# Configure ACL using Kong Ingress Controller **URL:** \ **Category:** Questions\ **Tags:** kubernetes\ **Created:** [October 10, 2018, 4:04am UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073 "2018-10-10T04:04:01Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![chlung](https://avatars.discourse-cdn.com/v4/letter/c/a6a055/32.png) [@chlung](https://discuss.konghq.com/u/chlung)\ **Post date:** [October 10, 2018, 4:04am UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/1 "2018-10-10T04:04:01Z")
Hi, I am looking for how to set up ACL using KongPlugin and KongConsumer in the following two area. 1. Whitelist and blacklist 2. GET, POST, PUT, and DELETE ACL Thanks. ---
**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\ **Post date:** [October 12, 2018, 6:25pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/2 "2018-10-12T18:25:24Z")
Hello @chlung, Please configure the ACL plugin using [KongPlugin](https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/custom-resources.md#kongplugin). Then, to create a consumer in Kong, use the [KongConsumer](https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/custom-resources.md#kongconsumer) CRD. Once, you have the Consumer in Kong, to configure ACL for a consumer, use [KongCredential](https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/custom-resources.md#kongcredential) custom resource of type `acl`. ---
**Author:** ![chlung](https://avatars.discourse-cdn.com/v4/letter/c/a6a055/32.png) [@chlung](https://discuss.konghq.com/u/chlung)\ **Post date:** [October 18, 2018, 6:38pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/3 "2018-10-18T18:38:46Z")
@hbagdi I tried KongPlugin with type acl, but the blacklist does not work as expected. Do I miss something here? ``` apiVersion: configuration.konghq.com/v1 kind: KongPlugin metadata: name: test-acl plugin: acl config: blacklist: foo.bar hide_group_header: true apiVersion: extensions/v1beta1 kind: Ingress metadata: name: acl-apis namespace: dummy annotations: configuration.konghq.com: kongingress-api plugins.konghq.com: acl-basic-auth plugins.konghq.com: test-acl spec: rules: - host: foo.bar http: paths: - path: / backend: serviceName: http-svc servicePort: 80 ``` I am still able to access blacklist api. I did notice an error in Kong-Ingress-Controller log, ``` E1018 10:19:19.464105 7 controller.go:130] unexpected failure updating Kong configuration: creating a global Kong plugin &{{{ } { 0 0001-01-01 00:00:00 +0000 UTC <nil> <nil> map[] map[] [] nil [] } [] 0 0} basic-auth map[hide_credentials:false] false }: the server reported a conflict (post plugins.meta.k8s.io) ``` Thanks. ---
**Author:** ![Ngob](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/ngob/32/386_2.png) [@Ngob](https://discuss.konghq.com/u/Ngob)\ **Post date:** [October 19, 2018, 12:31pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/4 "2018-10-19T12:31:30Z")
Hello, Did you try: ```auto plugins.konghq.com: acl-basic-auth,test-acl ``` I do not think you can add multiple annotation with the same name ---
**Author:** ![chlung](https://avatars.discourse-cdn.com/v4/letter/c/a6a055/32.png) [@chlung](https://discuss.konghq.com/u/chlung)\ **Post date:** [October 19, 2018, 1:27pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/5 "2018-10-19T13:27:23Z")
@Ngob Thanks. I just tried, and I am still get the result back. ---
**Author:** ![Ngob](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/ngob/32/386_2.png) [@Ngob](https://discuss.konghq.com/u/Ngob)\ **Post date:** [October 19, 2018, 1:46pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/6 "2018-10-19T13:46:17Z")
Isn’t the error about `basic-auth` ? I can see `acl-basic-auth,test-acl` in your configuration but not `basic-auth` ---
**Author:** ![chlung](https://avatars.discourse-cdn.com/v4/letter/c/a6a055/32.png) [@chlung](https://discuss.konghq.com/u/chlung)\ **Post date:** [October 19, 2018, 2:06pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/7 "2018-10-19T14:06:24Z")
@Ngob My issue is about blacklist not error. I also notice the error in log. As you said, the error in log goes away after I combine the plugin into a list, but the blacklist still return result. Do I miss-interpret the behavior? Thanks. ---
**Author:** ![dcherniv](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/dcherniv/32/1380_2.png) [@dcherniv](https://discuss.konghq.com/u/dcherniv)\ **Post date:** [December 24, 2018, 10:42pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/8 "2018-12-24T22:42:15Z")
@hbagdi the KongCredential CRD type acl doesn’t work properly. The group is never associated to the consumer. ingress annotations: `plugins.konghq.com: tokenizer-auth,tokenizer-prometheus,tokenizer-ratelimit,tokenizer-acl` tokenizer-acl plugin: ```auto apiVersion: configuration.konghq.com/v1 kind: KongPlugin metadata: name: tokenizer-acl namespace: dev plugin: acl config: whitelist: tokenizer-group hide_groups_header: "true" ``` consumer and one api-key credential: ```auto apiVersion: v1 items: - apiVersion: configuration.konghq.com/v1 kind: KongConsumer metadata: name: tokenizer username: tokenizer kind: List --- apiVersion: configuration.konghq.com/v1 kind: KongCredential metadata: name: tokenizer consumerRef: tokenizer type: key-auth config: key: REDACTED ``` Finally acl credential of type acl: ```auto apiVersion: configuration.konghq.com/v1 kind: KongCredential group: "tokenizer-group" metadata: name: tokenizer-group4 namespace: dev consumerRef: tokenizer type: acl config: group: "tokenizer-group" ``` I also tried different ways to define the credential: ```auto apiVersion: configuration.konghq.com/v1 kind: KongCredential metadata: name: tokenizer-group4 namespace: dev consumerRef: tokenizer type: acl config: group: "tokenizer-group" ``` Was tried and doesn’t work either. Response from kong: ```auto / # curl http://localhost:8001/consumers/tokenizer/acls {"total":0,"data":[]} ``` Nothing of note in the logs except `entity 'acl' not registered` but i think this is because the acl plugin didn’t get added to the ingress before the credential got applied. ---
**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\ **Post date:** [December 26, 2018, 6:45pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/9 "2018-12-26T18:45:14Z")
Hi guys, I can confirm that this will not work as expected in the current Ingress Controller versions. Kong Ingress Controller 0.3.0 is in the works which will add support for ACLs. The ACL plugin was supported but associating ACL groups to consumers was not. The following commit adds support for ACLs in the underlying library used to talk to Kong: > Stay tuned for the next release! ---
**Author:** ![dcherniv](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/dcherniv/32/1380_2.png) [@dcherniv](https://discuss.konghq.com/u/dcherniv)\ **Post date:** [December 27, 2018, 8:17pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/10 "2018-12-27T20:17:20Z")
@hbagdi will this PR allow us to associate other plugins to consumers? or is it strictly for ACL? It seems even associating a ratelimiter plugin is not possible currently. ---
**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\ **Post date:** [January 2, 2019, 6:00pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/11 "2019-01-02T18:00:26Z")
It should be possible using the `consumerRef` property: > ---
**Author:** ![dcherniv](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/dcherniv/32/1380_2.png) [@dcherniv](https://discuss.konghq.com/u/dcherniv)\ **Post date:** [January 27, 2019, 12:18am UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/12 "2019-01-27T00:18:43Z")
@hbagdi I just tried and ACL works as expected, however I don’t think i quite understand how other plugins are supposed to work. in konga it’s possible to add a plugin to a consumer: ![image](https://canada1.discourse-cdn.com/flex036/uploads/konghq/original/1X/4e15f664708c40316ed94ec6ca1f0cc9515771d7.png) How would i go about achieving the same behavior? I can’t seem to attach two different plugins of the same type to the ingress: ```auto plugins.konghq.com: dev-service-ratelimit, dev-service-consumer-ratelimit ``` Kong invariably picks just one. And when i create a rate limit plugin with just the consumerRef, without attaching to ingress, it just seems to be ignored. My use case is basically to be able to set multiple rate limits. One at the ingress level that applies to all consumers, and others at individual consumers so they can be throttled separately. ---
**Author:** ![Juan\_Manuel\_Vizcaino](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Juan\_Manuel\_Vizcaino](https://discuss.konghq.com/u/Juan_Manuel_Vizcaino)\ **Post date:** [February 20, 2019, 2:49pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/13 "2019-02-20T14:49:55Z")
I got the same problem using prometheus plugin. When i assign the plugin to the consumer using consumerRef: doesn’t work. Consumer doesn’t have any plugin. Konga problem or kong problem ? I think is a kong problem because the plugin doesn’t work. ---
**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\ **Post date:** [March 21, 2019, 7:26pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/14 "2019-03-21T19:26:04Z")
> [@Juan\_Manuel\_Vizcaino](#): > > I got the same problem using prometheus plugin. When i assign the plugin to the consumer using consumerRef: doesn’t work. Prometheus plugin doesn’t have a notion of consumer and enabling it on a consumer level doesn’t make much sense. ---
**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\ **Post date:** [March 21, 2019, 7:29pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/15 "2019-03-21T19:29:49Z")
> [@dcherniv](#): > > Kong invariably picks just one. And when i create a rate limit plugin with just the consumerRef, without attaching to ingress, it just seems to be ignored. This is a limitation currently and is expected to go away in future. You can also track the following issue: > > > Currently, plugins can be defined on route level, service level or a combination… of route+consumer and service+consumer. > > The controller should be able to configure consumer-only plugin.