Basic authentication configuration with database (Postgres)

Kubernetes
1

Hi Team,

I’m able to configure (service, route, consumer & credentials)the basic-auth using documentation Admin API’s - Basic Authentication plugin | Kong Docs .
I want to use of yaml files - plugin enable, KongPlugin resource to service (present in documentation), Create a Consumer & Create a Credential (no sample yaml file/kind exists in documentation)
Kong gateway + DB (Postgres) deployed in namespace-1
Service is available in namespace-2
How to configure this using yaml based?

Regards
Heman

2

Are you just looking for instructions to create the consumer and its credential? Provisioning Consumers and Credentials - v2.5.x | Kong Docs is the documentation that shows that. Credential Secrets work the same for all auth plugins: any field you’d set in Basic Authentication plugin | Kong Docs or similar will be a key in the Secret, so something like:

stringData:
  kongCredType: basic-auth
  username: myuser
  password: mypassword
3

here it is,

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: basic-auth-dbmode
annotations:
kubernetes.io/ingress.class: kong
config:
hide_credentials: true
plugin: basic-auth

apiVersion: v1
kind: Secret
metadata:
name: secretconsumer
stringData:
kongCredType: basic-auth
username: username
password: xxxxxx

#create a Consumer and configure the credentials to use the secret created
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
name: consumer
annotations:
kubernetes.io/ingress.class: kong
username: username
credentials:

  • secretconsumer

when we applied at Gateway side and entries are not inserting into DB(Postgres), any other insights here?

4

Basic Authentication plugin | Kong Docs ==> Example plugin configuration

Admin API -

curl -X POST http://localhost:8001/services/SERVICE_NAME|SERVICE_ID/plugins \
    --data "name=basic-auth"  \
    --data "config.hide_credentials=true"

Replace SERVICE_NAME|SERVICE_ID with the id or name of the service that this plugin configuration will target.

its making the entry in database under plugins and even services too

But its not happening if we use kubernetes based for the below ones -

First, create a KongPlugin resource:

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: basic-auth-example
config: 
  hide_credentials: true
plugin: basic-auth

Next, apply the KongPlugin resource to a service by annotating the service as follows:

apiVersion: v1
kind: Service
metadata:
  name: SERVICE_NAME|SERVICE_ID
  labels:
    app: SERVICE_NAME|SERVICE_ID
  annotations:
    konghq.com/plugins: basic-auth-example
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: SERVICE_NAME|SERVICE_ID
  selector:
    app: SERVICE_NAME|SERVICE_ID

does Admin API flavor is applicable to DB mode (Postgres) and kubernetes/YAML is applicable to non DB modes?

5

The Kubernetes YAML applies to both. The controller makes API requests appropriate to whichever mode you’re using on your behalf.

Is that Service used by an Ingress? The controller won’t create any configuration for a Service alone, it has be used as the backend for some Ingress rule or similar.

If so, the first troubleshooting step to take when configuration isn’t updating is the review the controller container logs. It can include errors that indicate if that or some other piece of configuration is invalid and preventing it from sending updates to the Kong admin API.

6

service
service812×685 35 KB

  1. Referring to attached screen shot, this is creating the new service but need to apply the basic-auth plugin to existing service which has created thru service object(Admin API - v2.8.x | Kong Docs).
  2. how it will decide internally to use the Admin API port (8001) while deploying through the yaml file
  3. Kong Hub | Plugins and Integrations | Kong Docs ==> i’m looking for plugins documentation Basic Authentication, OAuth 2.0 Authentication, Kong Spec Expose & Response Size Limiting
    can we deploy these plugins purely using yaml files or Admin API(using curl) + yaml files?

Note: Cluster is residing on tanzu kubernetes.

7

References ,

here, Admin API command is applying basic auth plugin to service which already exists (which is inserting into database and working fine)
Admin API:
curl -X POST http://localhost:8001/services/SERVICE_NAME|SERVICE_ID/plugins
–data “name=basic-auth”
–data “config.hide_credentials=true”

here, plugin and service is getting created independantly, plugin is not applying on service level and functionality is not similar to Admin API
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: basic-auth-example
config:
hide_credentials: true
plugin: basic-auth

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: basic-auth-db
annotations:
kubernetes.io/ingress.class: kong
config:
hide_credentials: true
plugin: basic-auth

=================================================
apiVersion: v1
kind: Service
metadata:
name: SERVICE_NAME|SERVICE_ID
labels:
app: SERVICE_NAME|SERVICE_ID
annotations:
konghq.com/plugins: basic-auth-example
spec:
ports:

  • port: 80
    targetPort: 80
    protocol: TCP
    name: SERVICE_NAME|SERVICE_ID
    selector:
    app: SERVICE_NAME|SERVICE_ID

apiVersion: v1
kind: Service
metadata:
name: httpbin-service
labels:
app: httpbin-service
annotations:
konghq.com/plugins: basic-auth-db
spec:
ports:

  • port: 80
    targetPort: 80
    protocol: TCP
    name: httpbin-service
    selector:
    app: httpbin-service

my requirement is to apply basic-auth plugin(using yaml) to existing service and should insert into database as similar to Admin API with curl command.
looking single yaml file to fulfill the request as similar Admin API with curl command.

8

my comments ==> I’m connecting to cluster using KUBECONFIG file, how it will choose the Admin API mode thru kubernetes(yaml based)

  1. Is that Service used by an Ingress? The controller won’t create any configuration for a Service alone, it has be used as the backend for some Ingress rule or similar.
    my comments ==> defined service & route objects , able to invoke the service thru proxy port( url:kong-proxy of EXTERNAL-IP :proxy port/servicename)
9

The controller reads a CONTROLLER_KONG_ADMIN_URL environment variable to find the admin API. In most installations this is set for you via static configuration (the manifests available in the controller Github repo) or via automation in the Helm chart.

The guides on the plugin pages do show the minimal configuration needed to apply a plugin to a particular resource type because they’re intended as brief reference examples for users already familiar with controller configuration in general. They don’t provide a complete end-to-end set of instructions to create everything you need; that is instead provided by the guides. Again, I’d recommend going through Provisioning Consumers and Credentials - v2.5.x | Kong Docs to get a working example up and to understand the relation between Ingresses and Services first, and then applying that knowledge to the configuration you actually want to create.

10

I have deployed using yaml files(not used Admin API’s) with Ingress pattern and plugin is working fine

11

Thank you Travis … :slight_smile: