# Configure ACL using Kong Ingress Controller

**URL:** <https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073>\
**Category:** Questions\
**Tags:** kubernetes\
**Created:** [October 10, 2018, 4:04am UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073 "2018-10-10T04:04:01Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![dcherniv](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/dcherniv/32/1380_2.png) [@dcherniv](https://discuss.konghq.com/u/dcherniv)\
**Post date:** [December 24, 2018, 10:42pm UTC](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073/8 "2018-12-24T22:42:15Z")

</div>

@hbagdi the KongCredential CRD type acl doesn’t work properly. The group is never associated to the consumer.  
ingress annotations:  
`plugins.konghq.com: tokenizer-auth,tokenizer-prometheus,tokenizer-ratelimit,tokenizer-acl`

tokenizer-acl plugin:

```auto
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: tokenizer-acl
  namespace: dev
plugin: acl
config:
  whitelist: tokenizer-group  
  hide_groups_header: "true"  

```

consumer and one api-key credential:

```auto
apiVersion: v1
items:
- apiVersion: configuration.konghq.com/v1
  kind: KongConsumer
  metadata:
    name: tokenizer
  username: tokenizer
kind: List
---
apiVersion: configuration.konghq.com/v1
kind: KongCredential
metadata:
  name: tokenizer
consumerRef: tokenizer
type: key-auth
config:
  key: REDACTED

```

Finally acl credential of type acl:

```auto
apiVersion: configuration.konghq.com/v1
kind: KongCredential
group: "tokenizer-group"
metadata:
  name: tokenizer-group4
  namespace: dev
consumerRef: tokenizer
type: acl
config:
  group: "tokenizer-group"

```

I also tried different ways to define the credential:

```auto
apiVersion: configuration.konghq.com/v1
kind: KongCredential
metadata:
  name: tokenizer-group4
  namespace: dev
consumerRef: tokenizer
type: acl
config:
  group: "tokenizer-group"

```

Was tried and doesn’t work either.

Response from kong:

```auto
/ # curl http://localhost:8001/consumers/tokenizer/acls
{"total":0,"data":[]}

```

Nothing of note in the logs except `entity 'acl' not registered`  
but i think this is because the acl plugin didn’t get added to the ingress before the credential got applied.

---

_[View the full topic](https://discuss.konghq.com/t/configure-acl-using-kong-ingress-controller/2073)._