Multi-tenancy in Kong Operator means running multiple isolated Kong Gateway instances — each with their own routing configuration, data plane, and namespace scope — on the same Kubernetes cluster, managed by a single Kong Operator installation.
Common use cases include separating a public-facing API gateway from an internal one, or giving different teams independent gateway instances without requiring separate clusters. For a step-by-step walkthrough, see Deploy multiple isolated gateways.
Each tenant is represented by a Gateway, provisioned using three resources:
GatewayConfiguration: A Kong-specific resource that configures the control plane and data plane options for a gateway, such as the proxy image, environment variables, and namespace watch scope.GatewayClass: A cluster-scoped Gateway API resource that registers Kong Operator as the controller for gateways of this class. It references the GatewayConfiguration via parametersRef.Gateway: A namespaced Gateway API resource that declares a gateway instance. It references the GatewayClass via gatewayClassName, which is how Kong Operator associates it with the correct GatewayConfiguration.For each Gateway, Kong Operator creates:
Multiple Gateway resources can coexist in the same cluster. The resulting in-memory KIC instances and data plane Pods are independent of each other. A single Kong Operator installation manages them all.
By default, each in-memory KIC instance watches all namespaces for Gateway API resources (HTTPRoute, GRPCRoute, etc.). Without additional configuration, one tenant’s KIC would also process another tenant’s routes, so namespace isolation is required for multi-tenancy.
Set watchNamespaces on GatewayConfiguration.spec.controlPlaneOptions to restrict each gateway’s in-memory KIC to its own namespace. For the full field reference, type options, WatchNamespaceGrant configuration, and operator-level scoping, see Limiting namespaces watched by ControlPlane.