Adopt existing entities from Konnect

If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

1. The following Konnect items are required to complete this tutorial:
   • Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

2. Set the personal access token as an environment variable:

   export KONNECT_TOKEN='YOUR KONNECT TOKEN'
   

   Copied!

1. Add the Kong Helm charts:

   helm repo add kong https://charts.konghq.com
   helm repo update
   

   Copied!

2. Install Kong Operator using Helm:

   helm upgrade --install kong-operator kong/kong-operator -n kong-system \
     --create-namespace \
     --set image.tag=2.1.0 \
     --set env.ENABLE_CONTROLLER_KONNECT=true
   

   Copied!

   helm upgrade --install kong-operator kong/kong-operator -n kong-system \
     --create-namespace \
     --set image.tag=2.1.0
   

   Copied!

   If you want cert-manager to issue and rotate the admission and conversion webhook certificates, install cert-manager to your cluster and enable cert-manager integration by passing the following argument while installing, in the next step:

   --set global.webhooks.options.certManager.enabled=true
   

   Copied!

   If you do not enable this, the chart will generate and inject self-signed certificates automatically. We recommend enabling cert-manager to manage the lifecycle of these certificates.

   Kong Operator needs a certificate authority to sign the certificate for mTLS communication between the control plane and the data plane. This is handled automatically by the Helm chart. If you need to provide a custom CA certificate, refer to the certificateAuthority section in the values.yaml of the Helm chart to learn how to create and reference your own CA certificate.

This tutorial doesn’t require a license, but you can add one using KongLicense. This assumes that your license is available in ./license.json.

echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongLicense
metadata:
 name: kong-license
rawLicenseString: '$(cat ./license.json)'
" | kubectl apply -f -

This example requires an existing Konnect control plane and entities that we’ll then connect to our Kubernetes cluster. Let’s create these entities with the Konnect API.

Run the following command to create a control plane and save its ID to your environment:

CONTROL_PLANE_ID=$(curl -X POST "https://us.api.konghq.com/v2/control-planes" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "name": "gateway-control-plane"
     }' | jq -r ".id"
)

Create a Gateway Service:

SERVICE_ID=$(curl -X POST "https://us.api.konghq.com/v2/control-planes/$CONTROL_PLANE_ID/core-entities/services" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "name": "demo-service",
       "protocol": "http",
       "host": "httpbin.konghq.com",
       "path": "/anything"
     }' | jq -r ".id"
)

Create a Route:

ROUTE_ID=$(curl -X POST "https://us.api.konghq.com/v2/control-planes/$CONTROL_PLANE_ID/core-entities/routes" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "name": "demo-route",
       "paths": [
         "/anything"
       ],
       "service": {
         "id": "'$SERVICE_ID'"
       }
     }' | jq -r ".id"
)

Create a Rate Limiting plugin:

PLUGIN_ID=$(curl -X POST "https://us.api.konghq.com/v2/control-planes/$CONTROL_PLANE_ID/core-entities/plugins" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "name": "rate-limiting",
       "config": {
         "second": 5,
         "hour": 1000,
         "policy": "local"
       }
     }' | jq -r ".id"
)

To manage adopt entities, you first need to create a KonnectGatewayControlPlane resource that references our Konnect control plane:

echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha2
metadata:
  name: gateway-control-plane
  namespace: kong
spec:
  source: Mirror
  mirror:
    konnect:
      id: "'$CONTROL_PLANE_ID'"
  konnect:
    authRef:
      name: konnect-api-auth
' | kubectl apply -f -

kubectl get -n kong konnectgatewaycontrolplane gateway-control-plane \
  -o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jq

{
  "observedGeneration": 1,
  "reason": "Programmed",
  "status": "True",
  "type": "Programmed"
}