \
  -o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jq

The output should look similar to this:

{
  "observedGeneration": 1,
  "reason": "Programmed",
  "status": "True",
  "type": "Programmed"
}

Troubleshooting DependenciesNotReady

If your Gateway or DataPlane resources are partially initialized, you will get an error like the following: 

{
  "lastTransitionTime": "2026-04-24T19:25:47Z",
  "message": "There are other conditions that are not yet ready",
  "observedGeneration": 1,
  "reason": "DependenciesNotReady",
  "status": "False",
  "type": "Programmed"
}

Wait for a few minutes to allow the dependencies to be provisioned before trying again.

← Previous 1. Install Kong Operator Next → 3. Configure route and service
Something wrong?
Report an Issue | Edit this Page
View all Kong documentation

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!
Contribute

Still need help?

Ask in our Slack Community
Contact Support