Kong TCPINGRESS tls doesnt create certificate

[rchekhina]

HI,

I have created the following TCPINGRESS with tls but it doesnt create the certificate. the cluster issuer letsencrypt-cloudflare-v1 is working because I can generate certificate with him:

apiVersion: configuration.konghq.com/v1beta1
kind: TCPIngress
metadata:
  name: openldap
  namespace: sa-openldap
  annotations:
    kubernetes.io/ingress.class: kong
    cert-manager.io/cluster-issuer: "letsencrypt-cloudflare-v1"
spec:
  rules:
    - port: 636
      host: auth.example.com
      backend:
        serviceName: openldap
        servicePort: 389
  tls:
    - secretName: openldap-tls-secret
      hosts:
      - auth.example.com

Can you help me please ?

Best regards.

[rchekhina]

HI,

the ssl connexion works but it uses the default self-signed kong certificate:

subject=C = US, ST = California, L = San Francisco, O = Kong, OU = IT Department, CN = localhost
issuer=C = US, ST = California, L = San Francisco, O = Kong, OU = IT Department, CN = localhost
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 944 bytes and written 400 bytes
Verification error: self-signed certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 18 (self-signed certificate)

[rchekhina]

HI,

I have found the solution :) from this source https://docs.konghq.com/kubernetes-ingress-controller/latest/guides/services/tcp/

• Install the experimental Gateway API CRDs before installing Kong Ingress Controller:

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.1.0/experimental-install.yaml

• Create kong namespace:

kubectl create ns kong-ingress

• Create a Gateway and GatewayClass instance to use:

echo "
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: kong
  namespace: kong-ingress
  annotations:
    konghq.com/gatewayclass-unmanaged: 'true'

spec:
  controllerName: konghq.com/kic-gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: kong
  namespace: kong-ingress
spec:
  gatewayClassName: kong
  listeners:
  - name: proxy
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
         from: All
" | kubectl apply -f -

• Install Kong Ingress Controller with Helm:

helm install kong-ingress kong/kong --namespace kong-ingress --create-namespace --values values.yml

• Enable the Gateway API Alpha feature gate:

kubectl set env -n kong-ingress deployment/kong-ingress-kong CONTROLLER_FEATURE_GATES="GatewayAlpha=true"

• Expose additional ports on deployment:

kubectl patch deploy -n kong-ingress kong-ingress-kong --patch '{
   "spec": {
     "template": {
       "spec": {
         "containers": [
           {
             "name": "proxy",
             "env": [
               {
                 "name": "KONG_STREAM_LISTEN",
                 "value": "0.0.0.0:636 ssl"
               }
             ],
             "ports": [
               {
                 "containerPort": 636,
                 "name": "stream636",
                 "protocol": "TCP"
               }
             ]
           }
         ]
       }
     }
   }
 }'

• Update the proxy Service to indicate the new ports:

kubectl patch service -n kong-ingress kong-ingress-kong-proxy --patch '{
  "spec": {
    "ports": [
      {
        "name": "stream636",
        "port": 636,
        "protocol": "TCP",
        "targetPort": 636
      }
    ]
  }
}'

• Configure TCPRoute:

kubectl -n kong-ingress patch --type=json gateway kong -p='[
    {
        "op":"add",
        "path":"/spec/listeners/-",
        "value":{
            "name":"stream636",
            "port":636,
            "protocol":"TLS",
            "hostname":"auth.example.com",
            "tls": {
                "certificateRefs":[{
                    "group":"",
                    "kind":"Secret",
                    "name":"auth.example.com"
                 }]
            }
        }
    }
]'

• Deploy an openldap service:

helm install openldap openldap/openldap-stack-ha --namespace sa-openldap --create-namespace --values values.yml

• Create SSL certificate (you need to install cert-manager and create cluster-issuer):

echo "apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: auth.example.com
  namespace: sa-openldap

spec:
  secretName: auth.example.com
  issuerRef:
    name: letsencrypt-cloudflare-v1
    kind: ClusterIssuer
  dnsNames:
  - auth.example.com
" | kubectl apply -f -

• Create the TCPIngress resource to route TLS-encrypted traffic to the openldap service:

echo "apiVersion: configuration.konghq.com/v1beta1
kind: TCPIngress
metadata:
  name: openldap-tls
  namespace: sa-openldap
  annotations:
    kubernetes.io/ingress.class: kong
spec:
  tls:
  - secretName: auth.example.com
    hosts:
      - auth.example.com
  rules:
  - host: auth.example.com
    port: 636
    backend:
      serviceName: openldap
      servicePort: 389
" | kubectl apply -f -

• Test the configuration:

echo | openssl s_client -servername auth.example.com -connect auth.example.com:636 2>/dev/null
CONNECTED(00000003)
---
Certificate chain
 0 s:CN = **auth.example.com**
   i:C = US, O = Let's Encrypt, CN = R10
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: May 16 07:34:13 2025 GMT; NotAfter: Aug 14 07:34:12 2025 GMT
 1 s:C = US, O = Let's Encrypt, CN = R10
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT