apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: annotations: kuma.io/gateway: enabled kuma.io/service-account-token-volume: kong-controller-token traffic.kuma.io/exclude-outbound-ports: "8444" traffic.sidecar.istio.io/excludeOutboundPorts: "8444" traffic.sidecar.istio.io/includeInboundPorts: "" creationTimestamp: "2026-06-09T13:58:06Z" generateName: kong-controller-84db4dc787- labels: app: kong-controller app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: controller app.kubernetes.io/version: "3.9" helm.sh/chart: controller-3.2.0 pod-template-hash: 84db4dc787 version: "3.9" name: kong-controller-84db4dc787-zrp2w namespace: kong ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kong-controller-84db4dc787 uid: 98dee225-7c32-424c-a356-a326ec924c1d resourceVersion: "600" uid: 1f7369ca-2ab7-4e0f-9619-8e7ac514d464 spec: automountServiceAccountToken: false containers: - env: - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN value: 0.0.0.0:8080 - name: CONTROLLER_ELECTION_ID value: kong-ingress-controller-leader-kong - name: CONTROLLER_INGRESS_CLASS value: kong - name: CONTROLLER_KONG_ADMIN_SVC value: kong/kong-gateway-admin - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY value: "true" - name: CONTROLLER_PUBLISH_SERVICE value: kong/kong-gateway-proxy image: kong/kubernetes-ingress-controller:3.5 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 name: ingress-controller ports: - containerPort: 8080 name: webhook protocol: TCP - containerPort: 10255 name: cmetrics protocol: TCP - containerPort: 10254 name: cstatus protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 10254 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /admission-webhook name: webhook-cert readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kong-controller-token readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-70-control-plane preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: kong-controller serviceAccountName: kong-controller terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - emptyDir: sizeLimit: 256Mi name: kong-controller-prefix-dir - emptyDir: sizeLimit: 1Gi name: kong-controller-tmp - name: kong-controller-token projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace - name: webhook-cert secret: defaultMode: 420 secretName: kong-controller-validation-webhook-keypair status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:10Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:06Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:26Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:26Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:06Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://4454d21951774223502c8ff4045744461b1af04d7a09a227bfc980c372969f94 image: docker.io/kong/kubernetes-ingress-controller:3.5 imageID: docker.io/kong/kubernetes-ingress-controller@sha256:8f01bd02910a7ac234f2554e64b4c7f39705d60cde739f71bfc45f7e15b7dd05 lastState: {} name: ingress-controller ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T13:58:09Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.5 podIPs: - ip: 10.244.0.5 qosClass: BestEffort startTime: "2026-06-09T13:58:06Z" - apiVersion: v1 kind: Pod metadata: annotations: kuma.io/gateway: enabled kuma.io/service-account-token-volume: kong-gateway-token traffic.sidecar.istio.io/includeInboundPorts: "" creationTimestamp: "2026-06-09T13:58:06Z" generateName: kong-gateway-86698f6995- labels: app: kong-gateway app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway app.kubernetes.io/version: "3.9" helm.sh/chart: gateway-3.2.0 pod-template-hash: 86698f6995 version: "3.9" name: kong-gateway-86698f6995-shd24 namespace: kong ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kong-gateway-86698f6995 uid: a6f0ece1-74da-4510-867c-cdc008c2f6e0 resourceVersion: "606" uid: 0008d441-50bc-449d-8bef-b162a7be1059 spec: automountServiceAccountToken: false containers: - env: - name: KONG_ADMIN_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_GUI_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_GUI_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_LISTEN value: 0.0.0.0:8444 http2 ssl, [::]:8444 http2 ssl - name: KONG_CLUSTER_LISTEN value: "off" - name: KONG_DATABASE value: "off" - name: KONG_LUA_PACKAGE_PATH value: /opt/?.lua;/opt/?