docs(kgo): add Konnect entities documentation

.github/styles/kong/dictionary.txt

@@ -230,6 +230,7 @@ ElastiCache
 elbs
 enablement
 enqueued
+enqueues
 enum
 env
 Equinix

app/_data/docs_nav_kgo_1.4.x.yml

@@ -105,6 +105,28 @@ items:
             url: /guides/upgrade/data-plane/blue-green/
       - text: Kong Custom Plugin Distribution
         url: guides/plugin-distribution/
+      - text: Managing Konnect entities
+        items:
+          - text: Architecture overview
+            url: /guides/konnect-entities/architecture/
+          - text: Gateway Control Plane
+            url: /guides/konnect-entities/gatewaycontrolplane/
+          - text: Service and Route
+            url: /guides/konnect-entities/service-and-route/
+          - text: Consumer, Credentials and Consumer Groups
+            url: /guides/konnect-entities/consumer-and-consumergroup/
+          - text: Key and Key Set
+            url: /guides/konnect-entities/key-and-keyset/
+          - text: Upstream and Targets
+            url: /guides/konnect-entities/upstream-and-target/
+          - text: Certificate and CA Certificate
+            url: /guides/konnect-entities/certificate-and-cacertificate/
+          - text: Vault
+            url: /guides/konnect-entities/vault/
+          - text: Data Plane Client Certificate
+            url: /guides/konnect-entities/dpcertificate/
+          - text: Tagging and Labeling
+            url: /guides/konnect-entities/tagging-and-labeling/
   - title: Reference
     icon: /assets/images/icons/icn-magnifying-glass.svg
     items:

app/_includes/md/kgo/check-condition.md

@@ -0,0 +1,24 @@
+{% assign name = include.name %}
+{% assign kind = include.kind %}
+{% assign conditionType = include.conditionType | default: "Programmed" %}
+{% assign reason = include.reason | default: "Programmed" %}
+{% assign generation = include.generation | default: 1 %}
+
+{% unless include.disableDescription %}
+You can verify the `{{ kind }}` was reconciled successfully by checking its `{{ conditionType }}` condition.
+{% endunless %}
+
+```shell
+kubectl get {{ kind | downcase }} {{ name }} -o=jsonpath='{.status.conditions[?(@.type=="{{ conditionType }}")]}' | jq
+```
+
+The output should look similar to this:
+
+```console
+{
+  "observedGeneration": {{ generation }},
+  "reason": "{{ reason }}",
+  "status": "True",
+  "type": "{{ conditionType }}"
+}
+```

