How to avoid free access to upstream service after deleting kong plugin?

Kubernetes
1

I observed, when you have proper configured Kong ingress with authorization (for example with JWT plugin), when you accidentally remove Kong CRD plugin instance, you have full access to upstream without any authorization.

Is there any way to defend against this behavior? Something like: when you have plugins.konghq.com definied on your ingress, you get the 502 error code until there is no proper kong CRD plugin instance available for ingress?

2

There is no such mechanism available out of the box. One way you can do it is to not give delete permissions for KongPlugin resource to users and keep it available only for Cluste such users.

The controller parses all the resources and configures Kong with all the resources that it can find.