# Kong Ingress Controller without ClusterRole creation **URL:** \ **Category:** Questions\ **Tags:** kubernetes\ **Created:** [June 2, 2020, 2:17pm UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414 "2020-06-02T14:17:23Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 2, 2020, 2:17pm UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/1 "2020-06-02T14:17:23Z")
Hi, I have a question regarding the installation of the Kong Ingress Controller on a Kubernetes cluster on a private cloud. I would like to know if ever it is possible to install Kong Ingress Controller on a K8S cluster without creating ClusterRole and ClusterRoleBindings ? I would like that the Kong Ingress Controller applies to a given namespace only, not a the entire cluster. Can I also skip the creation of the KongClusterPlugins? Thanks Jon ---
**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\ **Post date:** [June 3, 2020, 3:46pm UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/2 "2020-06-03T15:46:57Z")
> [@jondow](#): > > I would like to know if ever it is possible to install Kong Ingress Controller on a K8S cluster without creating ClusterRole and ClusterRoleBindings ? > I would like that the Kong Ingress Controller applies to a given namespace only, not a the entire cluster. Yes this is supported. You can use `CONTROLLER_WATCH_NAMESPACE` flag to limit the scope to a single Namespace. You will have to tweak ClusterRole to be a Role (and tweak the binding appropriately as well). > [@jondow](#): > > Can I also skip the creation of the KongClusterPlugins? Unfortunately no. This is a limitation right now and I’ve opened up [KongClusterPlugin should not be a required CRD · Issue #717 · Kong/kubernetes-ingress-controller · GitHub](https://github.com/Kong/kubernetes-ingress-controller/issues/717) to track it. ---
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 4, 2020, 6:17am UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/3 "2020-06-04T06:17:10Z")
Thanks Harry for your reply, Do you know when the enhancement of skipping the KongClusterPlugins creation would be available? Best Regards Jon. ---
**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\ **Post date:** [June 8, 2020, 5:12pm UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/4 "2020-06-08T17:12:33Z")
> [@jondow](#): > > Do you know when the enhancement of skipping the KongClusterPlugins creation would be available? I can’t give you a timeline yet. You can start watching this issue:[KongClusterPlugin should not be a required CRD · Issue #717 · Kong/kubernetes-ingress-controller · GitHub](https://github.com/Kong/kubernetes-ingress-controller/issues/717) ---
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 11, 2020, 2:36pm UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/5 "2020-06-11T14:36:28Z")
> [@hbagdi](#): > > CONTROLLER\_WATCH\_NAMESPACE hi Harry, Thank you for your reply. Just to make sure that I am understanding you properly. When you mention “CONTROLLER\_WATCH\_NAMESPACE flag” you are talking about the CONTROLLER\_WATCH\_NAMESPACE environment variable under the “ingress-controller” container definition in the Kong Deployment template? Am I correct? Thank you Regards Jon ---
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 12, 2020, 3:50pm UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/6 "2020-06-12T15:50:42Z")
> [@hbagdi](#): > > Yes this is supported. You can use `CONTROLLER_WATCH_NAMESPACE` flag to limit the scope to a single Namespace. > You will have to tweak ClusterRole to be a Role (and tweak the binding appropriately as well). Hi Harry, I tweaked the ClusterRole to become a Role (changing the kind and adding a namespace). But when I deploy the ingress-controller container, I see the following error: Failed to list \*v1.KongClusterPlugin: [kongclusterplugins.configuration.konghq.com](http://kongclusterplugins.configuration.konghq.com) is forbidden: User “system:serviceaccount:kong:kong-kong” cannot list resource “kongclusterplugins” in API group “[configuration.konghq.com](http://configuration.konghq.com)” at the cluster scope Any idea, what could be done to make it work? Thanks Regards Jon ---
**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\ **Post date:** [June 15, 2020, 5:39pm UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/7 "2020-06-15T17:39:50Z")
Ah, my bad. You will need to give the service account permission to read/list/watch KongClusterPlugin, else this won’t work today. We do want to make this workflow possible and track this problem in the following issue: > > > If KongClusterPlugin CRD is not present, the cluster should still function and adapt gracefully. > This comes up often because customers don't want... ---
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 16, 2020, 8:03am UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/8 "2020-06-16T08:03:57Z")
Thanks Harry, I gave read/list/watch permission to the serviceaccount. Please, see below the Role manifest I have deployed. But I still got the same error: " Failed to list \*v1.KongClusterPlugin: [kongclusterplugins.configuration.konghq.com](http://kongclusterplugins.configuration.konghq.com) is forbidden: User “system:serviceaccount:kong:kong-kong” cannot list resource “kongclusterplugins” in API group “[configuration.konghq.com](http://configuration.konghq.com)” at the cluster scope" What could I do to make this work when I am not able to create ClusterRole and ClusterRoleBindings for security reasons? Role Manifest: " apiVersion: [rbac.authorization.k8s.io/v1beta1](http://rbac.authorization.k8s.io/v1beta1) kind: Role metadata: name: kong-kong namespace: kong rules: - apiGroups: - “” resources: - endpoints - nodes - pods - secrets verbs: - list - watch - apiGroups: - “” resources: - nodes verbs: - get - apiGroups: - “” resources: - services verbs: - get - list - watch - apiGroups: - [networking.k8s.io](http://networking.k8s.io) - extensions - networking.internal.knative.dev resources: - ingresses verbs: - get - list - watch - apiGroups: - “” resources: - events verbs: - create - patch - apiGroups: - [networking.k8s.io](http://networking.k8s.io) - extensions - networking.internal.knative.dev resources: - ingresses/status verbs: - update - apiGroups: - [configuration.konghq.com](http://configuration.konghq.com) resources: - tcpingresses/status verbs: - update - apiGroups: - [configuration.konghq.com](http://configuration.konghq.com) resources: - kongplugins - kongclusterplugins - kongcredentials - kongconsumers - kongingresses - tcpingresses verbs: - get - list - watch - apiGroups: - “” resources: - configmaps verbs: - create - get - update - apiGroups: - “” resources: - configmaps - pods - secrets - namespaces verbs: - get - apiGroups: - “” resources: - configmaps resourceNames: # Defaults to “-” # Here: “-” # This has to be adapted if you change either parameter # when launching the nginx-ingress-controller. - “kong-ingress-controller-leader-{{ .Values.ingressController.ingressClass }}-{{ .Values.ingressController.ingressClass }}” verbs: - get - update - apiGroups: - “” resources: - configmaps verbs: - create - apiGroups: - “” resources: - endpoints verbs: - get " Thanks Jon ---
**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\ **Post date:** [June 16, 2020, 8:56pm UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/9 "2020-06-16T20:56:01Z")
KongClusterPlugin is a cluster-level resource. You can only assign RBAC permissions for a cluster-level resources from ClusterRole and ClusterRoleBinding, meaning, if you can’t create those, you can’t use Kong Ingress Controller. ---
**Author:** ![jondow](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/jondow/32/2019_2.png) [@jondow](https://discuss.konghq.com/u/jondow)\ **Post date:** [June 17, 2020, 6:49am UTC](https://discuss.konghq.com/t/kong-ingress-controller-without-clusterrole-creation/6414/10 "2020-06-17T06:49:03Z")
Thanks Harry, I misunderstood your statements. Now I understand that I cannot install Kong Ingress Controller without creating ClusterRole and ClusterRoleBindings, even though Kong Ingress Controller is intended to be used in a specific namespace, not at a Cluster level. Thank you Regards Jon