/init.lua;; - name: KONG_NGINX_WORKER_PROCESSES value: "2" - name: KONG_PORTAL_API_ACCESS_LOG value: /dev/stdout - name: KONG_PORTAL_API_ERROR_LOG value: /dev/stderr - name: KONG_PORT_MAPS value: 80:8000, 443:8443 - name: KONG_PREFIX value: /kong_prefix/ - name: KONG_PROXY_ACCESS_LOG value: /dev/stdout - name: KONG_PROXY_ERROR_LOG value: /dev/stderr - name: KONG_PROXY_LISTEN value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl - name: KONG_PROXY_STREAM_ACCESS_LOG value: /dev/stdout basic - name: KONG_PROXY_STREAM_ERROR_LOG value: /dev/stderr - name: KONG_ROLE value: traditional - name: KONG_ROUTER_FLAVOR value: traditional - name: KONG_STATUS_ACCESS_LOG value: "off" - name: KONG_STATUS_ERROR_LOG value: /dev/stderr - name: KONG_STATUS_LISTEN value: 0.0.0.0:8100, [::]:8100 - name: KONG_STREAM_LISTEN value: "off" - name: KONG_NGINX_DAEMON value: "off" image: kong:3.9 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - kong - quit - --wait=15 livenessProbe: failureThreshold: 3 httpGet: path: /status port: status scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 name: proxy ports: - containerPort: 8444 name: admin-tls protocol: TCP - containerPort: 8000 name: proxy protocol: TCP - containerPort: 8443 name: proxy-tls protocol: TCP - containerPort: 8100 name: status protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /status/ready port: status scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /kong_prefix/ name: kong-gateway-prefix-dir - mountPath: /tmp name: kong-gateway-tmp dnsPolicy: ClusterFirst enableServiceLinks: true initContainers: - command: - rm - -vrf - $KONG_PREFIX/pids env: - name: KONG_ADMIN_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_GUI_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_GUI_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_LISTEN value: 0.0.0.0:8444 http2 ssl, [::]:8444 http2 ssl - name: KONG_CLUSTER_LISTEN value: "off" - name: KONG_DATABASE value: "off" - name: KONG_LUA_PACKAGE_PATH value: /opt/?.lua;/opt/?/init.lua;; - name: KONG_NGINX_WORKER_PROCESSES value: "2" - name: KONG_PORTAL_API_ACCESS_LOG value: /dev/stdout - name: KONG_PORTAL_API_ERROR_LOG value: /dev/stderr - name: KONG_PORT_MAPS value: 80:8000, 443:8443 - name: KONG_PREFIX value: /kong_prefix/ - name: KONG_PROXY_ACCESS_LOG value: /dev/stdout - name: KONG_PROXY_ERROR_LOG value: /dev/stderr - name: KONG_PROXY_LISTEN value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl - name: KONG_PROXY_STREAM_ACCESS_LOG value: /dev/stdout basic - name: KONG_PROXY_STREAM_ERROR_LOG value: /dev/stderr - name: KONG_ROLE value: traditional - name: KONG_ROUTER_FLAVOR value: traditional - name: KONG_STATUS_ACCESS_LOG value: "off" - name: KONG_STATUS_ERROR_LOG value: /dev/stderr - name: KONG_STATUS_LISTEN value: 0.0.0.0:8100, [::]:8100 - name: KONG_STREAM_LISTEN value: "off" image: kong:3.9 imagePullPolicy: IfNotPresent name: clear-stale-pid resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /kong_prefix/ name: kong-gateway-prefix-dir - mountPath: /tmp name: kong-gateway-tmp nodeName: chart-test-swarm-run-70-control-plane preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: kong-gateway serviceAccountName: kong-gateway terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - emptyDir: sizeLimit: 256Mi name: kong-gateway-prefix-dir - emptyDir: sizeLimit: 1Gi name: kong-gateway-tmp - name: kong-gateway-token projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:13Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:13Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:26Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:26Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T13:58:06Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://bac2b5ef8cfeb856692e13bf050884c0d1b86a915cc2293fb143c92653d30f31 