kong ingress key-auth plugin work for all endpoints

8/2/2021

I use Kong ingress controller in my aks cluster, and I try to add the key-auth plugin to use in my ingress, and it works but there is a big problem in this setup, all the keys working for all the ingress's using this plugin, even in different namespaces.

this is my setup:

a new application named nginx1:

...
  annotations:
    konghq.com/plugins: nginx1-apikey
    kubernetes.io/ingress.class: kong
...
---
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: nginx1
  namespace: nginx1
  annotations:
    kubernetes.io/ingress.class: kong
username: nginx1
credentials:
- nginx1-apikey

---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: nginx1-apikey
  namespace: nginx1
plugin: key-auth

and a second application named nginx2:

...
  annotations:
    konghq.com/plugins: nginx2-apikey
    kubernetes.io/ingress.class: kong
...
---
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: nginx2
  namespace: nginx2
  annotations:
    kubernetes.io/ingress.class: kong
username: nginx2
credentials:
- nginx1-apikey

---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: nginx2-apikey
  namespace: nginx2
plugin: key-auth

and the i crated a secrets for each plugins:

kubectl create secret -n nginx1 generic nginx1-apikey  \
  --from-literal=kongCredType=key-auth  \
  --from-literal=key=1234
kubectl create secret -n nginx2 generic nginx2-apikey  \
  --from-literal=kongCredType=key-auth  \
  --from-literal=key=5678

this setup works fine, but both key work for both endpoints: enter image description here

there is any way to restrict the secret to spesific ingress?

-- Mendi Neymark
azure-aks
ingress-controller
kong
kong-ingress
kubernetes

0 Answers