I use Kong ingress controller in my aks cluster, and I try to add the key-auth plugin to use in my ingress, and it works but there is a big problem in this setup, all the keys working for all the ingress's using this plugin, even in different namespaces.
this is my setup:
a new application named nginx1:
...
annotations:
konghq.com/plugins: nginx1-apikey
kubernetes.io/ingress.class: kong
...
---
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
name: nginx1
namespace: nginx1
annotations:
kubernetes.io/ingress.class: kong
username: nginx1
credentials:
- nginx1-apikey
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: nginx1-apikey
namespace: nginx1
plugin: key-auth
and a second application named nginx2:
...
annotations:
konghq.com/plugins: nginx2-apikey
kubernetes.io/ingress.class: kong
...
---
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
name: nginx2
namespace: nginx2
annotations:
kubernetes.io/ingress.class: kong
username: nginx2
credentials:
- nginx1-apikey
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: nginx2-apikey
namespace: nginx2
plugin: key-auth
and the i crated a secrets for each plugins:
kubectl create secret -n nginx1 generic nginx1-apikey \
--from-literal=kongCredType=key-auth \
--from-literal=key=1234
kubectl create secret -n nginx2 generic nginx2-apikey \
--from-literal=kongCredType=key-auth \
--from-literal=key=5678
this setup works fine, but both key work for both endpoints:
there is any way to restrict the secret to spesific ingress?