feat(gateway): Certificate reloads - #6644
Open
lmilan wants to merge 16 commits into
Open
Conversation
✅ Deploy Preview for kongdeveloper ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
cloudjumpercat
requested changes
Aug 13, 2026
cloudjumpercat
left a comment
cloudjumpercat
left a comment
Contributor
There was a problem hiding this comment.
Mostly just nitpicks! The operator how to wasn't working for me, I think because Konnect auth is missing somewhere
| {:.warning} | ||
| > Don't run `kong reload` in a pod. `kong reload` does pick up the new value, and it does so without dropping connections, but it changes only the container that you ran it in. That container no longer matches its manifest, the other replicas are untouched, and the change is lost the next time the pod is rescheduled, scaled, or upgraded. | ||
| > | ||
| > Replacing the pods keeps the change in the manifest, where it survives all of those events. To avoid the gap in service that a rolling restart causes, run more than one replica with readiness probes configured, rather than using `kong reload`. |
Contributor
There was a problem hiding this comment.
Suggested change
| > Replacing the pods keeps the change in the manifest, where it survives all of those events. To avoid the gap in service that a rolling restart causes, run more than one replica with readiness probes configured, rather than using `kong reload`. | |
| > Replacing the pods keeps the change in the manifest, where it survives all of those events. To avoid the gap in service that a rolling restart causes, run more than one replica with readiness probes configured instead of using `kong reload`. |
|
|
||
| ## Restart the data plane without a template change | ||
|
|
||
| Not every change edits the pod template. When a `kong.conf` parameter points at a file and something outside Helm rewrites that file, the Deployment spec is byte-for-byte identical, so `helm upgrade` has nothing to replace and the pods keep running with the old contents loaded. A rotated Secret is the common case. |
Contributor
There was a problem hiding this comment.
Suggested change
| Not every change edits the pod template. When a `kong.conf` parameter points at a file and something outside Helm rewrites that file, the Deployment spec is byte-for-byte identical, so `helm upgrade` has nothing to replace and the pods keep running with the old contents loaded. A rotated Secret is the common case. | |
| Not every change edits the pod template. When a `kong.conf` parameter points at a file and something outside Helm rewrites that file, the deployment spec is byte-for-byte identical, so `helm upgrade` has nothing to replace and the pods keep running with the old contents loaded. A rotated Secret is the common case. |
"Deployment" just felt odd to be capped.
|
|
||
| `kubectl rollout restart` is how you replace the pods in that situation. Run it here against the data plane you just upgraded, so you can see what it does before you need it for a rotation: | ||
|
|
||
| 1. Record the current pod names and ages so we can compare afterwards: |
Contributor
There was a problem hiding this comment.
Suggested change
| 1. Record the current pod names and ages so we can compare afterwards: | |
| 1. Record the current pod names and ages so you can compare afterwards: |
| kubectl get pods -n kong -l app.kubernetes.io/instance=kong-dp | ||
| ``` | ||
|
|
||
| 1. Trigger a rolling restart of the Deployment: |
Contributor
There was a problem hiding this comment.
Suggested change
| 1. Trigger a rolling restart of the Deployment: | |
| 1. Trigger a rolling restart of the deployment: |
|
|
||
| Not every change edits the pod template. When a `kong.conf` parameter points at a file and something outside Helm rewrites that file, the Deployment spec is byte-for-byte identical, so `helm upgrade` has nothing to replace and the pods keep running with the old contents loaded. A rotated Secret is the common case. | ||
|
|
||
| `kubectl rollout restart` is how you replace the pods in that situation. Run it here against the data plane you just upgraded, so you can see what it does before you need it for a rotation: |
Contributor
There was a problem hiding this comment.
Suggested change
| `kubectl rollout restart` is how you replace the pods in that situation. Run it here against the data plane you just upgraded, so you can see what it does before you need it for a rotation: | |
| Use `kubectl rollout restart` to replace the pods in this situation. Run it here against the data plane you just upgraded, so you can see what it does before you need it for a rotation: |
Just so it feels a bit more active.
| The two serial numbers should now match. {{site.base_gateway}} is serving the rotated certificate. | ||
|
|
||
| {:.warning} | ||
| > Reloader restarts the whole Deployment, so every `kong.conf` value is re-read, not just the certificate. Roll out configuration changes deliberately, and keep at least two replicas so a rotation doesn't take your data plane offline. With a single replica, as in this guide, expect a gap in service while the pod is replaced. |
Contributor
There was a problem hiding this comment.
Suggested change
| > Reloader restarts the whole Deployment, so every `kong.conf` value is re-read, not just the certificate. Roll out configuration changes deliberately, and keep at least two replicas so a rotation doesn't take your data plane offline. With a single replica, as in this guide, expect a gap in service while the pod is replaced. | |
| > Reloader restarts the whole deployment, so every `kong.conf` value is re-read, not just the certificate. Roll out configuration changes deliberately, and keep at least two replicas so a rotation doesn't take your data plane offline. If you're using a single replica, like in this guide, expect a gap in service while the pod is replaced. |
| {:.warning} | ||
| > Reloader restarts the whole Deployment, so every `kong.conf` value is re-read, not just the certificate. Roll out configuration changes deliberately, and keep at least two replicas so a rotation doesn't take your data plane offline. With a single replica, as in this guide, expect a gap in service while the pod is replaced. | ||
|
|
||
| Reloader triggers the rollout by patching an environment variable into the pod template, so you'll see a `STAKATER_` variable on the Deployment that isn't in your values file. It's reset by your next `helm upgrade`, and Reloader adds it again on the following rotation. |
Contributor
There was a problem hiding this comment.
Suggested change
| Reloader triggers the rollout by patching an environment variable into the pod template, so you'll see a `STAKATER_` variable on the Deployment that isn't in your values file. It's reset by your next `helm upgrade`, and Reloader adds it again on the following rotation. | |
| Reloader triggers the rollout by patching an environment variable into the pod template, so you'll see a `STAKATER_` variable on the deployment that isn't in your values file. It's reset by your next `helm upgrade`, and Reloader adds it again on the following rotation. |
| indent: 3 | ||
| {% endon_prem %} | ||
|
|
||
| {% konnect %} |
Contributor
There was a problem hiding this comment.
This one feels awkward with the previous step of "Add your Kong Gateway Enterprise license:". Can we conditionally render the whole step so it only shows for on prem and Konnect users just won't see this step?
|
|
||
| Deploy a sample `HTTPRoute` to verify that TLS termination is working: | ||
|
|
||
| ```sh |
Contributor
There was a problem hiding this comment.
What did you get when you tested this with Konnect? Mine is giving me this error, and I suspect it's because we need some sort of step added to authenticate with Konnect because I didn't pass my PAT anywhere yet:
Error from server: error when creating "STDIN": admission webhook "gwapi.validations.kong.konghq.com" denied the request: Unable to validate HTTPRoute schema: HTTP status 403 (message: "Enterprise license missing or expired")
Comment on lines
+208
to
+209
| * In traditional mode they come from the database | ||
| * In DB-less mode they arrive with the declarative configuration |
Contributor
There was a problem hiding this comment.
Suggested change
| * In traditional mode they come from the database | |
| * In DB-less mode they arrive with the declarative configuration | |
| * In traditional mode, they come from the database | |
| * In DB-less mode, they come with the declarative configuration |
"arrive" just felt too much like personification
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #2348
Preview Links
Checklist
descriptionentry in frontmatter.