Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add support for externalized consumers #7657

Open
wants to merge 18 commits into
base: main
Choose a base branch
from
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Change consumer wording, remove caps for certain entities
Signed-off-by: Diana <[email protected]>
cloudjumpercat committed Mar 19, 2025
commit ff589dfa5ceaa400cee20b16d786555667a8af23
4 changes: 2 additions & 2 deletions app/_data/docs_nav_konnect.yml
Original file line number Diff line number Diff line change
@@ -15,8 +15,8 @@
url: /private-connections/aws-privatelink/
- text: Geographic Regions
url: /geo/
- text: Regional Consumers
url: /regional-consumers/
- text: Centralized consumer management
url: /centralized-consumer-management/
- text: Compatibility
url: /compatibility/
- text: Stages of Software Availability
8 changes: 4 additions & 4 deletions app/_hub/kong-inc/key-auth/how-to/_index.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
---
nav_title: Configure realms for regional Consumers
title: Configure realms for regional Consumers in {{site.konnect_short_name}}
nav_title: Configure realms for consumers
title: Configure realms for consumers in {{site.konnect_short_name}}
---

Starting in {{site.base_gateway]] 3.10.x, credentials that are stored centrally in {{site.konnect_short_name}} that are shared across multiple {{site.base_gateway}} can be validated by configuring `identity_realms` field in the Key Auth plugin. You can use these realms when you create [regional Consumers](/konnect/regional-consumers/).
Starting in {{site.base_gateway]] 3.10.x, credentials that are stored centrally in {{site.konnect_short_name}} that are shared across multiple {{site.base_gateway}} can be validated by configuring `identity_realms` field in the Key Auth plugin. You can use these realms when you create [centrally managed consumers](/konnect/centralized-consumer-management/). A data plane can only reach out to realms in the same region as they are deployed.

Add the `identity_realms` field as shown below:

@@ -37,7 +37,7 @@ Be sure to replace the following with your own values:
* $REALM_ID: The ID of the realm you created previously.
* $REGION: Region for your {{site.konnect_short_name}} instance.

The order in which you configure the `identity_realms` dictates the priority in which the data plane attempts to authenticate the provided API keys:
`identity_realms` are scoped to the control plane by default (`scope: cp`). The order in which you configure the `identity_realms` dictates the priority in which the data plane attempts to authenticate the provided API keys:

* **Realm is listed first:** The data plane will first reach out to the realm. If the API key is not found in the realm, the data plane will look for the API key in the control plane config.
* **Control plane scope listed first:** The data plane will initially check the control plane configuration (LMDB) for the API key before looking up the API Key in the realm.
Original file line number Diff line number Diff line change
@@ -1,24 +1,24 @@
---
title: Regional Consumers
title: Centralized consumer management
---

A [Consumer](/gateway/latest/key-concepts/consumers/) is a {{site.base_gateway}} entity that consumes or uses the APIs managed by {{site.base_gateway}}. These can be things like applications, services, or users who interact with your APIs. Consumers can be scoped to a {{site.konnect_short_name}} region and managed centrally as regional Consumers, or be scoped to a control plane in Gateway Manager.
A [consumer](/gateway/latest/key-concepts/consumers/) is a {{site.base_gateway}} entity that consumes or uses the APIs managed by {{site.base_gateway}}. These can be things like applications, services, or users who interact with your APIs. Consumers can be scoped to a {{site.konnect_short_name}} region and managed centrally, or be scoped to a control plane in Gateway Manager.

Regional Consumers provide the following benefits:
* The Consumer identity can be set up centrally instead of being defined across multiple control planes.
* Share Consumers across multiple control planes. Users don't need to replicate changes to Consumer identity in multiple control planes and Consumer configuration doesn't conflict.
* Reduces configuration sync issues between the control plane and the data planes. Regional Consumers aren't part of the configuration that is pushed down from the control plane to the data planes, so it reduces config size and latency.
Centralized consumer management provides the following benefits:
* The consumer identity can be set up centrally instead of being defined across multiple control planes.
* Share consumers across multiple control planes. Users don't need to replicate changes to consumer identity in multiple control planes and consumer configuration doesn't conflict.
* Reduces configuration sync issues between the control plane and the data planes. Consumers that are managed centrally aren't part of the configuration that is pushed down from the control plane to the data planes, so it reduces config size and latency.

## How regional Consumers work
## How centralized consumer management works

When you create a regional Consumer, you must assign it to a realm. A realm groups regional Consumers around an identity, defined by organizational boundaries, such as a production realm or a development realm. Realms are connected to a [geographic region](/konnect/geo/) in {{site.konnect_short_name}}. Regional Consumers exist outside of control planes, so they can be used across control planes.
When you create a consumer centrally, you must assign it to a realm. A realm groups consumers around an identity, defined by organizational boundaries, such as a production realm or a development realm. Realms are connected to a [geographic region](/konnect/geo/) in {{site.konnect_short_name}}. Centrally managed consumers exist outside of control planes, so they can be used across control planes.

