You are browsing documentation for an older version. See the latest documentation here.

Getting started with the Kong Ingress Controller

Overview

Deploy an upstream HTTP application, create a configuration group, add a route, and add a plugin using Kong Gateway and Kong Ingress Controller.

Installation

Follow the deployment documentation to install the Kong Ingress Controller on the Kubernetes cluster.

Installing the Gateway APIs

If you wish to use the Gateway APIs examples, follow the supplemental Gateway APIs installation instructions.

Testing connectivity to Kong Gateway

Ensure that the PROXY_IP environment variable is set to contain the IP address or URL pointing to Kong Gateway. The deployment guide that you used to install the Kong Ingress Controller on the Kubernetes cluster provides the instructions to configure this environment variable.

If everything is set correctly, a request to Kong Gateway returns a HTTP 404 Not Found status code:

curl -i $PROXY_IP

The results should look like this:

HTTP/1.1 404 Not Found
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 48
X-Kong-Response-Latency: 0
Server: kong/3.0.0

{"message":"no Route matched with those values"}

This is expected because Kong Gateway doesn’t know how to proxy the request yet.

Deploy an echo service

To proxy requests, you need an upstream application to send a request to. Deploying this echo server provides a simple application that returns information about the Pod it’s running in:

kubectl apply -f https://docs.konghq.com/assets/kubernetes-ingress-controller/examples/echo-service.yaml

The results should look like this:

service/echo created
deployment.apps/echo created

Create a configuration group

Ingress and Gateway APIs controllers need a configuration that indicates which set of routing configuration they should recognize. This allows multiple controllers to coexist in the same cluster. Before creating individual routes, you need to create a class configuration to associate routes with:

Gateway API

Ingress

echo "
---

apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
  name: kong
spec:
  controllerName: konghq.com/kic-gateway-controller
---

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: kong
  annotations:
    konghq.com/gateway-unmanaged: kong/kong-proxy
spec:
  gatewayClassName: kong
  listeners:
  - name: proxy
    port: 80
    protocol: HTTP
" | kubectl apply -f -

The results should look like this:

gatewayclass.gateway.networking.k8s.io/kong created
gateway.gateway.networking.k8s.io/kong created

Official distributions of Kong Ingress Controller come with a kong IngressClass by default. If kubectl get ingressclass kong does not return a not found error, you can skip this command.

echo "
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: kong
spec:
  controller: ingress-controllers.konghq.com/kong
" | kubectl apply -f -

The results should look like this:

ingressclass.networking.k8s.io/kong configured

After the controller has acknowledged the Gateway, it shows the proxy IP and its status:

kubectl get gateway kong

The results should look like this:

NAME   CLASS   ADDRESS        READY   AGE
kong   kong    203.0.113.42   True    4m46s

Kong Ingress Controller recognizes the kong IngressClass and konghq.com/kic-gateway-controller GatewayClass by default. Setting the CONTROLLER_INGRESS_CLASS or CONTROLLER_GATEWAY_API_CONTROLLER_NAME environment variable to another value overrides these defaults.

Add routing configuration

Create routing configuration to proxy /echo requests to the echo server:

Gateway API

Ingress

echo "
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: echo
  annotations:
    konghq.com/strip-path: 'true'
spec:
  parentRefs:
  - name: kong
  hostnames:
  - 'kong.example'
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /echo
    backendRefs:
    - name: echo
      kind: Service
      port: 1027
" | kubectl apply -f -

echo "
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echo
  annotations:
    konghq.com/strip-path: 'true'
spec:
  ingressClassName: kong
  rules:
  - host: kong.example
    http:
      paths:
      - path: /echo
        pathType: ImplementationSpecific
        backend:
          service:
            name: echo
            port:
              number: 1027
" | kubectl apply -f -

The results should look like this:

      Gateway API
    
      Ingress
    
httproute.gateway.networking.k8s.io/echo created
ingress.networking.k8s.io/echo created

Test the routing rule:

curl -i -H 'Host:kong.example' $PROXY_IP/echo

The results should look like this:

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 140
Connection: keep-alive
Date: Fri, 21 Apr 2023 12:24:55 GMT
X-Kong-Upstream-Latency: 0
X-Kong-Proxy-Latency: 1
Via: kong/3.2.2

Welcome, you are connected to node docker-desktop.
Running on Pod echo-7f87468b8c-tzzv6.
In namespace default.
With IP address 10.1.0.237.
...

If everything is deployed correctly, you should see the above response. This verifies that Kong Gateway can correctly route traffic to an application running inside Kubernetes.

Add TLS configuration

The routing configuration can include a certificate to present when clients connect over HTTPS. This is not required, as Kong Gateway will serve a default certificate if it cannot find another, but including TLS configuration along with routing configuration is typical.

Create a test certificate for the kong.example hostname.

      OpenSSL 1.1.1
    

      OpenSSL 0.9.8
    
openssl req -subj '/CN=kong.example' -new -newkey rsa:2048 -sha256 \
  -days 365 -nodes -x509 -keyout server.key -out server.crt \
  -addext "subjectAltName = DNS:kong.example" \
  -addext "keyUsage = digitalSignature" \
  -addext "extendedKeyUsage = serverAuth" 2> /dev/null;
  openssl x509 -in server.crt -subject -noout
openssl req -subj '/CN=kong.example' -new -newkey rsa:2048 -sha256 \
  -days 365 -nodes -x509 -keyout server.key -out server.crt \
  -extensions EXT -config <( \
   printf "[dn]\nCN=kong.example\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:kong.example\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth") 2>/dev/null;
  openssl x509 -in server.crt -subject -noout

The results should look like this:

      OpenSSL 1.1.1
    
      OpenSSL 0.9.8
    
subject=CN = kong.example
subject=CN = kong.example

Older OpenSSL versions, including the version provided with OS X Monterey, require using the alternative version of this command.

