このページは、まだ日本語ではご利用いただけません。翻訳中です。
Consumer, Credentials and Consumer Group
In this guide you’ll learn how to use the KongConsumer
and KongConsumerGroup
custom resources to
manage Kong Konnect Consumers
and consumer groups natively from your Kubernetes cluster.
Prerequisites: Install Kong Gateway Operator and create a valid KonnectAPIAuthConfiguration and KonnectGatewayControlPlane in your cluster.
Prerequisites
Install Kong Gateway Operator
Update the Helm repository:
helm repo add kong https://charts.konghq.com
helm repo update kong
Install Kong Gateway Operator with Helm:
helm upgrade --install kgo kong/gateway-operator -n kong-system --create-namespace --set image.tag=1.4 \
--set kubernetes-configuration-crds.enabled=true \
--set env.ENABLE_CONTROLLER_KONNECT=true
You can wait for the operator to be ready using kubectl wait
:
kubectl -n kong-system wait --for=condition=Available=true --timeout=120s deployment/kgo-gateway-operator-controller-manager
Create an access token in Konnect
You may create either a Personal Access Token (PAT) or a Service Account Token (SAT) in Konnect. Please refer to the
Konnect authentication documentation for more information. You will need this token
to create a KonnectAPIAuthConfiguration
object that will be used by the Kong Gateway Operator to authenticate
with Konnect APIs.
Create a Kong Konnect API auth configuration
Depending on your preferences, you can create a KonnectAPIAuthConfiguration
object with the token specified
directly in its spec or as a reference to a Kubernetes Secret. The serverURL
field should be set to the Konnect API
URL in a region where your Kong Konnect account is located. Please refer to the list of available API URLs
for more information.
You can verify the KonnectAPIAuthConfiguration
object was reconciled successfully by checking its status.
kubectl get konnectapiauthconfiguration konnect-api-auth
The output should look like this:
NAME VALID ORGID SERVERURL
konnect-api-auth True <your-konnect-org-id> https://us.api.konghq.tech
Create a Kong Gateway control plane
Creating the KonnectGatewayControlPlane
object in your Kubernetes cluster will provision a Kong Konnect Gateway
control plane in your Gateway Manager. The KonnectGatewayControlPlane
CR
API allows you to
explicitly set a type of the Kong Gateway control plane, but if you don’t specify it, the default type is
a Self-Managed Hybrid
gateway control plane.
You can create one by applying the following YAML manifest:
echo '
kind: KonnectGatewayControlPlane
apiVersion: konnect.konghq.com/v1alpha1
metadata:
name: gateway-control-plane
namespace: default
spec:
name: gateway-control-plane # Name used to identify the Gateway Control Plane in Konnect
konnect:
authRef:
name: konnect-api-auth # Reference to the KonnectAPIAuthConfiguration object
' | kubectl apply -f -
You can see the status of the Gateway Control Plane by running:
kubectl get konnectgatewaycontrolplanes.konnect.konghq.com gateway-control-plane
If the Gateway Control Plane is successfully created, you should see the following output:
NAME PROGRAMMED ID ORGID
gateway-control-plane True <konnect-control-plane-id> <your-konnect-ord-id>
Having that in place, you will be able to reference the gateway-control-plane
in your Kong Konnect entities as their parent.
Create a consumer
Creating the KongConsumer
object in your Kubernetes cluster will provision a Kong Konnect Consumer in
your Gateway Manager.
You can refer to the CR API
to see all the available fields.
Your KongConsumer
must be associated with a KonnectGatewayControlPlane
object that you’ve created in your cluster.
It will make it part of the Gateway Control Plane’s configuration.
