KGateway can handle API authentication in production but requires careful setup and integration with existing IAM systems.

Actionable Workflow

1. Install KGateway: Deploy the operator via OperatorHub on OpenShift or apply CRDs manually.

   oc new-project kgateway --display-name="KGateway"  
   oc apply -f https://raw.githubusercontent.com/k6io/k6-main/master/docs/assets/kgateway-operator.yaml  
   

2. Define Authentication Policy: Create a VirtualServer with JWT validation. Example policy below.

3. Bind to Existing IAM: Integrate with Keycloak, Auth0, or OpenID Connect providers. Ensure TLS is enforced.

4. Test End-to-End: Use curl with valid/invalid tokens to validate behavior.

   curl -H "Authorization: Bearer $(cat valid-token.jwt)" https://api.example.com  
   

5. Monitor and Iterate: Watch logs for auth failures and adjust policies as needed.

Concrete Policy Example

apiVersion: gateway.k6.io/v1  
kind: VirtualServer  
metadata:  
  name: auth-example  
spec:  
  host: api.example.com  
  routes:  
  - path: /secure  
    policies:  
      - jwt:  
          issuer: https://keycloak.example.com/auth/realms/myrealm  
          audience: api-server  
          jwksUri: https://keycloak.example.com/auth/realms/myrealm/protocol/openid-connect/certs  

Tooling

• KGateway Operator: Manages CRDs and reconciles configurations.
• OpenShift CLI: For applying policies and checking status (oc get virtualservers).
• Keycloak: Open-source IAM for token issuance and validation (common pairing).

Tradeoffs

• Pros: Tight integration with Kubernetes, declarative config, lightweight compared to Istio.
• Cons: Limited advanced features (rate limiting, canary deployments), requires custom scripting for complex auth flows. Steep learning curve for policy syntax.

Troubleshooting

• 401/403 Errors:

  • Verify token validity at jwt.io.
  • Check KGateway logs: oc logs -l app=k6-gateway.
  • Ensure audience and issuer match provider settings.

• Policy Not Applying:

  • Validate CRD syntax with oc adm validate --files virtualserver.yaml.
  • Check operator status: oc get VirtualServer -o yaml.

• Performance Issues:

  • Monitor CPU/Memory usage of KGateway pods.
  • Avoid complex JWT validation in high-throughput paths (use sidecar caching if needed).

Prevention

• Test Policies Locally: Use k6 to simulate traffic before deploying.
• Audit Regularly: Rotate secrets, review policies for obsolete routes.
• Document Provider Dependencies: Ensure IAM changes (e.g., Keycloak realm updates) are coordinated with KGateway policy updates.

In my experience, KGateway works well for basic auth needs but shouldn’t be the first choice for teams needing out-of-the-box advanced features. Always pair with robust monitoring and a fallback path for auth failures.

Source thread: Does anyone use kgateway for API gateway features like authentication?