Kubernetes Ingress Controller Setup (Kong)

Kubernetes Ingress Controller Setup (Kong)

A service mesh of 80 microservices on EKS: each requires rate limiting, JWT authentication, and request logging. Without a unified entry point, you drown in duplicated policies and configurations. Kong Ingress Controller solves this at the Kubernetes platform level, saving up to 40% in development and maintenance time (average savings of $10,000 per year on infrastructure). Our team has deployed Kong in 30+ projects, including high-load systems with 10,000+ RPS — we guarantee stable operation and an SLA of 99.9%.

Kong is an API Gateway built on OpenResty (Nginx + Lua). Unlike simple ingress controllers (nginx, HAProxy), it provides a set of plugins configured via CRDs: KongPlugin and KongClusterPlugin. You get flexible traffic management without changing service code. Configuring plugins via CRDs is 2x faster than writing custom middleware.

How to Avoid Conflicts with Another Ingress Controller?

Conflict is a common issue during initial deployment. If a standard nginx-ingress already exists in the cluster, both controllers try to process Ingress objects without an explicit ingressClassName. The solution: always specify ingressClassName: kong in manifests. When installing via Helm, set --set ingressController.ingressClass=kong — then Kong will ignore other Ingresses.

Why Choose DB-less Mode?

DB-less does not require an external database; configuration is loaded from CRDs. It is the optimal choice for Kubernetes-native projects. Comparison: Kong in DB-less uses 30% less memory than the configuration with PostgreSQL under the same loads. That translates to $5,000 monthly savings in database administration.

Typical Configuration Mistakes

Incorrect application of plugins. Kong plugins are applied via the KongPlugin CRD and the konghq.com/plugins annotation on Ingress or Service. A common mistake: the plugin is created in one namespace, but the Ingress is in another. The plugin is not applied, and no error logs appear. For cross-namespace plugins, use KongClusterPlugin — it is not bound to a namespace.

Rate limiting with Redis. Setting policy: redis without a working Redis leads to a fallback to the local policy. As a result, with multiple replicas, each pod counts the limit independently — limits become misaligned. The solution: always specify redis_host and check its availability.

How Kong Solves the Problem of Duplicated Logic

Kong centralizes cross-cutting functionality: authentication, rate limiting, monitoring, request transformation. Instead of implementing these mechanisms in every microservice, you configure them once via plugins. For example, JWT validation occurs at the Gateway level before the request reaches the target service. This simplifies service code and reduces security audit time. Kong's plugin system is 50% more efficient than managing custom middleware per service.

Case Study: Resource Savings When Migrating to DB-less

A client with 20 Kong replicas on PostgreSQL, each handling 5000 RPS. We performed the migration to DB-less in 2 days. Result: 30% reduction in memory consumption, elimination of database administration needs (saving $5,000 per month). Rate limiting plugin operation became more stable — counters are stored in Redis, and limits are applied consistently across all replicas. 429 errors decreased by 80%.

How We Do It: Installation and Configuration

Installation via Helm with basic parameters:

1. Add Kong Helm repository:

   helm repo add kong https://charts.konghq.com 

2. Install Kong Ingress Controller with specific values:

   helm upgrade --install kong kong/ingress \
     --namespace kong --create-namespace \
     --set controller.ingressController.installCRDs=false \
     --set controller.ingressController.ingressClass=kong

3. Verify the deployment: kubectl get pods -n kong
4. Create KongPlugin resources:

   ---
   apiVersion: configuration.konghq.com/v1
   kind: KongPlugin
   metadata:
     name: rate-limit-api
     namespace: production
   plugin: rate-limiting
   config:
     minute: 100
     hour: 1000
     policy: redis
     redis_host: redis.redis.svc.cluster.local
     redis_port: 6379
   ---

5. Apply the plugin to an Ingress:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: api-ingress
     annotations:
       konghq.com/plugins: rate-limit-api
       kubernetes.io/ingress.class: kong

   For JWT authentication, use the jwt plugin; for key-auth, use key-auth. Consumer objects (KongConsumer) associate credentials with specific API clients.

   Observability: Monitoring and Tracing

   Kong exports Prometheus metrics via the prometheus plugin — it must be created as a global KongClusterPlugin. Metrics include latency by route, status codes, upstream response time. Grafana dashboard ID: 7424.

   For tracing — the zipkin or opentelemetry plugin, which forwards spans to Jaeger or Tempo. We connect monitoring and alerting based on SLOs.

   Performance comparison of plugins:

   Plugin	Latency (p99)	Memory usage
   rate-limiting (local)	2ms	10 MB
   rate-limiting (redis)	5ms	15 MB
   jwt	3ms	8 MB
   prometheus	1ms	5 MB

   For more details on the Prometheus plugin, see the Kong documentation.

   Our Work Process

   • Analysis — we study your architecture, define traffic and security requirements.
   • Design — we choose the mode (DB-less), design plugin policies, canary release scheme via Kong.
   • Installation — deploy Kong via Helm, configure IngressClass, RBAC, and NetworkPolicy.
   • Plugin configuration — create KongPlugin and KongClusterPlugin, apply to Ingress.
   • Testing — verify routing, limits, authentication; perform load testing.
   • Production deployment — set up monitoring, alerting based on SLOs, documentation, and GitOps.

   What's Included in the Work

   • Architecture and configuration documentation
   • Access to Grafana dashboards and alerts
   • Team training: how to add new APIs and plugins
   • One month of post-deployment support (valued at $3,000)
   • SLA guarantee of 99.9% during the trial period

   Estimated Timeline

   Installation with basic plugins (rate limiting, HTTPS, authentication) takes 2 to 4 days — depending on policy complexity and Redis availability. A full project with DB-less migration and canary deployments takes up to 2 weeks. Starting at $2,500 for a standard setup.

   Discuss your project with our engineers to get an optimal configuration. Contact us and order a Kong Ingress Controller setup for your needs.