# Jwt plugin change db-mode to db-less-mode

**URL:** <https://discuss.konghq.com/t/jwt-plugin-change-db-mode-to-db-less-mode/4830>\
**Category:** Questions\
**Created:** [November 6, 2019, 11:20am UTC](https://discuss.konghq.com/t/jwt-plugin-change-db-mode-to-db-less-mode/4830 "2019-11-06T11:20:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![HYUN\_SUK\_JUNG](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hyun_suk_jung/32/1122_2.png) [@HYUN\_SUK\_JUNG](https://discuss.konghq.com/u/HYUN_SUK_JUNG)\
**Post date:** [November 6, 2019, 11:20am UTC](https://discuss.konghq.com/t/jwt-plugin-change-db-mode-to-db-less-mode/4830/1 "2019-11-06T11:20:55Z")

</div>

Hello

I used DB(postgesql) for the credential and consumer information of jwt plugin.  
I am working on converting kong in DB mode to db-less mode.

In DB mode, I added consumer and credential through admin api and confirmed that JWT plugin works properly.

> [@Unable to link a KongPlugin JWT to a specific consumer](https://discuss.konghq.com/t/unable-to-link-a-kongplugin-jwt-to-a-specific-consumer/2767):
>
> Hi there, This is my first question/issue here so let me know if it misses some details. We start to use Kong as an Ingress Controller but I have a small issue around the Kong plugin JWT Here is what I have currently: 2 separate apps on the same K8s cluster (separated by namespaces) KongPlugin JWT on the Ingress for both apps KongConsumer and KongCredential for each namespace My routes are protected (401 when I access the route without any token) My issue: On both apps, The tokens are ch…

I set referring to the above page, but JWT plugin gives 401 (Unauthorized) response.  
The published JWT contains “iss = [aaa.com](http://aaa.com)”.

Below is my configuration.

```
indent preformatted text by 4 spaces

```

apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)  
kind: KongPlugin  
metadata:  
name: jwt  
labels:  
global: “false”  
enabled: true  
plugin: jwt

* * *

apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)  
kind: KongConsumer  
metadata:  
name: global-consumer  
username: GlobalConsumer  
custom\_id: GlobalConsumer

* * *

apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)  
kind: KongCredential  
metadata:  
name: global-consumer-credentials  
consumerRef: global-consumer  
type: jwt  
config:  
key: “[aaa.com](http://aaa.com)”  
rsa\_public\_key: |  
-----BEGIN PUBLIC KEY-----  
MIIBIjA-----------  
NbOIuzKa----------  
kwIDAQAB-----------  
-----END PUBLIC KEY-----  
algorithm: RS256

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [November 7, 2019, 8:02pm UTC](https://discuss.konghq.com/t/jwt-plugin-change-db-mode-to-db-less-mode/4830/2 "2019-11-07T20:02:55Z")

</div>

Two questions:

1. Do you see error in logs of Kong Ingress Controller upon creation of that credential?
2. Can you exec into the Kong container and ensure that Kong has the credential correctly populated inside? (`GET /jwts` on the Admin API.)

---

<div class="post-metadata">

**Author:** ![HYUN\_SUK\_JUNG](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hyun_suk_jung/32/1122_2.png) [@HYUN\_SUK\_JUNG](https://discuss.konghq.com/u/HYUN_SUK_JUNG)\
**Post date:** [November 11, 2019, 5:06am UTC](https://discuss.konghq.com/t/jwt-plugin-change-db-mode-to-db-less-mode/4830/3 "2019-11-11T05:06:33Z")

</div>

**1, There is no log about creation of that credential**  
**[kong-ingress log]**  
Kong Ingress controller  
Release: 0.6.0  
Build: 273a5664  
Repository: [git@github.com](mailto:git@github.com):Kong/kubernetes-ingress-controller.git  
Go: go1.13  
I1111 04:26:04.113427 1 main.go:367] Creating API client for [https://10.221.0.1:443](https://10.221.0.1:443)  
I1111 04:26:04.122191 1 main.go:411] Running in Kubernetes Cluster version v1.15 (v1.15.0) - git (clean) commit e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529 - platform linux/amd64  
I1111 04:26:04.248282 1 main.go:153] kong version: 1.3.0  
I1111 04:26:04.248302 1 main.go:162] Kong datastore: off  
I1111 04:26:04.364622 1 controller.go:242] starting Ingress controller  
E1111 04:26:04.365118 1 main.go:315] error running the admission controller server:open /admission-webhook/tls.crt: no such file or directory  
I1111 04:26:04.366959 1 status.go:201] new leader elected: kong-8694569ccd-jzk7c  
I1111 04:26:04.430498 1 controller.go:135] successfully synced configuration to Kong  
I1111 04:26:16.346805 1 controller.go:135] successfully synced configuration to Kong  
I1111 04:26:19.625474 1 controller.go:135] successfully synced configuration to Kong

