Using ACLs with consumer groups

You are browsing unreleased documentation.

ACL configuration with Kong Gateway

This example covers a common use case: as an API owner, you want to regulate access based on the type of request methods and consumer groups. Specifically, the goal is to allow consumers in the dev group to perform GET, POST, and PUT requests on all routes, while reserving the DELETE request functionality exclusively for consumers in the admin group.

Create consumers

Using the API, create two consumers, admin and dev.

1. Create consumer admin:

     curl -i -X POST http://localhost:8001/consumers \
        --data "username=admin"
   

2. Create consumer dev:

     curl -i -X POST http://localhost:8001/consumers \
        --data "username=dev"
   

   The response for each request contains a UUID in the id field that you will need for the rest of the guide.

Create consumer groups

1. Using the API, create a consumer group for dev:

     curl -i -X POST http://localhost:8001/consumer_groups \
         --data "name=dev"
   

2. Then create a consumer group for admin:

     curl -i -X POST http://localhost:8001/consumer_groups \
       --data "name=admin"
   

3. Add a consumer to the admin group by using the UUID of the specific consumer:

    curl -i -X POST http://localhost:8001/consumer_groups/admin/consumers \
      --data "consumer=8a4bba3c-7f82-45f0-8121-ed4d2847c4a4"
   

4. Add a different consumer to the dev group:

    curl -i -X POST http://localhost:8001/consumer_groups/dev/consumers \
      --data "consumer=8a4bba3c-7f82-45f0-8121-ed4d2847c4a4"
   

Create routes

Using the Admin API and the expressions router, create two routes: one that matches GET, POST and PUT, and one that only matches DELETE.

1. Create a route that matches when the method is not DELETE:

    curl --request POST \
      --url http://localhost:8001/services/example-service/routes \
      --form-string name=devs-and-admins \
      --form-string expression='http.path == "/example" && http.method != "DELETE"'
   

2. Create a route that matches when the method is DELETE:

    curl --request POST \
      --url http://localhost:8001/services/example-service/routes \
      --form-string name=only-admins \
      --form-string expression='http.path == "/example" && http.method == "DELETE"'
   

Set up the ACL plugin

Scope the plugin to each of these routes with the respective allow configuration.

Enable the ACL plugin on the devs-and-admin route, setting the allow field to accept both groups:

curl -X POST http://localhost:8001/routes/{routeName|Id}/plugins \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
  "name": "acl",
  "config": {
    "include_consumer_groups": true,
    "allow": [
      "dev",
      "admin"
    ]
  }
}
    '

curl -X POST \
https://{us|eu}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/routes/{routeId}/plugins \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer TOKEN" \
    --data '{"name":"acl","config":{"include_consumer_groups":true,"allow":["dev","admin"]}}'

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: acl-example
plugin: acl
config:
  include_consumer_groups: true
  allow:
  - dev
  - admin
" | kubectl apply -f -

kubectl annotate ingress INGRESS_NAME konghq.com/plugins=acl-example

plugins:
- name: acl
  route: ROUTE_NAME|ID
  config:
    include_consumer_groups: true
    allow:
    - dev
    - admin

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "kpat_YOUR_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

resource "konnect_gateway_plugin_acl" "my_acl" {
  enabled = true

  config = {
    include_consumer_groups = true
    allow = ["dev", "admin"]
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  route = {
    id = konnect_gateway_route.my_route.id
  }
}

Enable another ACL plugin instance on the only-admins route, setting the allow field set to only accept the admin group:

curl -X POST http://localhost:8001/routes/{routeName|Id}/plugins \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
  "name": "acl",
  "config": {
    "include_consumer_groups": true,
    "allow": [
      "admin"
    ]
  }
}
    '

curl -X POST \
https://{us|eu}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/routes/{routeId}/plugins \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer TOKEN" \
    --data '{"name":"acl","config":{"include_consumer_groups":true,"allow":["admin"]}}'

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: acl-example
plugin: acl
config:
  include_consumer_groups: true
  allow:
  - admin
" | kubectl apply -f -

kubectl annotate ingress INGRESS_NAME konghq.com/plugins=acl-example

plugins:
- name: acl
  route: ROUTE_NAME|ID
  config:
    include_consumer_groups: true
    allow:
    - admin

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "kpat_YOUR_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

resource "konnect_gateway_plugin_acl" "my_acl" {
  enabled = true

  config = {
    include_consumer_groups = true
    allow = ["admin"]
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  route = {
    id = konnect_gateway_route.my_route.id
  }
}