Access a service internally without Ingress or HTTPRoute

[konsti]

We want to use the Kong AI Gateway functionality through the ai-proxy plugin for our services. We have created the KongPlugin, a Kubernetes Service, and an Ingress resource. The plugin is attached to the service using the konghq.com/plugin annotation.

✅ The AI proxy works correctly when sending requests to the ingress path in the OpenAI format.

🚫 It only started working after adding an Ingress resource. Without the Ingress, the kong-ingress-controller never detects or configures the service. Additionally, internal requests sent directly to service-name.namespace.svc.cluster.local are not proxied to the AI endpoint; instead, they attempt to reach the real upstream endpoint.

How can we expose the Kong AI Gateway to our internal services without making it accessible externally?

[pmalek]

You could achieve that my using a ClusterIP proxy Service.

• With the chart that would be specified by https://github.com/Kong/charts/blob/0b27b4aa3b19c0031879e0810a49a2afa9f931c9/charts/kong/values.yaml#L284

• Using KGO and Gateway (with HTTPRoute) you could specify the ingress service type via https://docs.konghq.com/gateway-operator/latest/reference/custom-resources/#gatewayconfigserviceoptions, like so:

  kind: GatewayConfiguration
  apiVersion: gateway-operator.konghq.com/v1beta1
  metadata:
    name: kong
    namespace: default
  spec:
    dataPlaneOptions:
      deployment:
        podTemplateSpec:
          spec:
            containers:
            - name: proxy
              image: kong/kong-gateway:3.8
      network:
        services:
          ingress:
            type: ClusterIP