Enable Kong Manager with Kong Gateway on Kubernetes

Uses: Kong Gateway

Deployment Platform:

Prerequisites

Series Prerequisites

This page is part of the Install Kong Gateway on-prem on Kubernetes series.

Complete the previous page, Configure the Admin API with Kong Gateway on Kubernetes before completing this page.

Kong Manager is the graphical user interface (GUI) for Kong Gateway. It uses the Kong Admin API under the hood to administer and control Kong Gateway.

Kong’s Admin API must be accessible over HTTP from your local machine to use Kong Manager

Installation

Kong Manager is served from the same node as the Admin API. To enable Kong Manager, make the following changes to your values-cp.yaml file.

Set admin_gui_url, admin_gui_api_url and admin_gui_session_conf under the env key:

env:
  admin_gui_url: http://manager.example.com
  admin_gui_api_url: http://admin.example.com
  # Change the secret and set cookie_secure to true if using an HTTPS endpoint
  admin_gui_session_conf: '{"secret":"secret","storage":"kong","cookie_secure":false}'

Replace example.com in the configuration with your domain.

Enable Kong Manager authentication under the enterprise key:

enterprise:
  rbac:
    enabled: true
    admin_gui_auth: basic-auth

Define Ingress annotations

Configure the manager section in values-cp.yaml. Replace example.com with your custom domain name.

If you are testing and don’t have a VPN set up for your VPC, you may change the alb.ingress.kubernetes.io/scheme annotation to internet-facing to add a public IP address. This is not recommended for long running deployments.

manager:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
     
     ingress:
       enabled: true
       hostname: manager.example.com
       path: /
       pathType: Prefix
       ingressClassName: alb
       annotations:
         alb.ingress.kubernetes.io/load-balancer-name: kong-alb-private
         alb.ingress.kubernetes.io/group.name: demo.kong-alb-private
         alb.ingress.kubernetes.io/target-type: instance
         alb.ingress.kubernetes.io/scheme: internal
         alb.ingress.kubernetes.io/healthcheck-path: /
         alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}]'

If you are testing and don’t have a VPN set up, you may change the appgw.ingress.kubernetes.io/use-private-ip annotation to false to add a public IP address. This is not recommended for long running deployments.

manager:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
     
     ingress:
       enabled: true
       hostname: manager.example.com
       path: /
       pathType: Prefix
       ingressClassName: azure-application-gateway
       annotations:
         appgw.ingress.kubernetes.io/use-private-ip: "true"

If you are testing and don’t have a VPN set up, you may change the kubernetes.io/ingress.class annotation to gce to add a public IP address. This is not recommended for long running deployments.

manager:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
     annotations:
       beta.cloud.google.com/backend-config: '{"default":"kong-hc"}'
     ingress:
       enabled: true
       hostname: manager.example.com
       path: /
       pathType: Prefix
       annotations:
         kubernetes.io/ingress.class: gce-internal

All endpoints proxied by Kong Ingress Controller will be publicly accessible. Use an authentication plugin to secure your API.

manager:
     enabled: true
     http:
       enabled: true
     tls:
       enabled: false
     
     ingress:
       enabled: true
       hostname: manager.example.com
       path: /
       pathType: Prefix
       ingressClassName: kong

Helm upgrade

Run helm upgrade to update the release.

helm upgrade kong-cp kong/kong -n kong --values ./values-cp.yaml

Update DNS

Fetch the Ingress IP address and update your DNS records to point at the Ingress address. You can configure DNS manually, or use a tool like external-dns to automate DNS configuration.

kubectl get ingress -n kong kong-cp-kong-manager \
  -o jsonpath='{.spec.rules[0].host}{": "}{range .status.loadBalancer.ingress[0]}{@.ip}{@.hostname}{end}'

Testing

Visit the URL in env.admin_gui_url in a web browser to see the Kong Manager log in page. The default username is kong_admin, and the password is the value you set in env.password when installing the Kong Gateway control plane in the previous step.

FAQs

I can’t log in to Kong Manager.

Check that env.password was set in values-cp.yaml before installing Kong. Kong Gateway generates a random admin password if this is not set. This password can not be recovered and you must reinstall Kong to set a new admin password.

The Kong super admin username is kong_admin, and the password is the value set in env.password in values-cp.yaml.

Kong Manager shows a white screen.

Ensure that env.admin_gui_api_url is set correctly in values-cp.yaml.

← Previous 2. Configure the Admin API