image: docker.io/library/kong:3.9 imageID: docker.io/library/kong@sha256:bcc27182e9bd2e696aee55ec6cb83f64ec0bfba2143914489dadb44f4f839b19 lastState: {} name: proxy ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T13:58:13Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 initContainerStatuses: - containerID: containerd://fba2178fa4880a6b977988af9c06e9ac2475fdf5cc9cfa82e6f855bdbd090c90 image: docker.io/library/kong:3.9 imageID: docker.io/library/kong@sha256:bcc27182e9bd2e696aee55ec6cb83f64ec0bfba2143914489dadb44f4f839b19 lastState: {} name: clear-stale-pid ready: true restartCount: 0 started: false state: terminated: containerID: containerd://fba2178fa4880a6b977988af9c06e9ac2475fdf5cc9cfa82e6f855bdbd090c90 exitCode: 0 finishedAt: "2026-06-09T13:58:12Z" reason: Completed startedAt: "2026-06-09T13:58:12Z" phase: Running podIP: 10.244.0.6 podIPs: - ip: 10.244.0.6 qosClass: BestEffort startTime: "2026-06-09T13:58:06Z" - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kong meta.helm.sh/release-namespace: kong creationTimestamp: "2026-06-09T13:58:06Z" labels: app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: controller app.kubernetes.io/version: "3.9" helm.sh/chart: controller-3.2.0 name: kong-controller-metrics namespace: kong resourceVersion: "491" uid: 1d52b32f-1cf2-42ff-a52f-b5d378d03910 spec: clusterIP: 10.96.129.192 clusterIPs: - 10.96.129.192 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: cmetrics port: 10255 protocol: TCP targetPort: cmetrics - name: status port: 10254 protocol: TCP targetPort: cstatus selector: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: controller app.kubernetes.io/version: "3.9" helm.sh/chart: controller-3.2.0 sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kong meta.helm.sh/release-namespace: kong creationTimestamp: "2026-06-09T13:58:06Z" labels: app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: controller app.kubernetes.io/version: "3.9" helm.sh/chart: controller-3.2.0 name: kong-controller-validation-webhook namespace: kong resourceVersion: "496" uid: b3a97253-a02f-4cec-91a5-3d65ad5a3d98 spec: clusterIP: 10.96.88.199 clusterIPs: - 10.96.88.199 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: webhook port: 443 protocol: TCP targetPort: webhook selector: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: controller app.kubernetes.io/version: "3.9" helm.sh/chart: controller-3.2.0 sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kong meta.helm.sh/release-namespace: kong creationTimestamp: "2026-06-09T13:58:06Z" labels: app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway app.kubernetes.io/version: "3.9" helm.sh/chart: gateway-3.2.0 name: kong-gateway-admin namespace: kong resourceVersion: "486" uid: d791da13-505b-4ae0-8e69-1c12115740cf spec: clusterIP: None clusterIPs: - None internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: kong-admin-tls port: 8444 protocol: TCP targetPort: 8444 selector: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/name: gateway sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kong meta.helm.sh/release-namespace: kong creationTimestamp: "2026-06-09T13:58:06Z" labels: app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway app.kubernetes.io/version: "3.9" helm.sh/chart: gateway-3.2.0 name: kong-gateway-manager namespace: kong resourceVersion: "505" uid: e730377c-bdf7-492d-99b1-abf0a468d6b6 spec: clusterIP: 10.96.68.35 clusterIPs: - 10.96.68.35 externalTrafficPolicy: Cluster internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: kong-manager nodePort: 30253 port: 8002 protocol: TCP targetPort: 8002 - name: kong-manager-tls nodePort: 31684 port: 8445 protocol: TCP targetPort: 8445 selector: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/name: gateway sessionAffinity: None type: NodePort status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kong