**[kong log]**  
2019/11/11 04:25:57 [notice] 1#0: using the “epoll” event method  
2019/11/11 04:25:57 [notice] 1#0: openresty/1.15.8.1  
2019/11/11 04:25:57 [notice] 1#0: built by gcc 8.3.0 (Alpine 8.3.0)  
2019/11/11 04:25:57 [notice] 1#0: OS: Linux 3.10.0-957.12.2.el7.x86\_64  
2019/11/11 04:25:57 [notice] 1#0: getrlimit(RLIMIT\_NOFILE): 1048576:1048576  
2019/11/11 04:25:57 [notice] 1#0: start worker processes  
2019/11/11 04:25:57 [notice] 1#0: start worker process 31  
2019/11/11 04:25:57 [notice] 1#0: start worker process 32  
127.0.0.1 - - [11/Nov/2019:04:26:04 +0000] “GET / HTTP/1.1” 200 6553 “-” “Go-http-client/1.1”  
127.0.0.1 - - [11/Nov/2019:04:26:04 +0000] “GET /tags HTTP/1.1” 200 23 “-” “Go-http-client/1.1”  
2019/11/11 04:26:04 [notice] 32#0: \*42 [lua] cache.lua:321: purge(): [DB cache] purging (local) cache, client: 127.0.0.1, server: kong\_admin, request: “POST /config?check\_hash=1 HTTP/1.1”, host: “localhost:8001”

**2. I checked admin api but no message found**  
I also checked consumer admin api but no message found

admin api : [https://xx.xx.xx.xx:8001/consumers/GlobalConsumer/jwt](https://xx.xx.xx.xx:8001/consumers/GlobalConsumer/jwt)  
[https://xx.xx.xx.xx:8001/consumers](https://xx.xx.xx.xx:8001/consumers)  
\*\* [Result] \*\*  
there is no message  
{  
message: “Not found”  
}

I also check DB-mode both of admin apis  
That work correctly.

ref. kong-ingress-controller is different  
DB mode : : 0.5.0  
DB-less mode : 0.6.0

I set the plugin and package\_path both of kong.conf and env in deployment and \_helper files  
because I already set the plugin and package\_path in kong.conf file but this is not working.  
so I added env in deployment and \_helper files

Do I need any additional configuration in kong.conf file when I change to db-less mode?

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [November 11, 2019, 6:35pm UTC](https://discuss.konghq.com/t/jwt-plugin-change-db-mode-to-db-less-mode/4830/4 "2019-11-11T18:35:37Z")

</div>

> [@HYUN\_SUK\_JUNG](#):
>
> admin api : [https://xx.xx.xx.xx:8001/consumers/GlobalConsumer/jwt](https://xx.xx.xx.xx:8001/consumers/GlobalConsumer/jwt)  
> [https://xx.xx.xx.xx:8001/consumers](https://xx.xx.xx.xx:8001/consumers)  
> \*\* [Result] \*\*  
> there is no message

The correct Admin API endpoint is:

```auto
curl -k https://localhost:8444/

```

Please use that to check the configuration of Kong.

> [@HYUN\_SUK\_JUNG](#):
>
> Do I need any additional configuration in kong.conf file when I change to db-less mode?

No, all you need is `database=off`.

---

<div class="post-metadata">

**Author:** ![HYUN\_SUK\_JUNG](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hyun_suk_jung/32/1122_2.png) [@HYUN\_SUK\_JUNG](https://discuss.konghq.com/u/HYUN_SUK_JUNG)\
**Post date:** [November 12, 2019, 12:44am UTC](https://discuss.konghq.com/t/jwt-plugin-change-db-mode-to-db-less-mode/4830/5 "2019-11-12T00:44:08Z")

</div>

I already set “database = off” in kong.conf

I set the node port 8001  
I changed admin node port 8001 to 8444 but there is no change.

[root]# **kubectl get kongplugins**  
NAME PLUGIN-TYPE AGE  
jwt jwt 2m16s  
[root]# **kubectl get kongconsumers**  
NAME USERNAME AGE  
global-consumer GlobalConsumer 2m22s  
[root]# **kubectl get kongcredential**  
NAME CREDENTIAL-TYPE AGE CONSUMER-REF  
global-consumer-credentials jwt 2m29s global-consumer  
[root]# **kubectl get services |grep kong-admin**  
kong-admin NodePort 10.221.2.228 8444:8444/TCP 2m59s

[root]# **curl -k [https://xx.xx.xx.xx:8444/consumers](https://xx.xx.xx.xx:8444/consumers)**  
{“next”:null,“data”:[]}  
[root]# **curl -k [https://xx.xx.xx.xx:8444/consumgers/GlobalConsumer/jwt](https://xx.xx.xx.xx:8444/consumgers/GlobalConsumer/jwt)**  
{“message”:“Not found”}  
[root]# **curl -k [https://xx.xx.xx.xx:8444/jwts](https://xx.xx.xx.xx:8444/jwts)**  
{“next”:null,“data”:[]}  
[root]# **curl -k [https://xx.xx.xx.xx:8444/plugins](https://xx.xx.xx.xx:8444/plugins)** \<== There are some results  
{

- created\_at: 1573535366,
- config: {
  - claims\_to\_verify: [
    - “exp”,
    - “nbf”],

  - run\_on\_preflight: true,

…

- name: “jwt”,  
…
- enabled: true  
}