# KongPlugin CRD fails with config.anonymous: unknown field while plugin works via Admin API

**URL:** <https://discuss.konghq.com/t/kongplugin-crd-fails-with-config-anonymous-unknown-field-while-plugin-works-via-admin-api/13788>\
**Category:** Questions\
**Created:** [October 28, 2025, 6:24am UTC](https://discuss.konghq.com/t/kongplugin-crd-fails-with-config-anonymous-unknown-field-while-plugin-works-via-admin-api/13788 "2025-10-28T06:24:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anisha\_Bhujbal](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/anisha_bhujbal/32/4670_2.png) [@Anisha\_Bhujbal](https://discuss.konghq.com/u/Anisha_Bhujbal)\
**Post date:** [October 28, 2025, 6:24am UTC](https://discuss.konghq.com/t/kongplugin-crd-fails-with-config-anonymous-unknown-field-while-plugin-works-via-admin-api/13788/1 "2025-10-28T06:24:44Z")

</div>

**Description / Issue:**

I have a custom Kong plugin `xyz-auth`.

- Using the **Kong Admin API** , the following `curl` works and creates the plugin successfully:

- When trying to create the **Kubernetes CRD** :

```auto
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
plugin: xyz-auth
metadata:   
  name: xyz-auth-plugin   
  annotations:      
    kubernetes.io/ingress.class: kong
config:   
  anonymous: anonymous-st

```

I get the error –\> admission webhook “[validations.kong.konghq.com](http://validations.kong.konghq.com)” denied the request: plugin failed schema validation: schema violation (config.anonymous: unknown field).

**What I’ve checked / tried:**

- The plugin works via **Admin API (`curl`)**.

- Checked the plugin schema at `/usr/local/share/lua/5.1/kong/plugins/xyz-auth/schema.lua`:

- Despite `anonymous` being defined in the schema, creating the **KongPlugin CRD** in Kubernetes still fails

- Suspect that **Kubernetes admission webhook** may not pick up the custom plugin schema correctly in DB-less / CRD mode.

* * *

**Questions / Help Needed:**

1. Is it possible to **add the `anonymous` field** to the plugin schema for Kubernetes CRDs?

2. Is there a recommended way to make **custom plugin fields work in Kubernetes CRDs**?

3. Can we safely **bypass the admission webhook** for testing purposes?