Cloud Gateways Data Plane Group Configurations

In this guide you’ll learn how to use the KonnectCloudGatewayDataPlaneGroupConfiguration custom resource to manage Kong Konnect Dedicated Cloud Gateways Data Plane Group Configurations natively from your Kubernetes cluster.

Prerequisites: Install Kong Gateway Operator and create a valid KonnectAPIAuthConfiguration and KonnectGatewayControlPlane in your cluster.

Install Kong Gateway Operator and create a valid KonnectAPIAuthConfiguration and KonnectGatewayControlPlane in your cluster.

Install Kong Gateway Operator

Update the Helm repository:

helm repo add kong https://charts.konghq.com
helm repo update kong

Install Kong Gateway Operator with Helm:

helm upgrade --install kgo kong/gateway-operator -n kong-system --create-namespace  \
  --set image.tag=1.5 \
  --set kubernetes-configuration-crds.enabled=true \
  --set env.ENABLE_CONTROLLER_KONNECT=true

You can wait for the operator to be ready using kubectl wait:

kubectl -n kong-system wait --for=condition=Available=true --timeout=120s deployment/kgo-gateway-operator-controller-manager

Create an access token in Konnect

You may create either a Personal Access Token (PAT) or a Service Account Token (SAT) in Konnect. Please refer to the Konnect authentication documentation for more information. You will need this token to create a KonnectAPIAuthConfiguration object that will be used by the Kong Gateway Operator to authenticate with Konnect APIs.

Create a Kong Konnect API auth configuration

Depending on your preferences, you can create a KonnectAPIAuthConfiguration object with the token specified directly in its spec or as a reference to a Kubernetes Secret. The serverURL field should be set to the Konnect API URL in a region where your Kong Konnect account is located. Please refer to the list of available API URLs for more information.

You can verify the KonnectAPIAuthConfiguration object was reconciled successfully by checking its status.

kubectl get konnectapiauthconfiguration konnect-api-auth

The output should look like this:

NAME               VALID   ORGID                                  SERVERURL
konnect-api-auth   True    <your-konnect-org-id>                  https://us.api.konghq.com

Create a Kong Gateway control plane

Creating the KonnectGatewayControlPlane object in your Kubernetes cluster will provision a Kong Konnect Gateway control plane in your Gateway Manager. The KonnectGatewayControlPlane CR API allows you to explicitly set a type of the Kong Gateway control plane, but if you don’t specify it, the default type is a Self-Managed Hybrid gateway control plane.

You can create one by applying the following YAML manifest:

echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: gateway-control-plane
  namespace: default
spec:
  name: gateway-control-plane # Name used to identify the Gateway Control Plane in Konnect
  cloud_gateway: true
  konnect:
    authRef:
      name: konnect-api-auth # Reference to the KonnectAPIAuthConfiguration object
  ' | kubectl apply -f -

You can see the status of the Gateway Control Plane by running:

kubectl get konnectgatewaycontrolplanes.konnect.konghq.com gateway-control-plane

If the Gateway Control Plane is successfully created, you should see the following output:

NAME                    PROGRAMMED   ID                                     ORGID
gateway-control-plane   True         <konnect-control-plane-id>             <your-konnect-ord-id>

Having that in place, you will be able to reference the gateway-control-plane in your Kong Konnect entities as their parent.

Create a Network

To use this CRD, you will need a Network. For detailed instructions, see the Create Cloud Gateways Network document.

If you have already created a network, you can refer to it by name later in this guide.

Create a Cloud Gateway Data Plane Group Configuration

Creating the KonnectCloudGatewayDataPlaneGroupConfiguration object in your Kubernetes cluster will provision a new Konnect Dedicated Cloud Gateway Data Plane Group Configuration.

You can refer to the KonnectCloudGatewayDataPlaneGroupConfiguration CRD API for all the available fields.

Note: Creating multiple Data Plane Group Configurations will cause overwriting each others configurations. There can only exist one Data Plane Group Configuration per one Cloud Gateway which sets the configuration for all the Data Plane Groups.