meta.helm.sh/release-namespace: kong creationTimestamp: "2026-06-09T13:58:06Z" labels: app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway app.kubernetes.io/version: "3.9" enable-metrics: "true" helm.sh/chart: gateway-3.2.0 name: kong-gateway-proxy namespace: kong resourceVersion: "495" uid: 0dc68062-3025-4e18-953e-8ce7bf0a190d spec: allocateLoadBalancerNodePorts: true clusterIP: 10.96.124.152 clusterIPs: - 10.96.124.152 externalTrafficPolicy: Cluster internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: kong-proxy nodePort: 31040 port: 80 protocol: TCP targetPort: 8000 - name: kong-proxy-tls nodePort: 30129 port: 443 protocol: TCP targetPort: 8443 selector: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/name: gateway sessionAffinity: None type: LoadBalancer status: loadBalancer: {} - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kong meta.helm.sh/release-namespace: kong creationTimestamp: "2026-06-09T13:58:06Z" generation: 1 labels: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: controller app.kubernetes.io/version: "3.9" helm.sh/chart: controller-3.2.0 name: kong-controller namespace: kong resourceVersion: "613" uid: a732d003-2511-4dba-b7ff-5f7e2224bbfa spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/name: controller strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: kuma.io/gateway: enabled kuma.io/service-account-token-volume: kong-controller-token traffic.kuma.io/exclude-outbound-ports: "8444" traffic.sidecar.istio.io/excludeOutboundPorts: "8444" traffic.sidecar.istio.io/includeInboundPorts: "" creationTimestamp: null labels: app: kong-controller app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: controller app.kubernetes.io/version: "3.9" helm.sh/chart: controller-3.2.0 version: "3.9" spec: automountServiceAccountToken: false containers: - env: - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN value: 0.0.0.0:8080 - name: CONTROLLER_ELECTION_ID value: kong-ingress-controller-leader-kong - name: CONTROLLER_INGRESS_CLASS value: kong - name: CONTROLLER_KONG_ADMIN_SVC value: kong/kong-gateway-admin - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY value: "true" - name: CONTROLLER_PUBLISH_SERVICE value: kong/kong-gateway-proxy image: kong/kubernetes-ingress-controller:3.5 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 name: ingress-controller ports: - containerPort: 8080 name: webhook protocol: TCP - containerPort: 10255 name: cmetrics protocol: TCP - containerPort: 10254 name: cstatus protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 10254 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /admission-webhook name: webhook-cert readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kong-controller-token readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: kong-controller serviceAccountName: kong-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: sizeLimit: 256Mi name: kong-controller-prefix-dir - emptyDir: sizeLimit: 1Gi name: kong-controller-tmp - name: kong-controller-token projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace - name: webhook-cert secret: defaultMode: 420 secretName: kong-controller-validation-webhook-keypair status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T13:58:26Z" lastUpdateTime: "2026-06-09T13:58:26Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T13:58:06Z" lastUpdateTime: "2026-06-09T13:58:26Z" message: ReplicaSet "kong-controller-84db4dc787" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kong meta.helm.sh/release-namespace: kong creationTimestamp: "2026-06-09T13:58:06Z" generation: 1 labels: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway app.kubernetes.io/version: "3.9" helm.sh/chart: gateway-3.2.0 name: kong-gateway namespace: kong resourceVersion: "615" uid: 22c99a8c-aa6c-45ed-8427-059168127832 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/name: gateway strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: