# Global KongPlugin is not defiend

**URL:** <https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353>\
**Category:** Questions\
**Tags:** kubernetes\
**Created:** [November 28, 2018, 1:45pm UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353 "2018-11-28T13:45:53Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![alx8](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/alx8/32/644_2.png) [@alx8](https://discuss.konghq.com/u/alx8)\
**Post date:** [November 28, 2018, 1:45pm UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/1 "2018-11-28T13:45:53Z")

</div>

I have installed Kong Ingress on Kubernetes cluster (AKS) using following these steps:  
[https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/deployment/aks.md](https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/deployment/aks.md)

Defined Ingress and can access my API, checked Postgres routes table and can see the route is there.

I wanted to define global KongPlugin and then to use it via annotations in my Ingress but the plugin is not defined, there is no plugin in plugins table and no plugin in via the admin api.

Used documentation from:  
[https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/custom-resources.md#kongplugin](https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/custom-resources.md#kongplugin)

KongPlugin yaml:

> ```
> apiVersion: configuration.konghq.com/v1
> kind: KongPlugin
> metadata:
> name: ip-restriction-global
> namespace: kong
> labels:
> global: "true"
> enabled: true
> config:
> key: value
> plugin: ip-restriction
> 
> ```

Tried with/without “enabled” /“disabled” field.

---

<div class="post-metadata">

**Author:** ![salamando](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@salamando](https://discuss.konghq.com/u/salamando)\
**Post date:** [November 29, 2018, 10:01am UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/2 "2018-11-29T10:01:13Z")

</div>

The same problem to me.  
I create a kongplugin just the same with

> <https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/deployment/minikube.md#configure-a-kong-plugin-using-annotations-in-ingress>

  
and patch the annotation to ingress.

But when i curl http {KONG\_ADMIN\_IP}:{KONG\_ADMIN\_PORT}/plugins  
i got this { “total”: 0, “data”: [] }

Add plugins with http interface is working

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [December 3, 2018, 10:14pm UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/3 "2018-12-03T22:14:10Z")

</div>

Hello @alx8

The following KongPlugin spec looks incorrect as `global : "true"` is not nested under `labels`.

```auto
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ip-restriction-global
  namespace: kong
  labels:
global: "true"
enabled: true
config:
key: value
plugin: ip-restriction

```

Could you instead try the following?

```auto
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ip-restriction-global
  namespace: kong
  labels:
    global: "true"
config:
  key: value
plugin: ip-restriction

```

Could you verify if this works for you and then mark this post as resolved if this helps?

---

<div class="post-metadata">

**Author:** ![alx8](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/alx8/32/644_2.png) [@alx8](https://discuss.konghq.com/u/alx8)\
**Post date:** [December 4, 2018, 7:19am UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/4 "2018-12-04T07:19:05Z")

</div>

@hbagdi Hello,  
Thank you for you answer.  
I used the `global : "true"` nested under labels as you suggested, indentation probably was broke when I pasted the yaml here.  
But still, the plugin is not available.

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [December 4, 2018, 6:43pm UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/5 "2018-12-04T18:43:24Z")

</div>

@alx8 Do you see any errors in the logs of the Ingress controller?  
Also, which version of Kong Ingress controller are you using?

---

<div class="post-metadata">

**Author:** ![alx8](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/alx8/32/644_2.png) [@alx8](https://discuss.konghq.com/u/alx8)\
**Post date:** [December 5, 2018, 9:52am UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/6 "2018-12-05T09:52:14Z")

</div>

## @hbagdi This is my Kong Ingress Version: ------------------------------------------------------------------------------- Kong Ingress controller Release: 0.2.0 Build: git-de9e38c6 Repository: [git@github.com](mailto:git@github.com):Kong/kubernetes-ingress-controller.git

This is the error I see in the Kong Ingress controller pod log:

> ```
> I1205 09:44:46.944359 6 controller.go:127] syncing Ingress configuration...
> 
> ```
> 
> I1205 09:44:47.262917 6 kong.go:124] syncing global plugins  
> E1205 09:44:47.266002 6 controller.go:130] unexpected failure updating Kong configuration:  
> creating a global Kong plugin &{{{ } { 0 0001-01-01 00:00:00 +0000 UTC map map nil } 0 0} ip-restriction map[key:value] false }: the server rejected our request for an unknown reason (post [plugins.meta.k8s.io](http://plugins.meta.k8s.io))  
> W1205 09:44:47.266037 6 queue.go:113] requeuing kong/ip-restriction-global, err creating a global Kong plugin &{{{ } { 0 0001-01-01 00:00:00 +0000 UTC map map nil } 0 0} ip-restriction map[key:value] false }: the server rejected our request for an unknown reason (post [plugins.meta.k8s.io](http://plugins.meta.k8s.io))  
> I1205 09:44:50.277855 6 controller.go:127] syncing Ingress configuration…  
> I1205 09:44:50.595904 6 kong.go:124] syncing global plugins  
> E1205 09:44:50.598290 6 controller.go:130] unexpected failure updating Kong configuration:  
> creating a global Kong plugin &{{{ } { 0 0001-01-01 00:00:00 +0000 UTC map map nil } 0 0} ip-restriction map[key:value] false }: the server rejected our request for an unknown reason (post [plugins.meta.k8s.io](http://plugins.meta.k8s.io))

