Cloud Gateways Networks

In this guide you’ll learn how to use the KonnectCloudGatewayTransitGateway custom resource to manage Kong Konnect Dedicated Cloud Gateways TransitGateways natively from your Kubernetes cluster.

Prerequisites: Install Kong Gateway Operator and create a valid KonnectAPIAuthConfiguration and KonnectGatewayControlPlane in your cluster.

Install Kong Gateway Operator and create a valid KonnectAPIAuthConfiguration and KonnectGatewayControlPlane in your cluster.

Install Kong Gateway Operator

Update the Helm repository:

helm repo add kong https://charts.konghq.com
helm repo update kong

Install Kong Gateway Operator with Helm:

helm upgrade --install kgo kong/gateway-operator -n kong-system --create-namespace  \
  --set image.tag=1.6 \
  --set kubernetes-configuration-crds.enabled=true \
  --set env.ENABLE_CONTROLLER_KONNECT=true

You can wait for the operator to be ready using kubectl wait:

kubectl -n kong-system wait --for=condition=Available=true --timeout=120s deployment/kgo-gateway-operator-controller-manager

Create an access token in Konnect

You may create either a Personal Access Token (PAT) or a Service Account Token (SAT) in Konnect. Please refer to the Konnect authentication documentation for more information. You will need this token to create a KonnectAPIAuthConfiguration object that will be used by the Kong Gateway Operator to authenticate with Konnect APIs.

Create a Kong Konnect API auth configuration

Depending on your preferences, you can create a KonnectAPIAuthConfiguration object with the token specified directly in its spec or as a reference to a Kubernetes Secret. The serverURL field should be set to the Konnect API URL in a region where your Kong Konnect account is located. Please refer to the list of available API URLs for more information.

You can verify the KonnectAPIAuthConfiguration object was reconciled successfully by checking its status.

kubectl get konnectapiauthconfiguration konnect-api-auth

The output should look like this:

NAME               VALID   ORGID                                  SERVERURL
konnect-api-auth   True    <your-konnect-org-id>                  https://us.api.konghq.com

Create a Kong Gateway control plane

Creating the KonnectGatewayControlPlane object in your Kubernetes cluster will provision a Kong Konnect Gateway control plane in your Gateway Manager. The KonnectGatewayControlPlane CR API allows you to explicitly set a type of the Kong Gateway control plane, but if you don’t specify it, the default type is a Self-Managed Hybrid gateway control plane.

You can create one by applying the following YAML manifest:

echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: gateway-control-plane
  namespace: default
spec:
  name: gateway-control-plane # Name used to identify the Gateway Control Plane in Konnect
  cloud_gateway: true
  konnect:
    authRef:
      name: konnect-api-auth # Reference to the KonnectAPIAuthConfiguration object
  ' | kubectl apply -f -

You can see the status of the Gateway Control Plane by running:

kubectl get konnectgatewaycontrolplanes.konnect.konghq.com gateway-control-plane

If the Gateway Control Plane is successfully created, you should see the following output:

NAME                    PROGRAMMED   ID                                     ORGID
gateway-control-plane   True         <konnect-control-plane-id>             <your-konnect-ord-id>

Having that in place, you will be able to reference the gateway-control-plane in your Kong Konnect entities as their parent.

Create a Network

To use this CRD, you will need a Network. For detailed instructions, see the Create Cloud Gateways Network document.

If you have already created a network, you can refer to it by name later in this guide.

Create a Transit Gateway in Cloud Provider

To use transit gateway, you must create a transit gateway in your cloud provider. You should create the transit gateway in the same region of the same provider as the Konnect network is in. For example, if you want to create a transit gateway in the Konnect network in the EU southwest region of AWS, you should also create the transit gateway in the EU southwest region of AWS. Currently we support AWS Transit Gateway and Azure Virtual Network Gateway. You can refer to the Konnect documents above to see how to create transit gateways and how to save the configuration used to create KonnectCloudGatewayTransitGateways.

Create a Cloud Gateway TransitGateway

Creating the KonnectCloudGatewayTransitGateway object in your Kubernetes cluster will provision a new Konnect Dedicated Cloud Gateway TransitGateway.

You can refer to the KonnectCloudGatewayTransitGateway CRD API for all the available fields.

To create a KonnectCloudGatewayTransitGateway object you can use the following YAML manifest:

echo '
kind: KonnectCloudGatewayTransitGateway
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: konnect-aws-transit-gateway-1
  namespace: default
spec:
  networkRef:
    type: namespacedRef
    namespacedRef:
      name: konnect-network-1 
  type: AWSTransitGateway
  awsTransitGateway:
    name: "aws-transit-gateway-1"
    cidr_blocks:
    - "10.10.0.0/24"
    attachment_config:
       # The transit gateway ID in the step of creating transit gateway in AWS
      transit_gateway_id: "tgw-0123456789abcdef10"
      # The RAM share ARN in the step of sharing the transit gateway in AWS
      ram_share_arn: "arn:aws:ram:eu-southwest-1:000011112222:resource-share/c001face-abcd-1234-9009-90091ea3a20c"
' | kubectl apply -f -

After the status.state of KonnectCloudGatewayNetwork it refers to becomes ready, the KonnectCloudGatewayTransitGateway will be configured in Konnect. You can fetch the status by:

kubectl get konnectcloudgatewaytransitgateways.konnect.konghq.com konnect-aws-transit-gateway-1 -o=jsonpath='{.status}' | yq -p json

Which should return the following status of the transit gateway:

conditions:
  - lastTransitionTime: "2025-04-23T09:16:49Z"
    message: KonnectAPIAuthConfiguration reference default/konnect-api-auth is resolved
    observedGeneration: 3
    reason: ResolvedRef
    status: "True"
    type: APIAuthResolvedRef
  - lastTransitionTime: "2025-04-23T09:16:49Z"
    message: referenced KonnectAPIAuthConfiguration default/konnect-api-auth is valid
    observedGeneration: 3
    reason: Valid
    status: "True"
    type: APIAuthValid
  - lastTransitionTime: "2025-04-23T09:16:49Z"
    message: Referenced KonnectCloudGatewayNetwork(s) are valid and programmed
    observedGeneration: 3
    reason: Valid
    status: "True"
    type: KonnectNetworkRefsValid
  - lastTransitionTime: "2025-04-23T09:16:49Z"
    message: ""
    observedGeneration: 3
    reason: Programmed
    status: "True"
    type: Programmed
id: 1111111-111111111111-11111111111111111
organizationID: 222222222-22222222-2222222222222222222
serverURL: https://global.api.konghq.com
state: initializing

Since creating a transit gateway can take some time, you can monitor the status of the transit gateway by checking the status.state field.

Accept Transit Gateway Attachment Request

For AWS transit gateways, there is one more step to let the transit gateways turn to ready. After the transit gateway created in Konnect, its status.state will become pending-acceptance in several minutes. This means Konnect has sent the request to AWS asking acceptance of attaching the transit gateway. You must accept the attaching in AWS following the guide of AWS Transit Gateway#Accept Transit Gateway attachment request.

After you accept the attachment request, the status.state of the KonnectCloudGatewayTransitGateway should become ready in some time.