app/_includes/md/kgo/konnect-entities-prerequisites.md

@@ -0,0 +1,133 @@
+{% unless include.disable_accordian %}
+<details class="custom" markdown="1">
+<summary>
+<blockquote class="note">
+  <p style="cursor: pointer">Before you create any Konnect entity, make sure you've <u>installed {{site.kgo_product_name}} and created a valid `KonnectAPIAuthConfiguration` {% if include.with-control-plane %} and `KonnectGatewayControlPlane`{% endif %}</u> in your cluster.</p>
+</blockquote>
+</summary>
+
+## Prerequisites
+{% endunless %}
+
+{% include md/kgo/prerequisites.md disable_accordian=true version=page.version release=page.release kconf-crds=true %}
+
+### Create an access token in Konnect
+
+You may create either a Personal Access Token (PAT) or a Service Account Token (SAT) in Konnect. Please refer to the
+[Konnect authentication documentation](/konnect/api/#authentication) for more information. You will need this token
+to create a `KonnectAPIAuthConfiguration` object that will be used by the {{site.kgo_product_name}} to authenticate
+with Konnect APIs.
+
+### Create a {{site.konnect_product_name}} API auth configuration
+
+Depending on your preferences, you can create a `KonnectAPIAuthConfiguration` object with the token specified
+directly in its spec or as a reference to a Kubernetes Secret. The `serverURL` field should be set to the Konnect API
+URL in a region where your {{site.konnect_product_name}} account is located. Please refer to the [list of available API URLs](/konnect/network/)
+for more information.
+
+{% navtabs token %}
+{% navtab Directly in specification %}
+```yaml
+echo '
+kind: KonnectAPIAuthConfiguration
+apiVersion: konnect.konghq.com/v1alpha1
+metadata:
+  name: konnect-api-auth
+  namespace: default
+spec:
+  type: token
+  token: kpat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+  serverURL: eu.api.konghq.com
+' | kubectl apply -f -
+```
+{% endnavtab %}
+{% navtab Stored in a Secret %}
+Please note that the Secret must have the `konghq.com/credential: konnect` label to make the {{site.kgo_product_name}}
+reconcile it.
+
+```yaml
+echo '
+kind: KonnectAPIAuthConfiguration
+apiVersion: konnect.konghq.com/v1alpha1
+metadata:
+  name: konnect-api-auth
+  namespace: default
+spec:
+  type: secretRef
+  secretRef:
+    name: konnect-api-auth-secret
+  serverURL: eu.api.konghq.com
+---
+kind: Secret
+apiVersion: v1
+metadata:
+  name: konnect-api-auth-secret
+  namespace: default
+  labels:
+    konghq.com/credential: konnect
+stringData:
+  token: kpat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+' | kubectl apply -f -
+```
+{% endnavtab %}
+{% endnavtabs %}
+
+You can verify the `KonnectAPIAuthConfiguration` object was reconciled successfully by checking its status.
+
+```shell
+kubectl get konnectapiauthconfiguration konnect-api-auth
+```
+
+The output should look like this:
+
+```console
+NAME               VALID   ORGID                                  SERVERURL
+konnect-api-auth   True    <your-konnect-org-id>                  https://eu.api.konghq.tech
+```
+
+{% if include.with-control-plane %}
+### Create a {{site.base_gateway}} control plane
+
+Creating the `KonnectGatewayControlPlane` object in your Kubernetes cluster will provision a {{site.konnect_product_name}} Gateway
+control plane in your [Gateway Manager](/konnect/gateway-manager). The `KonnectGatewayControlPlane` CR
+[API](/gateway-operator/{{ page.release }}/reference/custom-resources/#konnectgatewaycontrolplane) allows you to
+explicitly set a type of the {{site.base_gateway}} control plane, but if you don't specify it, the default type is
+a [Self-Managed Hybrid
+gateway control plane](/konnect/gateway-manager/#kong-gateway-control-planes).
+
+You can create one by applying the following YAML manifest:
+
+```yaml
+echo '
+kind: KonnectGatewayControlPlane
+apiVersion: konnect.konghq.com/v1alpha1
+metadata:
+  name: gateway-control-plane
+  namespace: default
+spec:
+  name: gateway-control-plane # Name used to identify the Gateway Control Plane in Konnect
+  konnect:
+    authRef:
+      name: konnect-api-auth # Reference to the KonnectAPIAuthConfiguration object
+  ' | kubectl apply -f -
+```
+
+You can see the status of the Gateway Control Plane by running:
+
+```shell
+kubectl get konnectgatewaycontrolplanes.konnect.konghq.com gateway-control-plane
+```
+
+If the Gateway Control Plane is successfully created, you should see the following output:
+
+```shell
+NAME                    PROGRAMMED   ID                                     ORGID
+gateway-control-plane   True         <konnect-control-plane-id>             <your-konnect-ord-id>
+```
+
+Having that in place, you will be able to reference the `gateway-control-plane` in your {{site.konnect_product_name}} entities as their parent.
+{% endif %}
+
+{% unless include.disable_accordian %}
+</details>
+{% endunless %}

app/_includes/md/kgo/prerequisites.md

@@ -2,7 +2,7 @@
 <details class="custom" markdown="1">
 <summary>
 <blockquote class="note">
-  <p style="cursor: pointer">Before you begin, ensure that you have <u>installed the {{site.kgo_product_name}}</u> in your Kubernetes cluster{% if include.aiGateway %} with AI Gateway support enabled{% endif %}{% if include.kongplugininstallation %} with KongPluginInstallation support enabled{% endif %}. {% if include.enterprise %}This guide requires an enterprise license.{% endif %}</p>
+  <p style="cursor: pointer">Before you begin, ensure that you have <u>installed the {{site.kgo_product_name}}</u> in your Kubernetes cluster{% if include.aiGateway %} with AI Gateway support enabled{% endif %}{% if include.kongplugininstallation %} with KongPluginInstallation support enabled{% endif %}{% if include.kconf-crds %} with Kong's Kubernetes Configuration CRDs enabled{% endif %}. {% if include.enterprise %}This guide requires an enterprise license.{% endif %}</p>
 </blockquote>
 </summary>
 
@@ -33,7 +33,7 @@ kubectl apply -f {{site.links.web}}/assets/gateway-operator/ai-gateway-crd.yaml
 
 ### Install {{ site.kgo_product_name }}
 
-{% include snippets/gateway-operator/install_with_helm.md version=include.version release=include.release %}
+{% include snippets/gateway-operator/install_with_helm.md version=include.version release=include.release kconf-crds=include.kconf-crds %}
 
 
 {%- if include.aiGateway %}

app/_includes/snippets/gateway-operator/install_with_helm.md

@@ -13,7 +13,7 @@ helm repo update kong
 Install {{ site.kgo_product_name }} with Helm:
 
 ```bash
-helm upgrade --install kgo kong/gateway-operator -n kong-system --create-namespace --set image.tag={{ kgo_version }}
+helm upgrade --install kgo kong/gateway-operator -n kong-system --create-namespace --set image.tag={{ kgo_version }} {{ if include.kconf-crds }}--set kubernetes-configuration-crds.enabled=true{{ endif }}
 ```
 
 You can wait for the operator to be ready using `kubectl wait`: