Deploy test services

1. Deploy the echo service in both tenant namespaces:

   kubectl apply -f https://developer.konghq.com/manifests/kic/echo-service.yaml -n kong-gw-public
   kubectl apply -f https://developer.konghq.com/manifests/kic/echo-service.yaml -n kong-gw-private

   Copied!

2. Wait for both deployments to be ready:

   kubectl rollout status deployment/echo -n kong-gw-public --timeout=60s
   kubectl rollout status deployment/echo -n kong-gw-private --timeout=60s

   Copied!

Create an HTTPRoute in the kong-gw-public namespace pointing to the echo service:

echo '
kind: HTTPRoute
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: echo
  namespace: kong-gw-public
spec:
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: gw-public
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /echo
    backendRefs:
    - name: echo
      port: 1027
' | kubectl apply -f -

Create two HTTPRoute resources in the kong-gw-private namespace. One is equivalent to the one in the kong-gw-public namespace, and the other is a /private path in kong-gw-private only:

echo '
kind: HTTPRoute
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: echo
  namespace: kong-gw-private
spec:
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: gw-private
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /echo
    backendRefs:
    - name: echo
      port: 1027
---
kind: HTTPRoute
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: private-only
  namespace: kong-gw-private
spec:
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: gw-private
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /private
    backendRefs:
    - name: echo
      port: 1027
' | kubectl apply -f -

1. Get the external IP address for each gateway:

   export PUBLIC_GW_IP=$(kubectl get gateway gw-public -n kong-gw-public \
     -o jsonpath='{.status.addresses[0].value}')
   echo $PUBLIC_GW_IP
   export PRIVATE_GW_IP=$(kubectl get gateway gw-private -n kong-gw-private \
     -o jsonpath='{.status.addresses[0].value}')
   echo $PRIVATE_GW_IP

   Copied!

2. The public gateway listens on port 80 and the private gateway on port 8080. Check that both return a 200 response on /echo:

   curl "$PUBLIC_GW_IP/echo" \
        --no-progress-meter --fail-with-body 

   Copied!

   curl "$PRIVATE_GW_IP:8080/echo" \
        --no-progress-meter --fail-with-body 

   Copied!

3. Send a request to the Route that only exists in kong-gw-private to verify that the public gateway has no knowledge of it:

   curl "$PRIVATE_GW_IP:8080/private" \
        --no-progress-meter --fail-with-body 

   Copied!

   curl "$PUBLIC_GW_IP/private" \
        --no-progress-meter --fail-with-body 

   Copied!

The public gateway returns 404 because its in-memory KIC only watches kong-gw-public. The private-only HTTPRoute lives in kong-gw-private, so the public KIC never processes it and never programs it into the public data plane. No matter what routes are deployed in kong-gw-private, they are completely invisible to gw-public — and vice versa. This is namespace isolation working as intended.