To create a KonnectCloudGatewayDataPlaneGroupConfiguration object you can use the following YAML manifest:

echo '
apiVersion: konnect.konghq.com/v1alpha1
kind: KonnectCloudGatewayDataPlaneGroupConfiguration
metadata:
  name: konnect-cg-dpconf
spec:
  api_access: private+public
  version: "3.10"
  dataplane_groups:
    - provider: aws
      region: eu-west-1
      networkRef:
        type: namespacedRef
        namespacedRef:
         name: konnect-network-1
      autoscale:
        type: static
        static:
          instance_type: small
          requested_instances: 2
      environment:
        - name: KONG_LOG_LEVEL
          value: debug
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
     name: gateway-control-plane
' | kubectl apply -f -

After creating the KonnectCloudGatewayDataPlaneGroupConfiguration you can check the status by running:

kubectl get konnectcloudgatewaydataplanegroupconfigurations.konnect.konghq.com konnect-cg-dpconf -o=jsonpath='{.status}' | yq -p json

Which should return the status of the Data Plane Group Configuration:

conditions:
  - lastTransitionTime: "2025-04-02T11:02:23Z"
    message: ""
    observedGeneration: 1
    reason: Programmed
    status: "True"
    type: Programmed
  - lastTransitionTime: "2025-04-02T10:31:15Z"
    message: Referenced ControlPlane <konnectNamespacedRef:gateway-control-plane> is programmed
    observedGeneration: 1
    reason: Valid
    status: "True"
    type: ControlPlaneRefValid
  - lastTransitionTime: "2025-04-02T10:31:15Z"
    message: KonnectAPIAuthConfiguration reference default/konnect-api-auth is resolved
    observedGeneration: 1
    reason: ResolvedRef
    status: "True"
    type: APIAuthResolvedRef
  - lastTransitionTime: "2025-04-02T10:31:15Z"
    message: referenced KonnectAPIAuthConfiguration default/konnect-api-auth is valid
    observedGeneration: 1
    reason: Valid
    status: "True"
    type: APIAuthValid
  - lastTransitionTime: "2025-04-02T11:02:22Z"
    message: Referenced KonnectCloudGatewayNetwork(s) are valid and programmed
    observedGeneration: 1
    reason: Valid
    status: "True"
    type: KonnectNetworkRefsValid
controlPlaneID: 22222222-2222-2222-2222-222222222222
dataplane_groups:
  - cloud_gateway_network_id: 19cb7627-1111-1111-1111-111111111111
    id: a94bb897-1111-1111-1111-111111111111
    provider: aws
    region: eu-west-1
    state: initializing
id: 35fe5b8b-1111-1111-1111-111111111111
organizationID: 8a6e97b1-b481-4fc2-8399-a59077076af6
serverURL: https://eu.api.konghq.tech

If one of the referenced networks is not ready yet, the status can look like this:

conditions:
  - lastTransitionTime: "2025-04-02T10:31:15Z"
    message: Some conditions have status set to False
    observedGeneration: 1
    reason: ConditionWithStatusFalseExists
    status: "False"
    type: Programmed
  - lastTransitionTime: "2025-04-02T10:31:15Z"
    message: Referenced ControlPlane <konnectNamespacedRef:gateway-control-plane> is programmed
    observedGeneration: 1
    reason: Valid
    status: "True"
    type: ControlPlaneRefValid
  - lastTransitionTime: "2025-04-02T10:31:15Z"
    message: KonnectAPIAuthConfiguration reference default/konnect-api-auth is resolved
    observedGeneration: 1
    reason: ResolvedRef
    status: "True"
    type: APIAuthResolvedRef
  - lastTransitionTime: "2025-04-02T10:31:15Z"
    message: referenced KonnectAPIAuthConfiguration default/konnect-api-auth is valid
    observedGeneration: 1
    reason: Valid
    status: "True"
    type: APIAuthValid
  - lastTransitionTime: "2025-04-02T10:31:15Z"
    message: 'Referenced KonnectCloudGatewayNetwork default/konnect-network-1: is not ready yet, current state: initializing'
    observedGeneration: 1
    reason: Invalid
    status: "False"
    type: KonnectNetworkRefsValid
controlPlaneID: 22222222-2222-2222-2222-222222222222

It will change when the network provisioning is finished.

Since creating a Data Plane Group Configuration can take some time, you can monitor its status by checking the dataplane_groups field. Data Plane Group Configurations receive this field when they are successfully provisioned in Konnect.

To check said status, you can run:

kubectl get konnectcloudgatewaydataplanegroupconfigurations.konnect.konghq.com eu-west-1 -o=jsonpath='{.status.dataplane_groups}' | yq -p json

Which should return the status of the provisioned Data Plane Group Configurations:

[
  {
    "cloud_gateway_network_id": "19cb7627-1111-1111-1111-111111111111",
    "egress_ip_addresses": [
      "18.111.11.111",
      "35.111.11.111",
      "18.111.11.111"
    ],
    "id": "a94bb897-1111-1111-1111-111111111111",
    "provider": "aws",
    "region": "eu-west-1",
    "state": "ready"
  }
]