Tried without  
config:  
 key: value  
Got same error:

> I1205 09:48:50.413536 6 kong.go:124] syncing global plugins  
> E1205 09:48:50.415775 6 controller.go:130] unexpected failure updating Kong configuration:  
> creating a global Kong plugin &{{{ } { 0 0001-01-01 00:00:00 +0000 UTC map map nil } 0 0} ip-restriction map false }: the server rejected our request for an unknown reason (post [plugins.meta.k8s.io](http://plugins.meta.k8s.io))  
> W1205 09:48:50.415832 6 queue.go:113] requeuing kong/ip-restriction-global, err creating a global Kong plugin &{{{ } { 0 0001-01-01 00:00:00 +0000 UTC map map nil } 0 0} ip-restriction map false }: the server rejected our request for an unknown reason (post [plugins.meta.k8s.io](http://plugins.meta.k8s.io))

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [December 5, 2018, 6:15pm UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/7 "2018-12-05T18:15:16Z")

</div>

I’d assumed that the `key: value` was an actual config but the first error log seems to indicate that you had put in the `key: value` part in the YAML as is.

The request fails without the config because IP restrictions plugin, [as per the docs](https://docs.konghq.com/hub/kong-inc/ip-restriction/), needs a bare minimum config and won’t work without a config.

The following should work fine:

```auto
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ip-restriction-global
  namespace: kong
  labels:
    global: "true"
config:
  whitelist:
  - "10.0.0.0/8"
plugin: ip-restriction

```

---

<div class="post-metadata">

**Author:** ![alx8](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/alx8/32/644_2.png) [@alx8](https://discuss.konghq.com/u/alx8)\
**Post date:** [December 6, 2018, 12:36pm UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/8 "2018-12-06T12:36:06Z")

</div>

@hbagdi thank you, this way the plugin is deployed.  
In our current deployment we have ip-restriction plugin per API.  
The question is if I config whitlist in KongPlugin like you suggested it will effect all Ingresses?  
How I deploy ip-restriction plugin per API with different whitelist/blacklist configs in each API ?

Actually what I am asking is how to set the plugin config for each Ingress independently from the KongPlugin config ?

Thank you

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [December 7, 2018, 6:56pm UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/9 "2018-12-07T18:56:15Z")

</div>

@alx8

You can create `KongPlugin` resources without the `global : "true"` label. This will actually not create a plugin in Kong.

Then you associate the plugin with the Ingress using the [plugins.konghq.com](https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/annotations.md#pluginskonghqcom) annotation. This will create the plugin on the Route corresponding to your Ingress. This let’s you finely control which plugins run on each Ingress.

---

<div class="post-metadata">

**Author:** ![alx8](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/alx8/32/644_2.png) [@alx8](https://discuss.konghq.com/u/alx8)\
**Post date:** [December 8, 2018, 2:55pm UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/10 "2018-12-08T14:55:00Z")

</div>

This was the missing part (:  
Then last question, I deployed Kongplugin and KongIngress, how do I use the [configuration.konghq.com](http://configuration.konghq.com) annotation properly.  
How to set config in Ingress for the plugin?  
How to associate config to plugin , for example if I have few plugins used with one Ingress , let’s say ip-restriction and udp-logs.

This is my Ingress (tried different options for [configuration.konghq.com](http://configuration.konghq.com)) :

> ```
> apiVersion: extensions/v1beta1
> kind: Ingress
> metadata:
> name: kong-admin
> namespace: kong
> annotations:
> kubernetes.io/ingress.class: "nginx"
> plugins.konghq.com: ip-restriction-global
> configuration.konghq.com: "config.whitelist=54.13.21.1"
> spec:
> rules:
> - host: kongadmin.kong.example
> http:
> paths:
> - path: "/"
> backend:
> serviceName: kong-ingress-controller
> servicePort: 8001
> 
> ```

Thanks a lot!

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [December 14, 2018, 7:22pm UTC](https://discuss.konghq.com/t/global-kongplugin-is-not-defiend/2353/11 "2018-12-14T19:22:54Z")

</div>

@alx8,

`configuration.konghq.com` annotation is used to associate a KongIngress resource with an Ingress resource. It has nothing to do with a plugin.

You define configs for the plugins in the `KongPlugin` custom resource under the `config` property.

Also, a `global` plugin (KongPlugin with a label `global: "true"`) doesn’t need to be applied at the Ingress level, it will be applied for every request that is proxied via Kong.

Hope this helps!