Install Kong Manager

Kong Manager is the graphical user interface (GUI) for Kong Gateway. It uses the Kong Admin API under the hood to administer and control Kong Gateway.

Kong’s Admin API must be accessible over HTTP from your local machine to use Kong Manager

Prerequisites

• Kong Gateway installed
• Kong’s Admin API is accessible over HTTP from your local machine

Installation

Kong Manager is served from the same node as the Admin API. To enable Kong Manager, make the following changes to your values-cp.yaml file.

1. Set admin_gui_url, admin_gui_api_url and admin_gui_session_conf under the env key.

    env:
      admin_gui_url: http://manager.example.com
      admin_gui_api_url: http://admin.example.com
      # Change the secret and set cookie_secure to true if using a HTTPS endpoint
      admin_gui_session_conf: '{"secret":"secret","storage":"kong","cookie_secure":false}'
   

2. Replace example.com in the configuration with your domain.

3. Enable Kong Manager authentication under the enterprise key.

    enterprise:
      rbac:
        enabled: true
        admin_gui_auth: basic-auth
   

4. Configure the manager section in values-cp.yaml. Replace example.com with your custom domain name.

   EKS

   AKS

   GKE

   KIC

   If you are testing and do not have a VPN set up for your VPC, you may change the alb.ingress.kubernetes.io/scheme annotation to internet-facing to add a public IP address. This is not recommended for long running deployments

   manager:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
        
     ingress:
       enabled: true
       hostname: manager.example.com
       path: /
       pathType: Prefix
       ingressClassName: alb
       annotations:
         alb.ingress.kubernetes.io/load-balancer-name: kong-alb-private
         alb.ingress.kubernetes.io/group.name: demo.kong-alb-private
         alb.ingress.kubernetes.io/target-type: instance
         alb.ingress.kubernetes.io/scheme: internal
         alb.ingress.kubernetes.io/healthcheck-path: /
         alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}]'

   If you are testing and do not have a VPN set up, you may change the appgw.ingress.kubernetes.io/use-private-ip annotation to false to add a public IP address. This is not recommended for long running deployments

   manager:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
        
     ingress:
       enabled: true
       hostname: manager.example.com
       path: /
       pathType: Prefix
       ingressClassName: azure-application-gateway
       annotations:
         appgw.ingress.kubernetes.io/use-private-ip: "true"

   If you are testing and do not have a VPN set up, you may change the kubernetes.io/ingress.class annotation to gce to add a public IP address. This is not recommended for long running deployments

   manager:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
     annotations:
       beta.cloud.google.com/backend-config: '{"default":"kong-hc"}'
     ingress:
       enabled: true
       hostname: manager.example.com
       path: /
       pathType: Prefix
       annotations:
         kubernetes.io/ingress.class: gce-internal

   All endpoints proxied by Kong Ingress Controller will be publicly accessible. Use an authentication plugin to secure your API

   manager:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
        
     ingress:
       enabled: true
       hostname: manager.example.com
       path: /
       pathType: Prefix
       ingressClassName: kong

5. Run helm upgrade to update the release.

    helm upgrade kong-cp kong/kong -n kong --values ./values-cp.yaml
   

6. Fetch the Ingress IP address and update your DNS records to point at the Ingress address. You can configure DNS manually, or use a tool like external-dns to automate DNS configuration.

    kubectl get ingress -n kong kong-cp-kong-manager -o jsonpath='{.spec.rules[0].host}{": "}{range .status.loadBalancer.ingress[0]}{@.ip}{@.hostname}{end}'
   

Testing

Visit the URL in env.admin_gui_url in a web browser to see the Kong Manager log in page. The default username is kong_admin, and the password is the value you set in env.password when installing the Kong Gateway control plane in the previous step.

Troubleshooting

I can’t log in to Kong Manager

Check that env.password was set in values-cp.yaml before installing Kong. Kong Gateway generates a random admin password if this is not set. This password can not be recovered and you must reinstall Kong to set a new admin password.

What are my login credentials?

The Kong super admin username is kong_admin, and the password is the value set in env.password in values-cp.yaml.

Kong Manager shows a white screen

Ensure that env.admin_gui_api_url is set correctly in values-cp.yaml.