Edit this page
Report an issueYou are browsing documentation for an older version. See the latest documentation here.
Create a KonnectExtension
In order to bind a Kong DataPlane to a Konnect ControlPlane, you can use the KonnectExtension (CRD reference can be found here).
You can learn more about how to use the KonnectExtension object in this guide.
Binding the DataPlane to a Konnect ControlPlane
The Kong DataPlane can be configured with self-managed Hybrid or KIC ControlPlanes. This means that the controlPlane entity referenced (via KonnectID or NamespacedRef) by the KonnectExtension object must belong to one of these two categories. It is important to notice, though, that in case the Konnect ControlPlane is of type KIC, the Kong DataPlane needs a Kubernetes ControlPlane (see the ControlPlane CRD ref) running in the cluster to be properly configured. In that scenario, the use of a Gateway is highly recommended.
The command below can be used to configure a KonnectExtension, which is used to attach a Gateway or a DataPlane to Konnect. You can find all the available KonnectExtension available options in the overview page.
Prerequisites: Create a valid KonnectAPIAuthConfiguration and KonnectGatewayControlPlane in your cluster.
Create an access token in Konnect
You may create either a Personal Access Token (PAT) or a Service Account Token (SAT) in Konnect. Please refer to the
Konnect authentication documentation for more information. You will need this token
to create a KonnectAPIAuthConfiguration object that will be used by the Kong Gateway Operator to authenticate
with Konnect APIs.
Create a Kong Konnect API auth configuration
Depending on your preferences, you can create a KonnectAPIAuthConfiguration object with the token specified
directly in its spec or as a reference to a Kubernetes Secret. The serverURL field should be set to the Konnect API
URL in a region where your Kong Konnect account is located. Please refer to the list of available API URLs
for more information.
Please note that the Secret must have the konghq.com/credential: konnect label to make the Kong Gateway Operator
reconcile it.
echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: konnect-api-auth
namespace: default
spec:
type: secretRef
secretRef:
name: konnect-api-auth-secret
serverURL: us.api.konghq.com
---
kind: Secret
apiVersion: v1
metadata:
name: konnect-api-auth-secret
namespace: default
labels:
konghq.com/credential: konnect
stringData:
token: kpat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
' | kubectl apply -f -
You can verify the KonnectAPIAuthConfiguration object was reconciled successfully by checking its status.
kubectl get konnectapiauthconfiguration konnect-api-auth
The output should look like this:
NAME VALID ORGID SERVERURL
konnect-api-auth True <your-konnect-org-id> https://us.api.konghq.com
Create a Kong Gateway control plane
Creating the KonnectGatewayControlPlane object in your Kubernetes cluster will provision a Kong Konnect Gateway
control plane in your Gateway Manager. The KonnectGatewayControlPlane CR
API allows you to
explicitly set a type of the Kong Gateway control plane, but if you don’t specify it, the default type is
a Self-Managed Hybrid
gateway control plane.
You can create one by applying the following YAML manifest:
echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: gateway-control-plane
namespace: default
spec:
name: gateway-control-plane # Name used to identify the Gateway Control Plane in Konnect
konnect:
authRef:
name: konnect-api-auth # Reference to the KonnectAPIAuthConfiguration object
' | kubectl apply -f -
You can see the status of the Gateway Control Plane by running:
kubectl get konnectgatewaycontrolplanes.konnect.konghq.com gateway-control-plane
If the Gateway Control Plane is successfully created, you should see the following output:
NAME PROGRAMMED ID ORGID
gateway-control-plane True <konnect-control-plane-id> <your-konnect-ord-id>
Having that in place, you will be able to reference the gateway-control-plane in your Kong Konnect entities as their parent.
echo '
kind: KonnectExtension
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: my-konnect-config
namespace: default
spec:
clientAuth:
certificateSecret:
provisioning: Automatic
konnect:
controlPlane:
ref:
type: konnectNamespacedRef
konnectNamespacedRef:
name: gateway-control-plane' | kubectl apply -f -