## Create regional Consumers and Realms
## Create consumers and realms

You can create regional Consumers using the {{site.konnect_short_name}} API. Only Org Admins have CRUD permissions for regional Consumers.
You can manage consumers centrally using the {{site.konnect_short_name}} API. Only Org Admins have CRUD permissions for these consumers.

{:.important}
> Regional Consumers are available for {{site.base_gateway}} 3.10 data planes. Make sure your control plane uses 3.10 data planes at minimum when configuring regional Consumers.
> Centralized consumer management is only available for {{site.base_gateway}} 3.10 data planes. Make sure your control plane uses 3.10 data planes at minimum when configuring these consumers.
1. Use the `/realms` endpoint to create a realm and optionally associate it with allowed control planes and time-to-live values:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We define time-to-live further down the document. Should we define it here as well?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll leave this one as-is since we typically follow this format in docs where we explain it later in the bullets and it could bloat the step instruction if I put it here.

```
@@ -47,7 +47,7 @@ You can create regional Consumers using the {{site.konnect_short_name}} API. Onl
* `ttl`: (Optional) 'ttl' is the time-to-live (TTL) in minutes of the consumer for this realm in the {{site.base_gateway}} cache.
* `negative_ttl`: (Optional) Represents the TTL of a bad login cache entry.
* `$CONSUMER_GROUP`: (Optional) Replace with the name of the consumer groups you want to associate with the realm.
1. Use the `/realms/{realmId}/consumers` endpoint to create a regional Consumer and optionally assign it to a Consumer Group:
1. Use the `/realms/{realmId}/consumers` endpoint to create a centrally managed consumer and optionally assign it to a consumer group:
```
curl -X POST \
https://{region}.api.konghq.com/v1/realms/{realmId}/consumers \
@@ -63,16 +63,16 @@ You can create regional Consumers using the {{site.konnect_short_name}} API. Onl
* `$KONNECT_TOKEN`: Replace with your {{site.konnect_short_name}} personal access token.
* `{realmId}`: The ID of the realm you created previously.
* `$CONSUMER_NAME`: Replace with the name of the consumer.
* `$CONSUMER_GROUP`: (Optional) Replace with the name of the consumer groups you want to associate with the consumer. Consumer groups set here are additive. This means that if you configure the realm with consumer groups A and B, and then configure the regional consumer with consumer group C, the authenticated consumer will be assigned to consumer groups A, B, and C.
* `$CONSUMER_GROUP`: (Optional) Replace with the name of the consumer groups you want to associate with the consumer. Consumer groups set here are additive. This means that if you configure the realm with consumer groups A and B, and then configure the consumer with consumer group C, the authenticated consumer will be assigned to consumer groups A, B, and C.
1. Consumers require authentication. Configure authentication using the [Key Auth plugin](/hub/kong-inc/key-auth/how-to/).

The order in which you configure the `identity_realms` dictates the priority in which the data plane attempts to authenticate the provided API keys:
`identity_realms` are scoped to the control plane by default (`scope: cp`). The order in which you configure the `identity_realms` dictates the priority in which the data plane attempts to authenticate the provided API keys:

* **Realm is listed first:** The data plane will first reach out to the realm. If the API key is not found in the realm, the data plane will look for the API key in the control plane config.
* **Control plane scope listed first:** The data plane will initially check the control plane configuration (LMDB) for the API key before looking up the API Key in the realm.
* **Realm only:** You can also configure a single `identity_realms` by omitting the `scope: cp` from the example. In this case, the data plane will only attempt to authenticate API keys against the realm. If the API key isn't found, the request will be blocked.
* **Control plane only:** You can configure a look up only in the control plane config by only specifying `scope: cp` for `identity_realms`. In this scenario, the data plane will only check the control plane configuration (LMDB) for API key authentication. If the API key isn't found, the request will be blocked.

{:.note}
> **Note:** If you are using KIC to manage your Data Plane nodes in {{site.konnect_short_name}}, ensure that you configure the `telemetry_endpoint` in the Data Plane. You can find the `telemetry_endpoint` in the {{site.konnect_short_name}} UI in [Gateway Manager](https://cloud.konghq.com/gateway-manager/) in the Data Plane node instructions.
> **Note:** If you are using KIC to manage your data plane nodes in {{site.konnect_short_name}}, ensure that you configure the `telemetry_endpoint` in the data plane. You can find the `telemetry_endpoint` in the {{site.konnect_short_name}} UI in [Gateway Manager](https://cloud.konghq.com/gateway-manager/) in the data plane node instructions.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to add a section around changing the scope of consumers from cp to realm? The user will need to do the following call:

POST https://us.api.konghq.com/identity/pools/%7BpoolID%7D/consumers)/Alice-123/keys
{
"type": "legacy" // Migrating Alice's existing keys
"secret": "Alice-api-key"
}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since that's optional, I'd rather link them to the API spec so they can see what else they can do. Do you have a predicted link to the public API spec?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am adding a new step to create new keys for the consumer, since I think that was missing.