Create a control plane

Use the KonnectGatewayControlPlane resource to define the Konnect control plane that your CRDs will target. This enables your cluster to send configuration to Konnect.

Apply the following configuration to define a Control Plane named gateway-control-plane:

New control plane

To create a new control plane managed with Kubernetes, use the following command:

echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha2
metadata:
  name: gateway-control-plane
  namespace: kong
spec:
  createControlPlaneRequest:
    name: gateway-control-plane
  konnect:
    authRef:
      name: konnect-api-auth
' | kubectl apply -f -

Existing Konnect control plane

To use a control plane previously created in Konnect, export the control plane ID:

export KONNECT_CONTROL_PLANE_ID="YOUR KONNECT CONTROL PLANE ID"

Run the following command:

echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha2
metadata:
  name: gateway-control-plane
spec:
  createControlPlaneRequest:
    name: gateway-control-plane
  konnect:
    authRef:
      name: konnect-api-auth
    source: Mirror
    mirror:
      konnect:
        id: "'$KONNECT_CONTROL_PLANE_ID'"
' | kubectl apply -f -

This resource links your cluster to a specific control plane instance in Konnect using the credentials provided in konnect-api-auth.

Make sure that the KonnectGatewayControlPlane resource is in the same namespace as the KonnectAPIAuthConfiguration resource.

To finalize the connection between your cluster and the Konnect control plane, create a KonnectExtension object. This resource binds your local Gateway or data plane to the Konnect control plane you’ve defined.

echo '
kind: KonnectExtension
apiVersion: konnect.konghq.com/v1alpha2
metadata:
  name: my-konnect-config
  namespace: kong
spec:
  clientAuth:
    certificateSecret:
      provisioning: Automatic
  konnect:
    controlPlane:
      ref:
        type: konnectNamespacedRef
        konnectNamespacedRef:
          name: gateway-control-plane
' | kubectl apply -f -

The KonnectExtension resource handles automatic certificate generation and establishes secure communication between your cluster and Konnect.

The Dataplane is the listener that will accept requests, and route traffic to your Kubernetes services.

echo '
apiVersion: gateway-operator.konghq.com/v1beta1
kind: DataPlane
metadata:
  name: dataplane
  namespace: kong
spec:
  extensions:
  - kind: KonnectExtension
    name: my-konnect-config
    group: konnect.konghq.com
  deployment:
    podTemplateSpec:
      spec:
        containers:
        - name: proxy
          image: kong/kong-gateway:3.13
          readinessProbe:
            initialDelaySeconds: 1
            periodSeconds: 1' | kubectl apply -f - 

kubectl get -n kong konnectgatewaycontrolplane gateway-control-plane \
  -o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jq

{
  "observedGeneration": 1,
  "reason": "Programmed",
  "status": "True",
  "type": "Programmed"
}

Once these resources are in place, your cluster is connected to Konnect and can begin managing entities such as KongService, KongRoute, and KongPlugin.