Installing Kong Operator creates cluster-scoped resources, such as CRDs and RBAC rules, so a namespace-scoped account isn’t enough. This page lists the permissions you need to install Kong Operator and manage its resources, and the permissions Kong Operator itself needs.
Permissions required for Kong Operator
Uses:
Kong Operator
Related Documentation
Related Resources
Installing Kong Operator
You need write access to the following resources to install Kong Operator:
|
Resource Kind |
Resource APIVersion |
Resource scope |
Purpose |
|---|---|---|---|
CustomResourceDefinition
|
apiextensions.k8s.io/v1
|
Cluster | Install Kong Operator and Gateway API CRDs |
ClusterRole
|
rbac.authorization.k8s.io/v1
|
Cluster | Grant Kong Operator access to the resources it manages |
ClusterRoleBinding
|
rbac.authorization.k8s.io/v1
|
Cluster | Bind the RBAC rules to the Kong Operator ServiceAccount |
Role
|
rbac.authorization.k8s.io/v1
|
Namespaced | Enable leader election |
RoleBinding
|
rbac.authorization.k8s.io/v1
|
Namespaced | Bind the leader election role to the Kong Operator ServiceAccount |
Deployment
|
apps/v1
|
Namespaced | Run Kong Operator |
Service
|
v1
|
Namespaced | Expose the webhook and metrics endpoints |
ServiceAccount
|
v1
|
Namespaced | Provide an identity for the Kong Operator Pods |
Secret
|
v1
|
Namespaced | Store TLS certificates and configuration |
ValidatingWebhookConfiguration
|
admissionregistration.k8s.io/v1
|
Cluster | Configure the validating webhook |
ValidatingAdmissionPolicy
|
admissionregistration.k8s.io/v1
|
Cluster | Enforce validation policies on managed resources |
ValidatingAdmissionPolicyBinding
|
admissionregistration.k8s.io/v1
|
Cluster | Bind validation policies to the managed resources |
Optional resources
The following resources are optional. You need write access to them only when you use cert-manager for webhook certificates:
|
Resource Kind |
Resource APIVersion |
Resource Scope |
Purpose |
|---|---|---|---|
Certificate
|
cert-manager.io/v1
|
Namespaced | Manage TLS certificates when using cert-manager for webhook certificates |
Issuer
|
cert-manager.io/v1
|
Namespaced | Issue the TLS certificates when using cert-manager for webhook certificates |
Managing Kong Operator resources
To create and manage Kong Operator resources, you need write access to the Custom Resources in the following API groups:
|
API group |
Purpose |
|---|---|
gateway-operator.konghq.com
|
Deploy and manage Kong Gateway instances in-cluster (for example, GatewayConfiguration, ControlPlane, DataPlane)
|
konnect.konghq.com
|
Configure Konnect resources from Kubernetes (for example, KonnectGatewayControlPlane, KonnectAPIAuthConfiguration)
|
configuration.konghq.com
|
Configure Kong entities and policies (for example, KongService, KongRoute, KongPlugin, KongConsumer)
|
aiconfiguration.konghq.com
|
Configure AI Gateway resources |
aigateway.konghq.com
|
Deploy AI Gateway instances |
eventgateway.konghq.com
|
Deploy Kong Event Gateway resources |
mcp.konghq.com
|
Deploy MCP Server resources |
gateway.networking.k8s.io
|
Standard Gateway API resources (Gateway, HTTPRoute)
|
For the complete list of Custom Resources, see Custom resource definitions.
Kong Operator ServiceAccount permissions
The Kong Operator ServiceAccount needs a set of permissions to reconcile the resources it manages.
The Helm chart creates the required ClusterRole and ClusterRoleBinding automatically, so you don’t need to manage them manually.
The rules are generated from the Kong Operator source. They change between releases as new features are added. The following table summarizes the access patterns:
|
Access |
Resources |
|---|---|
create, delete, get, list, patch, update, watch
|
Core resources (ConfigMap, Secret, Service, and ServiceAccount), Deployment, Gateway API Gateway and HTTPRoute, the Kong Custom Resources that Kong Operator manages, Certificate, HorizontalPodAutoscaler, PodDisruptionBudget, NetworkPolicy, Role, RoleBinding, and Lease
|
get, list, watch
|
Reference and discovery resources such as Pod, Namespace, Node, Ingress, GatewayClass, and Kong Custom Resources consumed as inputs
|
patch, update on status and finalizers subresources
|
All the Custom Resources that Kong Operator manages |
Kong Operator also creates namespace-scoped RBAC rules itself so that the Gateways it deploys can access the resources they need.
For the complete set of rules, see the ClusterRole template in the Kong Operator chart.