Install Kong Operator using Kong’s kong-operator chart with --set env.ENABLE_CONTROLLER_AIGATEWAYDATAPLANE=true to enable the AI Gateway data plane controller, then store your Konnect credentials in a Kubernetes Secret.
If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.
Set the personal access token as an environment variable:
export KONNECT_TOKEN='YOUR KONNECT TOKEN'This guide walks through a complete Kong AI Gateway setup using Kong Operator and Konnect.
By the end of the series, you will have:
Create the namespace used throughout this series:
kubectl create namespace kongAdd the Kong Helm charts:
helm repo add kong https://charts.konghq.com
helm repo updateInstall Kong Operator using Helm:
helm upgrade --install kong-operator kong/kong-operator -n kong-system \
--create-namespace \
--set image.tag=2.3 \
--set env.ENABLE_CONTROLLER_KONNECT=true \
--set env.ENABLE_CONTROLLER_AIGATEWAYDATAPLANE=trueIf you want cert-manager to issue and rotate the admission and conversion webhook certificates, install cert-manager to your cluster and enable cert-manager integration by passing the following argument while installing, in the next step:
--set global.webhooks.options.certManager.enabled=trueIf you do not enable this, the chart will generate and inject self-signed certificates automatically. We recommend enabling cert-manager to manage the lifecycle of these certificates.
Kong Operator needs a certificate authority to sign the certificate for mTLS communication between the control plane and the data plane.
This is handled automatically by the Helm chart. If you need to provide a custom CA certificate, refer to the certificateAuthority section
in the values.yaml of the Helm chart to learn how to create and reference your own CA certificate.
Confirm the AI Gateway CRDs are registered in the cluster:
kubectl get crd | grep -E "aigateway|aigatewaydataplane"You should see entries for konnectaigateways, aigatewaymodelproviders, aigatewaymodels, aigatewaypolicies, aigatewayauthstrategies, aigatewayconsumers, aigatewayconsumercredentials, aigatewayconsumergroups, aigatewayagents, aigatewaydataplanecertificates, and aigatewaydataplanes.