Install Kong Operator for multi-tenancy

Uses: Kong Operator

Incompatible with

konnect

Prerequisites

Kong Gateway Enterprise license

Save your Kong Gateway Enterprise license as license.json in your current working directory. If you don’t have a license, contact your Kong representative.

This series deploys two independent Kong Gateway instances — one public-facing, one private — on the same cluster using a single Kong Operator installation. Each gateway is scoped to its own namespace so that its in-memory KIC only processes routes from that namespace.

The following diagram shows the end state you’ll build across this series:

 
flowchart TB
  subgraph cluster["Kubernetes Cluster"]
    subgraph sys["kong-system"]
      KO["Kong Operator\n(KongLicense)"]
    end

    subgraph pub["kong-gw-public"]
      ConfigPub["GatewayConfiguration\nwatchNamespaces: own"]
      GWPub["Gateway: gw-public"]
      DPPub["Data plane Pod"]
      SvcPub["echo service\nHTTPRoute /echo"]
    end

    subgraph priv["kong-gw-private"]
      ConfigPriv["GatewayConfiguration\nwatchNamespaces: own"]
      GWPriv["Gateway: gw-private"]
      DPPriv["Data plane Pod"]
      SvcPriv["echo service\nHTTPRoute /echo"]
    end

    KO -->|manages| GWPub
    KO -->|manages| GWPriv
    ConfigPub -.->|configures| GWPub
    ConfigPriv -.->|configures| GWPriv
    GWPub -->|provisions| DPPub
    GWPriv -->|provisions| DPPriv
    DPPub -->|routes traffic to| SvcPub
    DPPriv -->|routes traffic to| SvcPriv
  end

Create namespaces

Create the system namespace and the two tenant namespaces:

kubectl create namespace kong-system
kubectl create namespace kong-gw-public
kubectl create namespace kong-gw-private

Copied!