Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add support for externalized consumers #7657

Open
wants to merge 18 commits into
base: main
Choose a base branch
from
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Finish draft
Signed-off-by: Diana <[email protected]>
cloudjumpercat committed Mar 13, 2025
commit 935f4f9372cf9479079e93cff704abdbafcd234b
42 changes: 28 additions & 14 deletions app/_hub/kong-inc/key-auth/overview/_index.md
Original file line number Diff line number Diff line change
@@ -303,21 +303,35 @@ API Keys that are stored centrally in {{site.konnect_short_name}} to be shared a

Add the `identity_realms` field as shown below:

```yaml
echo '
_format_version: "3.0"
plugins:
- name: key-auth
config:
key_names:
- apikey
identity_realms:
- region: us
id: <realm_id>
scope: realm
- scope: cp
' | deck gateway apply -
```bash
curl -X POST \
https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/plugins/ \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer TOKEN" \
--data '{
"name": "key-auth",
"config": {
"key_names": ["apikey"],
"identity_realms": [
{
"region": "$REGION",
"id": "$REALM_ID",
"scope": "realm"
},
{
"scope": "cp"
}
]
}
}'
```
Be sure to replace the following with your own values:
* {region}: Region for your {{site.konnect_short_name}} instance.
* {controlPlaneId}: UUID of your control plane.
* $KONNECT_TOKEN: Replace with your {{site.konnect_short_name}} personal access token.
* $REALM_ID: The ID of the realm you created previously.
* $REGION: Region for your {{site.konnect_short_name}} instance.

The order in which you configure the identity_realms dictates the priority in which the dataplane attempts to authenticate the provided API keys:

4 changes: 2 additions & 2 deletions app/konnect/centralized-consumers.md
Original file line number Diff line number Diff line change
@@ -79,7 +79,7 @@ You can create centralized Consumers using the {{site.konnect_short_name}} API.
```
kong/kong-gateway-dev:ac1501420169b29ea38c03d747f9204826ec8ac8
```
1. Use the `/realms` endpoint to create a realm and associate it with allowed Control Planes:
1. Use the `/realms` endpoint to create a realm and optionally associate it with allowed Control Planes and time-to-live values:
```
curl -X POST \
https://{region}.api.konghq.com/v1/realms \
@@ -108,7 +108,7 @@ You can create centralized Consumers using the {{site.konnect_short_name}} API.
"consumer_groups": ["gold"]
}'
```
1. Consumers require authentication. Configure authentication using the [Key Auth plugin](/hub/kong-inc/key-auth/#configure-realms-for-centralized-consumers-in-sitekonnectshortname).
1. Consumers require authentication. Configure authentication using the [Key Auth plugin](/hub/kong-inc/key-auth/#configure-realms-for-centralized-consumers-in-konnect).

{:.note}
> **Note:** If you are using KIC to manage your Data Plane nodes in {{site.konnect_short_name}}, ensure that you configure the `telemetry_endpoint` in the Data Plane. You can find the `telemetry_endpoint` in the {{site.konnect_short_name}} UI in [Gateway Manager]() in the Data Plane node instructions.