Create API Authentication

KonnectAPIAuthConfiguration serves as the container for the authentication credentials required to connect your Kubernetes cluster to Konnect.

It can store either:

• A Personal Access Token
• A System Account Access Token

Depending on your preferences, you can either:

• Create a KonnectAPIAuthConfiguration object with the token specified directly in the spec and use RBAC to restrict access to its type.
• Use a Kubernetes Secret of type Opaque and reference it from the KonnectAPIAuthConfiguration object. The token has to be specified in Secret’s token data field.

The serverURL should be set to the Konnect API url in the region where your account is located.

Using a token in KonnectAPIAuthConfiguration

echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: konnect-api-auth
  namespace: kong
spec:
  type: token
  token: "'$KONNECT_TOKEN'"
  serverURL: us.api.konghq.com
' | kubectl apply -f -

Using a Secret reference

echo 'apiVersion: v1
kind: Secret
metadata:
  name: konnect-api-auth-secret
  namespace: kong
  labels:
    konghq.com/credential: konnect
    konghq.com/secret: "true"
stringData:
  token: "'$KONNECT_TOKEN'"' | kubectl apply -f -

echo '
kind: KonnectAPIAuthConfiguration
apiVersion: konnect.konghq.com/v1alpha1
metadata:
  name: konnect-api-auth
  namespace: kong
spec:
  type: secretRef
  secretRef:
    name: konnect-api-auth-secret
  serverURL: us.api.konghq.com
' | kubectl apply -f -

Run the following command to verify that the authentication configuration was created successfully:

kubectl get konnectapiauthconfiguration konnect-api-auth -n kong

You should see output similar to the following:

NAME               VALID   ORGID                                  SERVERURL
konnect-api-auth   True    5ca26716-02f7-4430-9117-1d1a7a2695e7   https://us.api.konghq.com

The KonnectAPIAuthConfiguration is only usable once its APIAuthValid condition reports True:

kubectl get -n kong konnectapiauthconfiguration konnect-api-auth \
  -o=jsonpath='{.status.conditions[?(@.type=="APIAuthValid")]}' | jq

{
  "observedGeneration": 1,
  "reason": "Valid",
  "status": "True",
  "type": "APIAuthValid"
}