You can create a KongConsumer
by applying the following YAML manifest:
echo '
kind: KongConsumer
apiVersion: configuration.konghq.com/v1
metadata:
name: consumer
namespace: default
username: consumer
custom_id: 08433C12-2B81-4738-B61D-3AA2136F0212 # Optional
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: gateway-control-plane # Reference to the KonnectGatewayControlPlane object
' | kubectl apply -f -
You can verify the KongConsumer
was reconciled successfully by checking its Programmed
condition.
kubectl get kongconsumer consumer -o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jq
The output should look similar to this:
{
"observedGeneration": 1,
"reason": "Programmed",
"status": "True",
"type": "Programmed"
}
At this point, you should see the consumer in the Gateway Manager UI.
Associate the consumer with credentials
Consumers can have credentials associated with them. You can create one of the supported credential types. Please refer to the below custom resource’s documentation links to learn all the available fields for each credential type.
- KongCredentialBasicAuth
- KongCredentialKeyAuth
- KongCredentialACL
- KongCredentialJWT
- KongCredentialHMAC
For example, you can create a KongCredentialBasicAuth
associated with the consumer
KongConsumer
by applying the
following YAML manifest:
echo '
apiVersion: configuration.konghq.com/v1alpha1
kind: KongCredentialBasicAuth
metadata:
name: basic-auth-cred
namespace: default
spec:
consumerRef:
name: consumer # Reference to the KongConsumer object
password: pass
username: username
' | kubectl apply -f -
You can verify the KongCredentialBasicAuth
was reconciled successfully by checking its Programmed
condition.
kubectl get kongcredentialbasicauth basic-auth-cred -o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jq
The output should look similar to this:
{
"observedGeneration": 1,
"reason": "Programmed",
"status": "True",
"type": "Programmed"
}
At this point, you should see the credential in the consumer’s credentials in the Gateway Manager UI.
Create a consumer group
Creating the KongConsumerGroup
object in your Kubernetes cluster will provision a Kong Konnect consumer group in
your Gateway Manager. Please refer to the
KongConsumerGroup
CR API to see
all the available fields.
You can create a KongConsumerGroup
by applying the following YAML manifest:
echo '
kind: KongConsumerGroup
apiVersion: configuration.konghq.com/v1beta1
metadata:
name: consumer-group
namespace: default
spec:
name: consumer-group
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: gateway-control-plane # Reference to the KonnectGatewayControlPlane object
' | kubectl apply -f -
You can verify the KongConsumerGroup
was reconciled successfully by checking its Programmed
condition.
kubectl get kongconsumergroup consumer-group -o=jsonpath='{.status.conditions[?(@.type=="Programmed")]}' | jq
The output should look similar to this:
{
"observedGeneration": 1,
"reason": "Programmed",
"status": "True",
"type": "Programmed"
}
At this point, you should see the consumer group in the Gateway Manager UI.
Associate a consumer with a consumer group
You can associate a KongConsumer
with a KongConsumerGroup
by modifying the KongConsumer
object and adding the
consumerGroups
field. This field is a list of KongConsumerGroup
names.
For example, you can associate the consumer
KongConsumer
with the consumer-group
KongConsumerGroup
by applying the
following YAML manifest:
echo '
kind: KongConsumer
apiVersion: configuration.konghq.com/v1
metadata:
name: consumer
namespace: default
username: consumer
custom_id: 08433C12-2B81-4738-B61D-3AA2136F0212 # Optional
consumerGroups:
- consumer-group # Reference to the KongConsumerGroup object
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: gateway-control-plane # Reference to the KonnectGatewayControlPlane object
' | kubectl apply -f -
You can verify the KongConsumer
’s consumerGroups
field was reconciled successfully by checking its KongConsumerGroupRefsValid
condition.
kubectl get kongconsumer consumer -o=jsonpath='{.status.conditions[?(@.type=="KongConsumerGroupRefsValid")]}' | jq
The output should look similar to this:
{
"observedGeneration": 1,
"reason": "Valid",
"status": "True",
"type": "KongConsumerGroupRefsValid"
}
At this point, you should see the consumer
Consumer in the Consumer Group members in the Gateway Manager UI.