How to: Configure the Admin API with Kong Gateway on Kubernetes

Prerequisites

Series Prerequisites

This page is part of the Install Kong Gateway on-prem on Kubernetes series.

Complete the previous page, Install Kong Gateway on-prem with Helm before completing this page.

Kong Gateway is now running on Kubernetes. The Admin API is a NodePort service, which means it’s not publicly available. The proxy service is a LoadBalancer which provides a public address.

To make the admin API accessible without using kubectl port-forward, you can create an internal load balancer on your chosen cloud. This is required to use Kong Manager to view or edit your configuration.

Configure your Ingress Controller

To expose the Admin API, you need an Ingress Controller running in your cluster. Choose a provider and ensure that your Ingress controller is configured correctly:

You need the aws-load-balancer-controller installed in your cluster to configure Ingress resources on EKS.

After installing, check that your cluster is running the aws-load-balancer-controller:

kubectl get deployments.apps -n kube-system aws-load-balancer-controller

You need application-gateway-kubernetes-ingress installed in your cluster to configure Ingress resources on AKS.

After installing, check that your cluster is running the ingress-appgw-deployment:

kubectl get deployments.apps -n kube-system ingress-appgw-deployment

Clusters running GKE versions 1.18 and later automatically provision load balancers in response to Ingress resources being created.

GKE requires a BackendConfig resource to be created for Kong deployments to be marked as healthy.

Create a BackendConfig resource to configure health checks:

 echo "apiVersion: cloud.google.com/v1
    kind: BackendConfig
    metadata:
      name: kong-hc
      namespace: kong
    spec:
      healthCheck:
        checkIntervalSec: 15
        port: 8100
        type: HTTP
        requestPath: /status" | kubectl apply -f -

This BackendConfig is attached to the admin service using the annotations key in values-cp.yaml.

GKE provisions one load balancer per Ingress definition. Following this guide will result in multiple load balancers being created.

Set ingressController.enabled to true in your values-cp.yaml file to enable Kong Ingress Controller. When enabling the ingress controller, set env.publish_service to ensure that Kong Ingress Controller populates the address field in the managed Ingress resources.

You must also set ingressController.env.kong_admin_token to the value stored in env.password to enable communication between Kong Ingress Controller and the Kong Gateway Admin API:

ingressController:
     enabled: true
     env:
       publish_service: kong/kong-dp-kong-proxy
       kong_admin_token: kong_admin_password

Define Ingress annotations

Configure the admin section in values-cp.yaml. Replace example.com with your custom domain name.

If you are testing and don’t have a VPN set up for your VPC, you may change the alb.ingress.kubernetes.io/scheme annotation to internet-facing to add a public IP address. This is not recommended for long running deployments.

admin:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
     
     ingress:
       enabled: true
       hostname: admin.example.com
       path: /
       pathType: Prefix
       ingressClassName: alb
       annotations:
         alb.ingress.kubernetes.io/load-balancer-name: kong-alb-private
         alb.ingress.kubernetes.io/group.name: demo.kong-alb-private
         alb.ingress.kubernetes.io/target-type: instance
         alb.ingress.kubernetes.io/scheme: internal
         alb.ingress.kubernetes.io/healthcheck-path: /
         alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}]'

If you are testing and don’t have a VPN set up, you may change the appgw.ingress.kubernetes.io/use-private-ip annotation to false to add a public IP address. This is not recommended for long running deployments.

admin:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
     
     ingress:
       enabled: true
       hostname: admin.example.com
       path: /
       pathType: Prefix
       ingressClassName: azure-application-gateway
       annotations:
         appgw.ingress.kubernetes.io/use-private-ip: "true"

If you are testing and don’t have a VPN set up, you may change the kubernetes.io/ingress.class annotation to gce to add a public IP address. This is not recommended for long running deployments.

admin:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
     annotations:
       beta.cloud.google.com/backend-config: '{"default":"kong-hc"}'
     ingress:
       enabled: true
       hostname: admin.example.com
       path: /
       pathType: Prefix
       annotations:
         kubernetes.io/ingress.class: gce-internal

All endpoints proxied by Kong Ingress Controller will be publicly accessible. Use an authentication plugin to secure your API.

admin:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
     
     ingress:
       enabled: true
       hostname: admin.example.com
       path: /
       pathType: Prefix
       ingressClassName: kong

Helm upgrade

Run helm upgrade to update the release.

helm upgrade kong-cp kong/kong -n kong --values ./values-cp.yaml

Update DNS

Fetch the Ingress IP address and update your DNS records to point at the Ingress address. You can configure DNS manually, or use a tool like external-dns to automate DNS configuration.

kubectl get ingress -n kong kong-cp-kong-admin \
  -o jsonpath='{.spec.rules[0].host}{": "}{range .status.loadBalancer.ingress[0]}{@.ip}{@.hostname}{end}'

Configure the Admin API with Kong Gateway on Kubernetes