Create a Control Plane

Use the KonnectGatewayControlPlane resource to define the Konnect Control Plane that your CRDs will target. This enables your cluster to send configuration to Konnect.

A KonnectAPIAuthConfiguration must already exist to authenticate with the Konnect API. If you haven’t created one yet, see Create API Authentication.

Apply the following configuration to define a Control Plane named gateway-control-plane:

echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: gateway-control-plane
  namespace: kong
spec:
  name: gateway-control-plane
  konnect:
    authRef:
      name: konnect-api-auth
' | kubectl apply -f -

This resource links your cluster to a specific Control Plane instance in Konnect using the credentials provided in konnect-api-auth.

To finalize the connection between your cluster and the Konnect control plane, create a KonnectExtension object. This resource binds your local Gateway or Data Plane to the Konnect control plane you’ve defined.

echo '
kind: KonnectExtension
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: my-konnect-config
  namespace: kong
spec:
  clientAuth:
    certificateSecret:
      provisioning: Automatic
  konnect:
    controlPlane:
      ref:
        type: konnectNamespacedRef
        konnectNamespacedRef:
          name: gateway-control-plane
' | kubectl apply -f -

The KonnectExtension resource handles automatic certificate generation and establishes secure communication between your cluster and Konnect.

kubectl get -n kong konnectgatewaycontrolplane gateway-control-plane \
  -o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jq

{
  "observedGeneration": 1,
  "reason": "Programmed",
  "status": "True",
  "type": "Programmed"
}

Once these resources are in place, your cluster is connected to Konnect and can begin managing entities such as KongService, KongRoute, and KongPlugin.