Skip to main content

Deploy using a Helm Chart

Mounting the Binary​

Before deploying the Kong Docker container, we first must create or update your Kong Dockerfile to mount the Corsha Kong Plugin binary into the container.

Below is an example Dockerfile, which assumes the Corsha Kong plugin binary is located in bin/

Replace corsha-docker.jfrog.io/kong/kong-gateway with the artifact repository where the Kong image you are using is located.

FROM corsha-docker.jfrog.io/kong/kong-gateway:<VERSION>

ADD bin/corsha-kong-plugin /usr/local/bin/corsha-kong-plugin

Build and push the image created from this Dockerfile. We will use it in our Helm deployment.

Using Additional Roots of Trust​

If necessary, we can configure an additional Certificate Authority.

To do so:

  1. Create a Kubernetes secret that holds the root Certificate Authority.
kubectl create secret generic <Secret Name> --from-file=path/to/your/ca-bundle.crt -n corsha
  1. Create a Volume and Volume Mount via Helm by adding the following values to your overrides:
deployment:
  userDefinedVolumes:
  - name: ca-cert-bundle
    secret:
      secretName: <Secret Name>
  userDefinedVolumeMounts:
  - name: ca-cert-bundle
    mountPath: "/etc/ssl/certs/"
  1. Set trusted certificate variable in Chart by adding the following to your overrides
env:
  nginx_proxy_proxy_ssl_trusted_certificate: "/etc/ssl/certs/root.ca.crt"

Deploying with Helm​

Apply the following overrides to your Kong configuration and deploy the API Gateway as you normally would.

securityContext:
  readOnlyRootFilesystem: false
env:
  plugins: "corsha-kong-plugin"
  pluginserver_names: "corsha-kong-plugin"
  pluginserver_corsha_kong_plugin_query_cmd: "/usr/local/bin/corsha-kong-plugin -dump"

You must also ensure your values point to the image created with the binary mounted.

tip

Replace /usr/local/bin/corsha-kong-plugin with path to where the binary was mounted in the Dockerfile

Next we'll make a request with a Corsha Cred through Kong + Corsha. You will need to outfit your API clients with Corsha Authenticators using the guide to Adding an Authenticator to API Clients.