Create a Super Admin with the Admin API
After enabling RBAC, you can create a Super Admin user by issuing a POST request to the /rbac/users/ endpoint. Then associate the user to the super-admin role.
Prerequisites
Kong Gateway running with RBAC enabled
This tutorial requires Kong Gateway Enterprise.
-
Export your license to an environment variable:
export KONG_LICENSE_DATA='LICENSE-CONTENTS-GO-HERE'Copied! -
Run the quickstart script with RBAC enabled:
curl -Ls get.konghq.com/quickstart | bash -s -- -e "KONG_LICENSE_DATA" \ -e "KONG_ENFORCE_RBAC=on" \ -e "KONG_ADMIN_GUI_AUTH=basic-auth" \ -e "KONG_PASSWORD=kong" \ -e 'KONG_ADMIN_GUI_SESSION_CONF={"secret":"kong", "cookie_lifetime":300000, "cookie_renew":200000, "cookie_name":"kong_cookie", "cookie_secure":false, "cookie_samesite": "off"}'Copied!For more information about the values see the RBAC reference. Once Kong Gateway is ready, you will see the following message:
Kong Gateway ReadyCopied!
Create the super-admin RBAC user
-
Create an RBAC user:
curl -X POST "http://localhost:8001/rbac/users" \ -H "Accept: application/json"\ -H "Content-Type: application/json"\ -H "Kong-Admin-Token: $KONG_ADMIN_TOKEN" \ --json '{ "name": "'$ADMIN_NAME'", "user_token": "'$USER_TOKEN'" }'Copied! -
Associate the user to the
super-adminrole:curl -X POST "http://localhost:8001/rbac/users/$ADMIN_NAME/roles" \ -H "Accept: application/json"\ -H "Content-Type: application/json"\ -H "Kong-Admin-Token: $KONG_ADMIN_TOKEN" \ --json '{ "roles": "super-admin" }'Copied!
Validate
You can validate that the super-admin role was correctly assigned to the RBAC user using the /rbac/users/{user}/roles endpoint:
curl "http://localhost:8001/rbac/users/$ADMIN_NAME/roles" \
-H "Kong-Admin-Token: $KONG_ADMIN_TOKEN"
If this was configured correctly the response body will look like this:
{
"user": {
"enabled": true,
"updated_at": 1737490456,
"comment": null,
"id": "49a1d4e5-e306-4b2d-a343-8973afd1360d",
"created_at": 1737490456,
"user_token_ident": "40a46",
"name": "tim",
"user_token": "$2b$09$578ORHJCMmpvDTVbB6hDkeIDsXZkUcgBQRemXdrwH2ex8IYBKWSE."
},
"roles": [
{
"created_at": 1737488148,
"role_source": "local",
"name": "super-admin",
"updated_at": 1737488148,
"ws_id": "fcde03f2-738e-4b29-a63e-fe0cdcc9a76e",
"comment": "Full access to all endpoints, across all workspaces",
"id": "3d7d7bfc-b894-4d9f-b28f-c9396bce201a"
}
]
}
You can see that the RBAC role assigned to the user is super-admin.
Cleanup
Destroy the Kong Gateway container
curl -Ls https://get.konghq.com/quickstart | bash -s -- -d