You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: app/_src/gateway-operator/guides/konnect-entities/consumer-and-consumergroup.md
+91-4
Original file line number
Diff line number
Diff line change
@@ -44,19 +44,23 @@ At this point, you should see the consumer in the Gateway Manager UI.
44
44
45
45
## Associate the consumer with credentials
46
46
47
-
Consumers can have credentials associated with them. You can create one of the supported credential types. Please refer
48
-
to the below custom resource's documentation links to learn all the available fields for each credential type.
47
+
Consumers can have credentials associated with them.
48
+
In order to define credentials you can use the dedicated CRDs{% if_version gte: 1.5.x %} or define credentials in Secrets and link them using `KongConsumer` `credentials` field{% endif_version %}.
49
+
50
+
### Using CRDs
51
+
52
+
{{ site.kgo_product_name }} supports the following credential types, please refer to each type's documentation link to learn all the available fields for each credential type:
For example, you can create a `KongCredentialBasicAuth` associated with the `consumer` `KongConsumer` by applying the
57
61
following YAML manifest:
58
62
59
-
```yaml
63
+
```bash
60
64
echo '
61
65
apiVersion: configuration.konghq.com/v1alpha1
62
66
kind: KongCredentialBasicAuth
@@ -75,6 +79,89 @@ spec:
75
79
76
80
At this point, you should see the credential in the consumer's credentials in the Gateway Manager UI.
77
81
82
+
{% if_version gte: 1.5.x %}
83
+
### Using Secrets
84
+
85
+
To use Secrets as consumer credential definitions, you can create a Secret with the credentials and link it to the `KongConsumer` object using the `credentials` field:
86
+
87
+
```bash
88
+
echo '
89
+
kind: KongConsumer
90
+
apiVersion: configuration.konghq.com/v1
91
+
metadata:
92
+
name: consumer1
93
+
namespace: default
94
+
username: consumer1
95
+
spec:
96
+
controlPlaneRef:
97
+
type: konnectNamespacedRef
98
+
konnectNamespacedRef:
99
+
name: cp
100
+
credentials:
101
+
- consumer1-basic-auth1
102
+
---
103
+
kind: Secret
104
+
apiVersion: v1
105
+
metadata:
106
+
name: consumer1-basic-auth1
107
+
namespace: default
108
+
labels:
109
+
konghq.com/credential: basic-auth
110
+
stringData:
111
+
username: username
112
+
password: pass
113
+
' | kubectl apply -f -
114
+
```
115
+
116
+
This manifest should yield a consumer with a basic auth credential associated with it in {{ site.konnect_short_name }}.
117
+
118
+
We can check the validity of the credential secret reference by looking at the `CredentialSecretRefsValid` `KongConsumer` condition:
119
+
120
+
```bash
121
+
kubectl get kongconsumer consumer1 -o=jsonpath='{.status.conditions[?(@.type=="CredentialSecretRefsValid")]}' | jq
122
+
```
123
+
124
+
Should give the following output:
125
+
126
+
```yaml
127
+
{
128
+
"lastTransitionTime": "2025-03-12T15:36:46Z",
129
+
"message": "",
130
+
"observedGeneration": 1,
131
+
"reason": "Valid",
132
+
"status": "True",
133
+
"type": "CredentialSecretRefsValid"
134
+
}
135
+
```
136
+
137
+
#### Credential Secret Requirements
138
+
139
+
Please note that `Secret`s used as credentials have to meet certain requirements:
140
+
141
+
- each `Secret` has to be labeled using the `konghq.com/credential` label with the credential type as the value:
142
+
- basic auth credentials should have it set to `basic-auth`
143
+
- API key credentials should have it set to `key-auth`
144
+
- HMAC credentials should have it set to `hmac-auth`
145
+
- JWT credentials should have it set to `jwt`
146
+
- ACL credentials should have it set to `acl`
147
+
148
+
- additionally each `Secret` has to contain the following fields:
149
+
- basic auth credentials:
150
+
- `username`: the username
151
+
- `password`: the password
152
+
- API key credentials:
153
+
- `key`: the API key
154
+
- HMAC credentials:
155
+
- `username`: the username
156
+
- `secret`: the secret
157
+
- JWT credentials
158
+
- `key`: the key
159
+
- `algorithm`: the algorithm (please consult the [JWT plugin reference](/hub/kong-inc/jwt/#create-a-jwt-credential) for the supported algorithms)
160
+
- `rsa_public_key`: the RSA public key (if the `algorithm` is requires it)
161
+
- ACL credentials
162
+
- `group`: the group
163
+
{% endif_version %}
164
+
78
165
## Create a consumer group
79
166
80
167
Creating the `KongConsumerGroup` object in your Kubernetes cluster will provision a {{site.konnect_product_name}} consumer group in
0 commit comments