このページは、まだ日本語ではご利用いただけません。翻訳中です。
旧バージョンのドキュメントを参照しています。 最新のドキュメントはこちらをご参照ください。
Provisioning Consumers and Credentials
Learn how to use the KongConsumer custom resource and use Secret resources to associate credentials with those consumers.
Installation
Follow the deployment documentation to install the Kong Ingress Controller on the Kubernetes cluster.
Installing the Gateway APIs
If you wish to use the Gateway APIs examples, follow the supplemental Gateway APIs installation instructions.
Testing connectivity to Kong Gateway
Ensure that the PROXY_IP
environment variable is
set to contain the IP address or URL pointing to Kong Gateway.
The deployment guide that you used to install the Kong Ingress Controller on the Kubernetes cluster provides the instructions to configure this environment variable.
If everything is set correctly, a request to Kong Gateway returns
a HTTP 404 Not Found
status code:
curl -i $PROXY_IP
The results should look like this:
HTTP/1.1 404 Not Found
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 48
X-Kong-Response-Latency: 0
Server: kong/3.0.0
{"message":"no Route matched with those values"}
This is expected because Kong Gateway doesn’t know how to proxy the request yet.
Deploy an echo service
To proxy requests, you need an upstream application to send a request to. Deploying this echo server provides a simple application that returns information about the Pod it’s running in:
kubectl apply -f https://docs.jp.konghq.com/assets/kubernetes-ingress-controller/examples/echo-service.yaml
The results should look like this:
service/echo created
deployment.apps/echo created
Create a configuration group
Ingress and Gateway APIs controllers need a configuration that indicates which set of routing configuration they should recognize. This allows multiple controllers to coexist in the same cluster. Before creating individual routes, you need to create a class configuration to associate routes with:
Kong Ingress Controller recognizes the kong
IngressClass and
konghq.com/kic-gateway-controller
GatewayClass
by default. Setting the CONTROLLER_INGRESS_CLASS
or
CONTROLLER_GATEWAY_API_CONTROLLER_NAME
environment variable to
another value overrides these defaults.
Add routing configuration
Create routing configuration to proxy /echo
requests to the echo server:
The results should look like this:
Test the routing rule:
curl -i -H 'Host:kong.example' $PROXY_IP/echo
The results should look like this:
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 140
Connection: keep-alive
Date: Fri, 21 Apr 2023 12:24:55 GMT
X-Kong-Upstream-Latency: 0
X-Kong-Proxy-Latency: 1
Via: kong/3.2.2
Welcome, you are connected to node docker-desktop.
Running on Pod echo-7f87468b8c-tzzv6.
In namespace default.
With IP address 10.1.0.237.
...
If everything is deployed correctly, you should see the above response. This verifies that Kong Gateway can correctly route traffic to an application running inside Kubernetes.
Add authentication to the service
With Kong, adding authentication for an API is as simple as enabling a plugin.
-
To enforce authentication requirements on the route you’ve created, create a KongPlugin resource with an authentication plugin, such as
key-auth
:echo " apiVersion: configuration.konghq.com/v1 kind: KongPlugin metadata: name: example-auth plugin: key-auth " | kubectl apply -f -
The results should look like this:
kongplugin.configuration.konghq.com/example-auth created
-
Associate this plugin with the Ingress rule that you created using the
konghq.com/plugins
annotation:The results should look like this:
-
Test the routing configuration by sending a request that matches the proxying rules defined in the
echo
routing configuration. It now requires a valid API key:curl -si http://kong.example/echo --resolve kong.example:80:$PROXY_IP
The results should look like this:
HTTP/1.1 401 Unauthorized Content-Type: application/json; charset=utf-8 Connection: keep-alive WWW-Authenticate: Key realm="kong" Content-Length: 41 Server: kong/3.0.1 {"message":"No API key found in request"}
Requests that do not include a key receive a 401 Unauthorized response.
Provision a consumer and credential
Credential Secrets include a kongCredType
key, whose value indicates what authentication plugin the credential is for, and keys corresponding to the fields necessary to configure that credential type (key
for key-auth
credentials).
-
Create a credential Secret:
kubectl create secret generic kotenok-key-auth \ --from-literal=kongCredType=key-auth \ --from-literal=key=gav
The results should look like this:
secret/kotenok-key-auth created
-
Create a KongConsumer resource that uses the Secret:
echo "apiVersion: configuration.konghq.com/v1 kind: KongConsumer metadata: name: kotenok annotations: kubernetes.io/ingress.class: kong username: kotenok credentials: - kotenok-key-auth " | kubectl apply -f -
The results should look like this:
kongconsumer.configuration.konghq.com/kotenok created
Use the credential
Now, send a request including the credential (key-auth
expects an apikey
header with the key by default):
curl -si http://kong.example/echo --resolve kong.example:80:$PROXY_IP -H "apikey: gav"
The results should look like this:
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 09 Dec 2022 22:16:24 GMT
Server: echoserver
x-added-service: demo
X-Kong-Upstream-Latency: 0
X-Kong-Proxy-Latency: 1
Via: kong/3.1.1
Hostname: echo-fc6fd95b5-8tn52
...
In this guide, you learned how to leverage an authentication plugin in Kong and provision credentials. This enables you to offload authentication into your Ingress layer and keeps the application logic simple.
All other authentication plugins bundled with Kong work in this way and can be used to quickly add an authentication layer on top of your microservices.