kuma.io/gateway: enabled kuma.io/service-account-token-volume: kong-gateway-token traffic.sidecar.istio.io/includeInboundPorts: "" creationTimestamp: null labels: app: kong-gateway app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway app.kubernetes.io/version: "3.9" helm.sh/chart: gateway-3.2.0 version: "3.9" spec: automountServiceAccountToken: false containers: - env: - name: KONG_ADMIN_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_GUI_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_GUI_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_LISTEN value: 0.0.0.0:8444 http2 ssl, [::]:8444 http2 ssl - name: KONG_CLUSTER_LISTEN value: "off" - name: KONG_DATABASE value: "off" - name: KONG_LUA_PACKAGE_PATH value: /opt/?.lua;/opt/?/init.lua;; - name: KONG_NGINX_WORKER_PROCESSES value: "2" - name: KONG_PORTAL_API_ACCESS_LOG value: /dev/stdout - name: KONG_PORTAL_API_ERROR_LOG value: /dev/stderr - name: KONG_PORT_MAPS value: 80:8000, 443:8443 - name: KONG_PREFIX value: /kong_prefix/ - name: KONG_PROXY_ACCESS_LOG value: /dev/stdout - name: KONG_PROXY_ERROR_LOG value: /dev/stderr - name: KONG_PROXY_LISTEN value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl - name: KONG_PROXY_STREAM_ACCESS_LOG value: /dev/stdout basic - name: KONG_PROXY_STREAM_ERROR_LOG value: /dev/stderr - name: KONG_ROLE value: traditional - name: KONG_ROUTER_FLAVOR value: traditional - name: KONG_STATUS_ACCESS_LOG value: "off" - name: KONG_STATUS_ERROR_LOG value: /dev/stderr - name: KONG_STATUS_LISTEN value: 0.0.0.0:8100, [::]:8100 - name: KONG_STREAM_LISTEN value: "off" - name: KONG_NGINX_DAEMON value: "off" image: kong:3.9 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - kong - quit - --wait=15 livenessProbe: failureThreshold: 3 httpGet: path: /status port: status scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 name: proxy ports: - containerPort: 8444 name: admin-tls protocol: TCP - containerPort: 8000 name: proxy protocol: TCP - containerPort: 8443 name: proxy-tls protocol: TCP - containerPort: 8100 name: status protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /status/ready port: status scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /kong_prefix/ name: kong-gateway-prefix-dir - mountPath: /tmp name: kong-gateway-tmp dnsPolicy: ClusterFirst initContainers: - command: - rm - -vrf - $KONG_PREFIX/pids env: - name: KONG_ADMIN_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_GUI_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_GUI_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_LISTEN value: 0.0.0.0:8444 http2 ssl, [::]:8444 http2 ssl - name: KONG_CLUSTER_LISTEN value: "off" - name: KONG_DATABASE value: "off" - name: KONG_LUA_PACKAGE_PATH value: /opt/?.lua;/opt/?/init.lua;; - name: KONG_NGINX_WORKER_PROCESSES value: "2" - name: KONG_PORTAL_API_ACCESS_LOG value: /dev/stdout - name: KONG_PORTAL_API_ERROR_LOG value: /dev/stderr - name: KONG_PORT_MAPS value: 80:8000, 443:8443 - name: KONG_PREFIX value: /kong_prefix/ - name: KONG_PROXY_ACCESS_LOG value: /dev/stdout - name: KONG_PROXY_ERROR_LOG value: /dev/stderr - name: KONG_PROXY_LISTEN value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl - name: KONG_PROXY_STREAM_ACCESS_LOG value: /dev/stdout basic - name: KONG_PROXY_STREAM_ERROR_LOG value: /dev/stderr - name: KONG_ROLE value: traditional - name: KONG_ROUTER_FLAVOR value: traditional - name: KONG_STATUS_ACCESS_LOG value: "off" - name: KONG_STATUS_ERROR_LOG value: /dev/stderr - name: KONG_STATUS_LISTEN value: 0.0.0.0:8100, [::]:8100 - name: KONG_STREAM_LISTEN value: "off" image: kong:3.9 imagePullPolicy: IfNotPresent name: clear-stale-pid resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /kong_prefix/ name: kong-gateway-prefix-dir - mountPath: /tmp name: kong-gateway-tmp restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: kong-gateway serviceAccountName: kong-gateway terminationGracePeriodSeconds: 30 volumes: - emptyDir: sizeLimit: 256Mi name: kong-gateway-prefix-dir - emptyDir: sizeLimit: 1Gi name: kong-gateway-tmp - name: kong-gateway-token projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T13:58:26Z" lastUpdateTime: "2026-06-09T13:58:26Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T13:58:06Z" lastUpdateTime: "2026-06-09T13:58:26Z" message: ReplicaSet "kong-gateway-86698f6995" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kong meta.helm.sh/release-namespace: kong creationTimestamp: "2026-06-09T13:58:06Z" generation: 1 labels: app: kong-controller app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: controller app.kubernetes.io/version: "3.9" helm.sh/chart: controller-3.2.0 pod-template-hash: 84db4dc787 version: "3.9" name: kong-controller-84db4dc787 namespace: kong ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kong-controller uid: a732d003-2511-4dba-b7ff-5f7e2224bbfa resourceVersion: "605" uid: 98dee225-7c32-424c-a356-a326ec924c1d spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/name: controller pod-template-hash: 84db4dc787 template: metadata: annotations: kuma.io/gateway: enabled kuma.io/service-account-token-volume: kong-controller-token traffic.kuma.io/exclude-outbound-ports: "8444" traffic.sidecar.istio.io/excludeOutboundPorts: "8444" traffic.sidecar.istio.io/includeInboundPorts: "" creationTimestamp: null labels: app: kong-controller app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: controller app.kubernetes.io/version: "3.9" helm.sh/chart: controller-3.2.0 pod-template-hash: 84db4dc787 version: "3.9" spec: automountServiceAccountToken: false containers: - env: - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN value: 0.0.0.0:8080 - name: CONTROLLER_ELECTION_ID value: kong-ingress-controller-leader-kong - name: CONTROLLER_INGRESS_CLASS value: kong - name: CONTROLLER_KONG_ADMIN_SVC value: kong/kong-gateway-admin - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY value: "true" - name: CONTROLLER_PUBLISH_SERVICE value: kong/kong-gateway-proxy image: kong/kubernetes-ingress-controller:3.5 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 name: ingress-controller ports: - containerPort: 8080 name: webhook protocol: TCP - containerPort: 10255 name: cmetrics protocol: TCP - containerPort: 10254 name: cstatus protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 10254 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /admission-webhook name: webhook-cert readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kong-controller-token readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: kong-controller serviceAccountName: kong-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: sizeLimit: 256Mi name: kong-controller-prefix-dir - emptyDir: sizeLimit: 1Gi name: kong-controller-tmp - name: kong-controller-token projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace - name: webhook-cert secret: defaultMode: 420 secretName: kong-controller-validation-webhook-keypair status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kong meta.helm.sh/release-namespace: kong creationTimestamp: "2026-06-09T13:58:06Z" generation: 1 labels: app: kong-gateway app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway app.kubernetes.io/version: "3.9" helm.sh/chart: gateway-3.2.0 pod-template-hash: 86698f6995 version: "3.9" name: kong-gateway-86698f6995 namespace: kong ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kong-gateway uid: 22c99a8c-aa6c-45ed-8427-059168127832 resourceVersion: "614" uid: a6f0ece1-74da-4510-867c-cdc008c2f6e0 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/name: gateway pod-template-hash: 86698f6995 template: metadata: annotations: kuma.io/gateway: enabled kuma.io/service-account-token-volume: kong-gateway-token traffic.sidecar.istio.io/includeInboundPorts: "" creationTimestamp: null labels: app: kong-gateway app.kubernetes.io/component: app app.kubernetes.io/instance: kong app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gateway app.kubernetes.io/version: "3.9" helm.sh/chart: gateway-3.2.0 pod-template-hash: 86698f6995 version: "3.9" spec: automountServiceAccountToken: false containers: - env: - name: KONG_ADMIN_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_GUI_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_GUI_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_LISTEN value: 0.0.0.0:8444 http2 ssl, [::]:8444 http2 ssl - name: KONG_CLUSTER_LISTEN value: "off" - name: KONG_DATABASE value: "off" - name: KONG_LUA_PACKAGE_PATH value: /opt/?.lua;/opt/?