helm upgrade --install kong-operator kong/kong-operator -n kong-system \
--create-namespace \
--set image.tag=2.3 \
--set env.ENABLE_CONTROLLER_KONNECT=true
kubectl -n kong-system wait --for=condition=Available=true --timeout=300s deployment/kong-operator-kong-operator-controller-managerReference an existing Control Plane
Uses:
Kong Operator
TL;DR
Using Kong Operator, create a KonnectGatewayControlPlane object with spec.source: Mirror and add Konnect authentication.
Prerequisites
Kong Konnect
If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.
- The following Konnect items are required to complete this tutorial:
- Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.
-
Set the personal access token as an environment variable:
export KONNECT_TOKEN='YOUR KONNECT TOKEN'
Kong Operator running
If you want cert-manager to issue and rotate the admission and conversion webhook certificates, install cert-manager to your cluster and enable cert-manager integration by passing the following argument while installing, in the next step:
--set global.webhooks.options.certManager.enabled=trueIf you do not enable this, the chart will generate and inject self-signed certificates automatically. We recommend enabling cert-manager to manage the lifecycle of these certificates.
Kong Operator needs a certificate authority to sign the certificate for mTLS communication between the control plane and the data plane.
This is handled automatically by the Helm chart. If you need to provide a custom CA certificate, refer to the certificateAuthority section
in the values.yaml of the Helm chart to learn how to create and reference your own CA certificate.
Create a KonnectAPIAuthConfiguration resource
kubectl create namespace kong --dry-run=client -o yaml | kubectl apply -f -
echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: konnect-api-auth
namespace: kong
spec:
type: token
token: "'$KONNECT_TOKEN'"
serverURL: us.api.konghq.com
' | kubectl apply -f -Set the Konnect Control Plane ID
Set the KONNECT_CONTROL_PLANE_ID variable to the ID of the control plane that you want to reference:
export KONNECT_CONTROL_PLANE_ID='YOUR CONTROL PLANE ID'If you don’t have a control plane yet, create one with the Konnect API and save its ID to the variable:
KONNECT_CONTROL_PLANE_ID=$(curl -X POST "https://us.api.konghq.com/v2/control-planes" \
--no-progress-meter --fail-with-body \
-H "Authorization: Bearer $KONNECT_TOKEN" \
--json '{
"name": "mirror-source-control-plane"
}' | jq -r ".id"
)Create a KonnectGatewayControlPlane
Create a KonnectGatewayControlPlane object and add the Konnect authentication resource we created in the prerequisites.
echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha2
metadata:
name: gateway-control-plane
namespace: kong
spec:
source: Mirror
mirror:
konnect:
id: "'$KONNECT_CONTROL_PLANE_ID'"
konnect:
authRef:
name: konnect-api-auth
' | kubectl apply -f -Validation
You can verify the KonnectGatewayControlPlane was reconciled successfully by checking its Programmed condition.
kubectl get -n kong konnectgatewaycontrolplane gateway-control-plane \
-o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jqThe output should look similar to this:
{
"observedGeneration": 1,
"reason": "Programmed",
"status": "True",
"type": "Programmed"
}Now you can reference the gateway-control-plane resource from other CRDs as though it was created by Kong Operator.
Cleanup
Delete the resources created in this guide
Delete the KonnectGatewayControlPlane and the authentication configuration. Because this guide references an existing control plane rather than creating one, the control plane in Konnect is left untouched. If you created it for this guide with the API request in the prerequisites, delete it from Konnect separately:
kubectl delete -n kong --ignore-not-found \
konnectgatewaycontrolplane/gateway-control-plane \
konnectapiauthconfiguration/konnect-api-authDelete the namespaces
helm uninstall kong-operator -n kong-system
kubectl delete namespace kong kong-system