# Ingress controller rules not flexible enough

**URL:** <https://discuss.konghq.com/t/ingress-controller-rules-not-flexible-enough/8629>\
**Category:** Questions\
**Tags:** kubernetes\
**Created:** [July 1, 2021, 1:01am UTC](https://discuss.konghq.com/t/ingress-controller-rules-not-flexible-enough/8629 "2021-07-01T01:01:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bgardella](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/bgardella/32/2592_2.png) [@bgardella](https://discuss.konghq.com/u/bgardella)\
**Post date:** [July 1, 2021, 1:01am UTC](https://discuss.konghq.com/t/ingress-controller-rules-not-flexible-enough/8629/1 "2021-07-01T01:01:29Z")

</div>

I have been using Kong in ECS to great effect with manual rules I have set up using the REST/API. The rules are something like this:

HOST: service.one → Rate Limit 1000/second  
HOST: service.one + api-key: 1234-5678 → Rate Limit 10,000/second  
HOST: service.one + api-key: 1234-5678 + PATH: /special-path/\* → Rate Limit 150,000/second

There are no examples that I can find on how to configure multiple Ingress rules to the same service and have those rules yield different rate limits. I can do this easily with the REST/API.

I have only been able to successfully configure Kong Ingress in the following way:

SERVICE: service.one  
KongPlugin\_1: rate-limiting second: 1000

INGRESS: ingress.one with annotations:  
– [kubernetes.io/ingress.class:](http://kubernetes.io/ingress.class:) kong  
– [konghq.com/plugins:](http://konghq.com/plugins:) KongPlugin\_1

KONG\_INGRESS:  
route:  
hosts:  
- service.one  
headers:  
api-key:  
- 1234-5678

And if I try to add any additional ingress pointing to the same service, only the last rule wins. There is no way to merge a hierarchy of rules.

---

<div class="post-metadata">

**Author:** ![traines](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/traines/32/158_2.png) [@traines](https://discuss.konghq.com/u/traines)\
**Post date:** [July 8, 2021, 9:59pm UTC](https://discuss.konghq.com/t/ingress-controller-rules-not-flexible-enough/8629/2 "2021-07-08T21:59:43Z")

</div>

You will want to use [consumers with auth plugins and credentials](https://docs.konghq.com/kubernetes-ingress-controller/1.3.x/guides/using-consumer-credential-resource/#provision-a-consumer) rather than the header-based routes in your example.

With those, you can take advantage of [plugin precedence rules](https://docs.konghq.com/enterprise/2.4.x/admin-api/#precedence) to create the 1k/s plugin on the Service only, the 10k/s plugin on the Service and KongConsumer with a `1234-5678` key-auth credential, and the 150k/s plugin on the Service, Ingress with `/special-path`, and KongConsumer.

Attaching the same KongPlugin instance to multiple resources will create a plugin that attached to each generated Kong resource.