Deploy the private gateway

As with the public gateway, controlPlaneOptions.watchNamespaces.type: own restricts the in-memory KIC to watch only the kong-gw-private namespace.

echo '
kind: GatewayConfiguration
apiVersion: gateway-operator.konghq.com/v2beta1
metadata:
  name: gw-private
  namespace: kong-gw-private
spec:
  dataPlaneOptions:
    deployment:
      podTemplateSpec:
        spec:
          containers:
          - name: proxy
            image: kong/kong-gateway:3.15
  controlPlaneOptions:
    watchNamespaces:
      type: own
' | kubectl apply -f -

1. Create a GatewayClass that references the GatewayConfiguration above:

   echo '
   kind: GatewayClass
   apiVersion: gateway.networking.k8s.io/v1
   metadata:
     name: gw-private
   spec:
     controllerName: konghq.com/gateway-operator
     parametersRef:
       group: gateway-operator.konghq.com
       kind: GatewayConfiguration
       name: gw-private
       namespace: kong-gw-private
   ' | kubectl apply -f -

   Copied!

2. Wait for Kong Operator to accept the GatewayClass:

   kubectl wait --for=condition=Accepted=True gatewayclass/gw-private --timeout=60s

   Copied!

1. Create the Gateway resource in the kong-gw-private namespace. The private gateway uses port 8080 to avoid a host-port conflict with the public gateway on single-node clusters (such as OrbStack, k3s, or kind) where each LoadBalancer service binds a host port.

   echo '
   kind: Gateway
   apiVersion: gateway.networking.k8s.io/v1
   metadata:
     name: gw-private
     namespace: kong-gw-private
   spec:
     gatewayClassName: gw-private
     listeners:
     - name: http
       protocol: HTTP
       port: 8080
   ' | kubectl apply -f -

   Copied!

2. Wait for the gateway to be programmed:

   kubectl wait --for=condition=Programmed=True gateway/gw-private -n kong-gw-private --timeout=120s

   Copied!

Verify the private gateway was reconciled successfully:

kubectl get -n kong-gw-private gateway gw-private \
  -o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jq

{
  "observedGeneration": 1,
  "reason": "Programmed",
  "status": "True",
  "type": "Programmed"
}