# Kong plugins not working for traffic originating from same kubernetes cluster

**URL:** <https://discuss.konghq.com/t/kong-plugins-not-working-for-traffic-originating-from-same-kubernetes-cluster/9391>\
**Category:** Questions\
**Tags:** service-mesh, kubernetes\
**Created:** [November 18, 2021, 1:25pm UTC](https://discuss.konghq.com/t/kong-plugins-not-working-for-traffic-originating-from-same-kubernetes-cluster/9391 "2021-11-18T13:25:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![avirupnandi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/avirupnandi/32/2821_2.png) [@avirupnandi](https://discuss.konghq.com/u/avirupnandi)\
**Post date:** [November 18, 2021, 1:25pm UTC](https://discuss.konghq.com/t/kong-plugins-not-working-for-traffic-originating-from-same-kubernetes-cluster/9391/1 "2021-11-18T13:25:21Z")

</div>

We have a KIC setup in our kubernetes cluster. As mentioned in [https://docs.konghq.com/hub/kong-inc/key-auth/#enable-the-plugin-on-a-service](https://docs.konghq.com/hub/kong-inc/key-auth/#enable-the-plugin-on-a-service), I am trying to use key-auth plugins with our service.

Below setup works for for traffic through ingress e.g. `curl https://demo-app.elample.com/health-check` throws error `{"message":"No API key found in request"}`. But when I am trying to access the service endpoint from inside the cluster then the API-KEY error is not thrown. e.g. `curl http://demo-app.demo-ns.svc.cluster.local:8080/health-check` returns 200 ok.

I want the KEY-AUTH plugin should work for all kind of traffic, (external and internal). How is that possible?

```auto
apiVersion: v1
kind: Service
metadata:
  name: demo--service
  annotations:
    konghq.com/plugins: demo-auth
spec:
  selector:
    app: demo-app
  ports:
    - port: 8080
      targetPort: 8080
      protocol: TCP

```

* * *

```auto
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: demo-auth
  annotations:
    kubernetes.io/ingress.class: demo-kong
config:
  anonymous: null
  hide_credentials: false
  key_in_body: false
  key_names:
    - x-api-key
  run_on_preflight: true
plugin: key-auth

```

* * *

```auto
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: demo-user
  annotations:
    kubernetes.io/ingress.class: demo-kong
username: demo-user
credentials:
  - demo-user-api-key-secret

```

---

<div class="post-metadata">

**Author:** ![fomm](https://avatars.discourse-cdn.com/v4/letter/f/ea666f/32.png) [@fomm](https://discuss.konghq.com/u/fomm)\
**Post date:** [November 19, 2021, 3:36am UTC](https://discuss.konghq.com/t/kong-plugins-not-working-for-traffic-originating-from-same-kubernetes-cluster/9391/2 "2021-11-19T03:36:10Z")

</div>

> [@avirupnandi](#):
>
> `http://demo-app.demo-ns.svc.cluster.local:8080/health-check`

By sending request to `demo-app.demo-ns.svc.cluster.local:8080/health-check` directly you are bypassing the Ingress Controller.

You might need service mesh to restrict access between internal services, for example enable mTLS.

---

<div class="post-metadata">

**Author:** ![traines](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/traines/32/158_2.png) [@traines](https://discuss.konghq.com/u/traines)\
**Post date:** [November 24, 2021, 3:17pm UTC](https://discuss.konghq.com/t/kong-plugins-not-working-for-traffic-originating-from-same-kubernetes-cluster/9391/3 "2021-11-24T15:17:23Z")

</div>

As fomm mentioned, requests to the Service’s `svc.cluster.local` address aren’t actually going through Kong, they’re just traversing the cluster’s internal network. Kong is primarily designed as an edge gateway, for traffic inbound into your cluster from outside. You can send internal traffic through Kong by sending it to the `demo-app.elample.com` hostname (or some internal hostname that resolves to the Kong proxy Service) instead, but it’s a bit atypical.

Our mesh proxy, Kuma, is designed for internal network policies, and uses sidecar proxies for each Service rather than a single gateway. You can restrict traffic between Services using a combination of the [Traffic Permission](https://kuma.io/docs/1.4.0/policies/traffic-permissions/) and mTLS policies.