helm upgrade --install kong-operator kong/kong-operator -n kong-system \
--create-namespace \
--set image.tag=2.3 \
--set env.ENABLE_CONTROLLER_KONNECT=true
kubectl -n kong-system wait --for=condition=Available=true --timeout=300s deployment/kong-operator-kong-operator-controller-managerCreate a Cloud Gateway Data Plane group configuration
Uses:
Kong Operator
Incompatible with
on-prem
Related Documentation
Tags
Related Resources
TL;DR
Use the KonnectCloudGatewayDataPlaneGroupConfiguration resource to define autoscaling Data Plane groups and associate them with Cloud Gateway networks.
Prerequisites
Kong Konnect
If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.
- The following Konnect items are required to complete this tutorial:
- Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.
-
Set the personal access token as an environment variable:
export KONNECT_TOKEN='YOUR KONNECT TOKEN'
Kong Operator running
If you want cert-manager to issue and rotate the admission and conversion webhook certificates, install cert-manager to your cluster and enable cert-manager integration by passing the following argument while installing, in the next step:
--set global.webhooks.options.certManager.enabled=trueIf you do not enable this, the chart will generate and inject self-signed certificates automatically. We recommend enabling cert-manager to manage the lifecycle of these certificates.
Kong Operator needs a certificate authority to sign the certificate for mTLS communication between the control plane and the data plane.
This is handled automatically by the Helm chart. If you need to provide a custom CA certificate, refer to the certificateAuthority section
in the values.yaml of the Helm chart to learn how to create and reference your own CA certificate.
Create a KonnectAPIAuthConfiguration resource
kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -
echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: konnect-api-auth
namespace: kong
spec:
type: token
token: "'$KONNECT_TOKEN'"
serverURL: us.api.konghq.com
' | kubectl apply -f -Create a KonnectGatewayControlPlane resource
echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha2
metadata:
name: gateway-control-plane
namespace: kong
spec:
createControlPlaneRequest:
name: gateway-control-plane
konnect:
authRef:
name: konnect-api-auth
' | kubectl apply -f -Create a KonnectCloudGatewayNetwork resource
In order to manage Cloud Gateway Networks you need to have a Cloud Gateway Provider Account associated with your Konnect account. Export the ID of your provider account to your environment with the Cloud Gateways API:
export CLOUD_GATEWAY_PROVIDER_ID=$(curl -s -H 'Content-Type: application/json' -H "Authorization: Bearer $KONNECT_TOKEN" -XGET https://global.api.konghq.com/v2/cloud-gateways/provider-accounts | jq -r '.data[0].id')Create the KonnectCloudGatewayNetwork resource:
echo '
kind: KonnectCloudGatewayNetwork
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: konnect-network-1
namespace: kong
spec:
name: network1
cloud_gateway_provider_account_id: "'$CLOUD_GATEWAY_PROVIDER_ID'"
availability_zones:
- euw1-az1
- euw1-az2
- euw1-az3
cidr_block: 192.168.0.0/16
region: eu-west-1
konnect:
authRef:
name: konnect-api-auth
' | kubectl apply -f -It can take some time for the network to finish initializing. Make sure the network is ready before moving on to the next step. You can got to the Konnect Networks page or use the following command to check the network state:
curl -s -H 'Content-Type: application/json' -H "Authorization: Bearer $KONNECT_TOKEN" -XGET https://global.api.konghq.com/v2/cloud-gateways/networks| jq
Create a KonnectCloudGatewayDataPlaneGroupConfiguration
Use the KonnectCloudGatewayDataPlaneGroupConfiguration resource to configure data plane groups for a Dedicated Cloud Gateway. Only one configuration can exist per Control Plane.
Creating multiple configurations will result in overwriting the previous one. Each Dedicated Cloud Gateway supports only a single DataPlaneGroupConfiguration.
echo '
kind: KonnectCloudGatewayDataPlaneGroupConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: konnect-cg-dpconf
namespace: kong
spec:
api_access: private+public
version: "3.10"
dataplane_groups:
- provider: aws
region: eu-west-1
networkRef:
type: namespacedRef
namespacedRef:
name: konnect-network-1
autoscale:
type: autopilot
autopilot:
base_rps: 100
environment:
- name: KONG_LOG_LEVEL
value: debug
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: gateway-control-plane
' | kubectl apply -f -Since creating a Data Plane Group Configuration can take some time, you can monitor its status by checking the dataplane_groups field. Data Plane Group Configurations receive this field when they are successfully provisioned in Konnect.
kubectl get -n kong konnectcloudgatewaydataplanegroupconfiguration.konnect.konghq.com konnect-cg-dpconf -o=jsonpath='{.status.dataplane_groups}' | yq -p jsonValidation
You can verify the KonnectCloudGatewayDataPlaneGroupConfiguration was reconciled successfully by checking its Programmed condition.
kubectl get -n kong konnectcloudgatewaydataplanegroupconfiguration konnect-cg-dpconf \
-o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jqThe output should look similar to this:
{
"observedGeneration": 1,
"reason": "Programmed",
"status": "True",
"type": "Programmed"
}Cleanup
Delete the resources created in this guide
Deleting the KonnectCloudGatewayDataPlaneGroupConfiguration removes the Data Plane group from Konnect. Deleting the KonnectGatewayControlPlane also deletes the control plane Kong Operator created in Konnect:
kubectl delete -n kong --ignore-not-found \
konnectcloudgatewaydataplanegroupconfiguration/konnect-cg-dpconf \
konnectcloudgatewaynetwork/konnect-network-1 \
konnectgatewaycontrolplane/gateway-control-plane \
konnectapiauthconfiguration/konnect-api-authDelete the namespaces
helm uninstall kong-operator -n kong-system
kubectl delete namespace kong kong-system