Operator Documentation

Kong Operator is the Kubernetes-native way to interact with Kong. Deploy data planes, configure Konnect, and more.

Deploy the Kong Operator

Check if your version of Kong Operator is supported

New features, bug fixes and breaking changes for Kong Operator

Learn about the various settings and configurations of the operator which can be tweaked using CLI flags.

Explore schemas of the available Custom Resources for Kong Operator

Understand which versions of Kubernetes and the Gateway API Kong Operator works with

Configure feature gates and controllers for Kong ControlPlane in Kong Operator

Configure Kong Operator to route outbound traffic through an HTTP proxy using standard Go environment variables.

Learn how to limit the namespaces that ControlPlane watches.

Deploy and configure Kong Gateway in Kubernetes using the standard Gateway API resources.

Deploy and configure Kong Gateway in Kubernetes using Kong-specific Custom Resource Definitions (CRDs) provided by Kong Operator.

Deploy Kong Event Gateway on Kubernetes with Kong Operator, Konnect, and Event Gateway CRDs.

Deploy Kong Event Gateway with a `LoadBalancer` Service and port-based broker mapping.

Deploy Kong Event Gateway behind a Kubernetes Gateway using TLS passthrough and SNI routing.

Install Kong Operator and prepare a Kubernetes cluster for Kong Event Gateway.

Understand how Kong Operator interacts with Gateway API resources

Customize your Kong Gateway deployments when using the Gateway resource

Learn how Kong Operator reconciles `Gateway` resources, automatically configuring listeners as needed

Provide your Kong Gateway license using the KongLicense CRD or as an environment variable

Deploy and validate Kong Event Gateway resources with Kong Operator

Customize the image used for Kong Gateway

Deploy sidecar containers alongside Kong Gateway using PodTemplateSpec

Learn how to use cert-manager to automatically provision and rotate TLS certificates for Kong Operator.

Learn how to configure HTTPS listeners and TLS termination for Kong Operator.

Use a custom CA certificate when generating Data Plane certificates for Konnect

Package and deploy custom Kong plugins as OCI images using the Kong Operator and reference them in Kong Gateway resources.

Configure Kong Operator to manage traditional Kubernetes Ingress resources.

Learn how to attach plugins to HTTPRoute resources using KongPluginBinding, ExtensionRef, or annotations.

Learn how to configure connection, read, and write timeouts and retry behavior on a Kubernetes Service using Kong Operator annotations.

Learn how to override the Host header that Kong Gateway sends to upstream services using the konghq.com/host-header annotation.

Learn how to customize load balancing behavior for a Kubernetes Service using the konghq.com/upstream-policy annotation and a KongUpstreamPolicy resource.

See which metrics Kong Operator exposes and learn how to authenticate using a ServiceAccount to scrape the values

Control the number of available pods during a rollout

Customize your ControlPlane and DataPlane deployments. Supports images, volume mounts, node affinity and more

Horizontally scale Kong Gateway based on CPU usage

Scale your Kubernetes workloads using latency information from Kong Gateway

Configure upstream behavior such as timeouts, retries, host header, and TLS by annotating Kubernetes Services exposed through an HTTPRoute.

Complete migration guide from Kong Operator (KGO) 1.6.x to Kong Operator (KO) 2.0.0.

Learn how to migrate your KonnectExtension resources to KonnectGatewayControlPlane before upgrading to KO 2.0.0.

How do I migrate from Kong Gateway Operator 1.4 to 1.5, taking in to account breaking changes?

Deploy a new version of Kong Operator using Helm

Automatically terminate existing pods as new ones become ready

Create a new Kong Gateway Service any time your deployment changes, then promote it to be live after testing

Complete migration guide from Kong Ingress Controller (KIC) to Kong Operator (KO) 2.0.0.

Inspect resource statuses to see detailed information about Kong Operator resources

Automatically register DataPlanes with Konnect by providing authentication credentials in KonnectExtension

Explore schemas of the available Custom Resources for Kong Operator

Define a Konnect Gateway control plane and bind it to your cluster using a `KonnectExtension`.

Provision a service and route in Konnect using Kubernetes CRDs.

Set up authentication between your Kubernetes cluster and Konnect using the `KonnectAPIAuthConfiguration` and `KonnectExtension` resources.

Secure an API using the `key-auth` plugin and credentials from a `KongConsumer`.

Use the `KongPlugin` CRD to configure proxy caching for a route or service.

Install the Kong Operator with Helm and enable Konnect CRD support.

Configure email settings, team access, and a custom domain for a Dev Portal with Kong Operator.

Configure a `PortalIdentityProviderRequest` for Dev Portal sign-in with Kong Operator.

Create a `Portal`, a `PortalPage`, and a `PortalCustomization` with Kong Operator.

Install Kong Operator and prepare a Kubernetes cluster for Konnect Dev Portal CRDs.

How does the Kong Operator reconciliation loop work?

How do I add additional metadata to entities managed by Kong Operator?

What is KongPluginBinding, and how does it interact with the konghq.com/plugins annotation?

How do I use cross namespace references with Kong Operator?

Create a Hybrid mode control plane in Konnect

Create a Control Plane, and a Control Plane Group that contains the Control Plane

Create a new Kong Ingress Controller Control Plane in Konnect

Reference an existing Hybrid mode Control Plane in Konnect

Provision TLS and CA certificates in Konnect using Kubernetes CRDs, and assign SNIs to TLS certificates.

Provision Consumers and manage Consumer Groups in Konnect using Kubernetes CRDs.

Provision a Data Plane client certificate in Konnect using the `KongDataPlaneClientCertificate` CRD.

Provision Keys and Key Sets in Konnect using CRDs, and associate Keys with Key Sets.

Provision and manage Gateway Services and Routes in Konnect using KGO custom resources.

Create a Kong Route that does not have an attached Service. Useful when used with the Lambda plugin.

Provision a Vault in Konnect using the KongVault CRD and configure it for use with your Control Plane.

Provision an Upstream and attach Targets to it in Konnect using Kubernetes CRDs.

Enable a plugin on a Route in Konnect using the KongPlugin and KongPluginBinding CRDs and configure it for use with your control plane.

Provision a Dedicated Cloud Gateway Data Plane group configuration in Konnect using the `KonnectCloudGatewayDataPlaneGroupConfiguration` CRD.

Provision a Dedicated Cloud Gateway Network in Konnect using the `KonnectCloudGatewayNetwork` CRD.

Learn how to use the KongReferenceGrant resource to use Konnect authentication configuration across namespaces.

Learn how to use the ReferenceGrant and KongReferenceGrant resources to reference a Secret across namespaces.

Ensure your Konnect control planes use predictable names to support references from other resources.

How do I find out why my resources aren't being reconciled against Konnect?

Explore schemas of the available Custom Resources for Kong Operator

Answers to common questions about managing Konnect entities using the Operator.

How do I migrate from Kong Gateway Operator 1.4 to 1.5, taking in to account breaking changes?

Learn how to migrate your KonnectExtension resources to KonnectGatewayControlPlane before upgrading to KO 2.0.0.