/init.lua;; - name: KONG_NGINX_WORKER_PROCESSES value: "2" - name: KONG_PORTAL_API_ACCESS_LOG value: /dev/stdout - name: KONG_PORTAL_API_ERROR_LOG value: /dev/stderr - name: KONG_PORT_MAPS value: 80:8000, 443:8443 - name: KONG_PREFIX value: /kong_prefix/ - name: KONG_PROXY_ACCESS_LOG value: /dev/stdout - name: KONG_PROXY_ERROR_LOG value: /dev/stderr - name: KONG_PROXY_LISTEN value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl - name: KONG_PROXY_STREAM_ACCESS_LOG value: /dev/stdout basic - name: KONG_PROXY_STREAM_ERROR_LOG value: /dev/stderr - name: KONG_ROLE value: traditional - name: KONG_ROUTER_FLAVOR value: traditional - name: KONG_STATUS_ACCESS_LOG value: "off" - name: KONG_STATUS_ERROR_LOG value: /dev/stderr - name: KONG_STATUS_LISTEN value: 0.0.0.0:8100, [::]:8100 - name: KONG_STREAM_LISTEN value: "off" - name: KONG_NGINX_DAEMON value: "off" image: kong:3.9 imagePullPolicy: IfNotPresent lifecycle: preStop: exec: command: - kong - quit - --wait=15 livenessProbe: failureThreshold: 3 httpGet: path: /status port: status scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 name: proxy ports: - containerPort: 8444 name: admin-tls protocol: TCP - containerPort: 8000 name: proxy protocol: TCP - containerPort: 8443 name: proxy-tls protocol: TCP - containerPort: 8100 name: status protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /status/ready port: status scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /kong_prefix/ name: kong-gateway-prefix-dir - mountPath: /tmp name: kong-gateway-tmp dnsPolicy: ClusterFirst initContainers: - command: - rm - -vrf - $KONG_PREFIX/pids env: - name: KONG_ADMIN_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_GUI_ACCESS_LOG value: /dev/stdout - name: KONG_ADMIN_GUI_ERROR_LOG value: /dev/stderr - name: KONG_ADMIN_LISTEN value: 0.0.0.0:8444 http2 ssl, [::]:8444 http2 ssl - name: KONG_CLUSTER_LISTEN value: "off" - name: KONG_DATABASE value: "off" - name: KONG_LUA_PACKAGE_PATH value: /opt/?.lua;/opt/?/init.lua;; - name: KONG_NGINX_WORKER_PROCESSES value: "2" - name: KONG_PORTAL_API_ACCESS_LOG value: /dev/stdout - name: KONG_PORTAL_API_ERROR_LOG value: /dev/stderr - name: KONG_PORT_MAPS value: 80:8000, 443:8443 - name: KONG_PREFIX value: /kong_prefix/ - name: KONG_PROXY_ACCESS_LOG value: /dev/stdout - name: KONG_PROXY_ERROR_LOG value: /dev/stderr - name: KONG_PROXY_LISTEN value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl - name: KONG_PROXY_STREAM_ACCESS_LOG value: /dev/stdout basic - name: KONG_PROXY_STREAM_ERROR_LOG value: /dev/stderr - name: KONG_ROLE value: traditional - name: KONG_ROUTER_FLAVOR value: traditional - name: KONG_STATUS_ACCESS_LOG value: "off" - name: KONG_STATUS_ERROR_LOG value: /dev/stderr - name: KONG_STATUS_LISTEN value: 0.0.0.0:8100, [::]:8100 - name: KONG_STREAM_LISTEN value: "off" image: kong:3.9 imagePullPolicy: IfNotPresent name: clear-stale-pid resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /kong_prefix/ name: kong-gateway-prefix-dir - mountPath: /tmp name: kong-gateway-tmp restartPolicy: Always schedulerName: default-scheduler securityContext: seccompProfile: type: RuntimeDefault serviceAccount: kong-gateway serviceAccountName: kong-gateway terminationGracePeriodSeconds: 30 volumes: - emptyDir: sizeLimit: 256Mi name: kong-gateway-prefix-dir - emptyDir: sizeLimit: 1Gi name: kong-gateway-tmp - name: kong-gateway-token projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 kind: List metadata: resourceVersion: ""