Create a Secret containing the certificate.

 kubectl create secret tls kong.example --cert=./server.crt --key=./server.key

The results should look like this:

 secret/kong.example created

Update your routing configuration to use this certificate.

      Ingress
    

      Gateway API
    
kubectl patch --type json ingress echo -p='[{
    "op":"add",
	"path":"/spec/tls",
	"value":[{
        "hosts":["kong.example"],
		"secretName":"kong.example"
    }]
}]'
kubectl patch --type=json gateway kong -p='[{
    "op":"add",
    "path":"/spec/listeners/-",
    "value":{
        "name":"proxy-ssl",
        "port":443,
        "protocol":"HTTPS",
        "tls":{
            "certificateRefs":[{
                "group":"",
                "kind":"Secret",
                "name":"kong.example"
            }]
        }
    }
}]'

The results should look like this:

      Ingress
    
      Gateway API
    
ingress.networking.k8s.io/echo patched
gateway.gateway.networking.k8s.io/kong patched

Send requests to verify if the configured certificate is served.

 curl -ksv https://kong.example/echo --resolve kong.example:443:$PROXY_IP 2>&1 | grep -A1 "certificate:"

The results should look like this:

 * Server certificate:
 *  subject: CN=kong.example

Using plugins on Ingress / Gateway API Routes

Setup a KongPlugin resource.

 echo "
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin
 metadata:
   name: request-id
 config:
   header_name: my-request-id
   echo_downstream: true
 plugin: correlation-id
 " | kubectl apply -f -

The results should look like this:

 kongplugin.configuration.konghq.com/request-id created

Update your route configuration to use the new plugin.

      Ingress
    
      Gateway API
    
kubectl annotate ingress echo konghq.com/plugins=request-id
kubectl annotate httproute echo konghq.com/plugins=request-id

The results should look like this:

      Ingress
    
      Gateway API
    
ingress.networking.k8s.io/echo annotated
httproute.gateway.networking.k8s.io/echo annotated

Kong now applies your plugin configuration to all routes associated with this resource.

To verify, send another request through the proxy.

curl -i http://kong.example/echo --resolve kong.example:80:$PROXY_IP

The results should look like this:

HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Thu, 10 Nov 2022 22:33:14 GMT
Server: echoserver
my-request-id: ea87894d-7f97-4710-84ae-cbc608bb8107#2
X-Kong-Upstream-Latency: 0
X-Kong-Proxy-Latency: 0
Via: kong/3.1.1
    
Hostname: echo-fc6fd95b5-6lqnc

Pod Information:
	node name:	kind-control-plane
	pod name:	echo-fc6fd95b5-6lqnc
	pod namespace:	default
	pod IP:	10.244.0.9
...
Request Headers:
    ...
	my-request-id=ea87894d-7f97-4710-84ae-cbc608bb8107#2
...

Requests that match the echo Ingress or HTTPRoute now include a my-request-id header with a unique ID in both their request headers upstream and their response headers downstream.

Using plugins on Services

Kong can also apply plugins to Services. This allows you execute the same plugin configuration on all requests to that Service, without configuring the same plugin on multiple Ingresses.

Create a KongPlugin resource.

 echo "
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin
 metadata:
   name: rl-by-ip
 config:
   minute: 5
   limit_by: ip
   policy: local
 plugin: rate-limiting
 " | kubectl apply -f -

The results should look like this:

 kongplugin.configuration.konghq.com/rl-by-ip created

Apply the konghq.com/plugins annotation to the Kubernetes Service that needs rate-limiting.
```
 kubectl annotate service echo konghq.com/plugins=rl-by-ip
```
The results should look like this:
```
 service/echo annotated
```
Kong now enforces a rate limit to requests proxied to this Service.

To verify, send a request.

 curl -i http://kong.example/echo --resolve kong.example:80:$PROXY_IP

The results should look like this:

 HTTP/1.1 200 OK
 Content-Type: text/plain; charset=UTF-8
 Transfer-Encoding: chunked
 Connection: keep-alive
 X-RateLimit-Remaining-Minute: 4
 RateLimit-Limit: 5
 RateLimit-Remaining: 4
 RateLimit-Reset: 13
 X-RateLimit-Limit-Minute: 5
 Date: Thu, 10 Nov 2022 22:47:47 GMT
 Server: echoserver
 my-request-id: ea87894d-7f97-4710-84ae-cbc608bb8107#3
 X-Kong-Upstream-Latency: 1
 X-Kong-Proxy-Latency: 1
 Via: kong/3.1.1

 Hostname: echo-fc6fd95b5-6lqnc
 Pod Information:
 	node name:	kind-control-plane
 	pod name:	echo-fc6fd95b5-6lqnc
 	pod namespace:	default
 	pod IP:	10.244.0.9
 ...

Next steps

To learn how to secure proxied routes, see the ACL and JWT Plugins Guide.
The External Services Guide explains how to proxy services outside of your Kubernetes cluster.
Gateway API is a set of resources for configuring networking in Kubernetes. The Kong Ingress Controller supports Gateway API by default. To learn how to use Gateway API supported by the Kong Ingress Controller, see Using Gateway API.