helm upgrade --install kong-operator kong/kong-operator -n kong-system \
--create-namespace \
--set image.tag=2.3 \Proxy UDP traffic using UDPRoute
Uses:
Kong Operator
Incompatible with
konnect
Related Documentation
Minimum Version
Kong Operator - 2.3
TL;DR
Prerequisites
Kong Operator running (with an Enterprise license)
-
Add the Kong Helm charts:
helm repo add kong https://charts.konghq.com helm repo update -
Install Kong Operator using Helm:
If you want cert-manager to issue and rotate the admission and conversion webhook certificates, install cert-manager to your cluster and enable cert-manager integration by passing the following argument while installing, in the next step:
--set global.webhooks.options.certManager.enabled=trueIf you do not enable this, the chart will generate and inject self-signed certificates automatically. We recommend enabling cert-manager to manage the lifecycle of these certificates. Kong Operator needs a certificate authority to sign the certificate for mTLS communication between the control plane and the data plane. This is handled automatically by the Helm chart. If you need to provide a custom CA certificate, refer to the
certificateAuthoritysection in thevalues.yamlof the Helm chart to learn how to create and reference your own CA certificate.
Apply a KongLicense. This assumes that your license is available in ./license.json
echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongLicense
metadata:
name: kong-license
rawLicenseString: '$(cat ./license.json)'
" | kubectl apply -f -UDPRoute is a Kubernetes Gateway API resource for routing UDP traffic by port. This guide shows how to configure Kong Operator to proxy UDP traffic to a backend Service.
Create the kong namespace
Create the kong namespace in your Kubernetes cluster, which is where the demo will run:
kubectl create namespace kongConfigure the Gateway
Create a GatewayConfiguration, GatewayClass, and Gateway with an HTTP listener:
echo '
apiVersion: gateway-operator.konghq.com/v2beta1
kind: GatewayConfiguration
metadata:
name: kong-gateway-configuration
namespace: kong
spec:
dataPlaneOptions:
deployment:
podTemplateSpec:
spec:
containers:
- image: kong/kong-gateway:3.15
name: proxy
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: kong-udp
spec:
controllerName: konghq.com/gateway-operator
parametersRef:
group: gateway-operator.konghq.com
kind: GatewayConfiguration
name: kong-gateway-configuration
namespace: kong
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: kong-udp-gateway
namespace: kong
spec:
gatewayClassName: kong-udp
listeners:
- name: http
port: 80
protocol: HTTP' | kubectl apply -f -Deploy a UDP backend
Install the tftp Service, a small TFTP test server that listens over UDP:
kubectl apply -f https://developer.konghq.com/manifests/kic/udp-service.yaml -n kongRoute UDP traffic
-
Re-apply the
kong-udp-gatewayGateway with an additionalUDPlistener:Warning: Applying this Gateway replaces the listener list. Include every listener you want to keep.
echo 'apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: kong-udp-gateway namespace: kong spec: gatewayClassName: kong-udp listeners: - name: http port: 80 protocol: HTTP - name: stream9999 port: 9999 protocol: UDP allowedRoutes: namespaces: from: All' | kubectl apply -f - -
Create a
UDPRoute:echo "apiVersion: gateway.networking.k8s.io/v1 kind: UDPRoute metadata: name: tftp namespace: kong spec: parentRefs: - name: kong-udp-gateway sectionName: stream9999 rules: - backendRefs: - name: tftp port: 9999 " | kubectl apply -f -
This configuration instructs Kong Gateway to forward UDP traffic it receives on port 9999 to the tftp Service on port 9999.
Validate
-
Wait for the Gateway to be programmed:
kubectl wait gateway/kong-udp-gateway -n kong \ --for=condition=Programmed=True \ --timeout=5m -
Get the Gateway’s external IP:
export PROXY_IP=$(kubectl get gateway kong-udp-gateway -n kong -o jsonpath='{.status.addresses[0].value}') echo $PROXY_IP -
Send a TFTP request through the proxy:
curl -s tftp://$PROXY_IP:9999/helloThe results should look like this:
Hostname: tftp-5849bfd46f-nqk9x Request Information: client_address=127.0.0.1 client_port=39364 real path=/hello request_scheme=tftp