Enable Key Authentication

1. Create a new key-auth plugin:

   echo '
   kind: KongPlugin
   apiVersion: configuration.konghq.com/v1
   metadata:
     name: key-auth
     namespace: kong
   plugin: key-auth
   ' | kubectl apply -f -

   Copied!

2. Apply the plugin by annotating the KongService with the names of the plugins you have created:

   kubectl annotate -n kong kongservice service konghq.com/plugins=proxy-cache-all-endpoints,key-auth --overwrite

   Copied!

3. Test that the API is secure by sending a request using curl -i $PROXY_IP/echo:

   curl -i http://$PROXY_IP/echo 

   Copied!

   This request returns a 401 error with the message No API key found in request.

   You should see the response:

   HTTP/1.1 401 Unauthorized
   Date: Wed, 11 Jan 2044 18:33:46 GMT
   Content-Type: application/json; charset=utf-8
   WWW-Authenticate: Key realm="kong"
   Content-Length: 45
   X-Kong-Response-Latency: 1
   Server: kong/3.16.0.1-enterprise-edition
   
   {
     "message":"No API key found in request",
     "request_id":"89e4883a53a0af51b322204ad1zfa16a"
   }

Key authentication in Kong Gateway works by using the Consumer entity. Keys are assigned to Consumers, and client applications present the key within the requests they make.

Keys are stored as Kubernetes Secrets and Consumers are managed with the KongConsumer CRD.

1. Create a new Secret labeled to use key-auth credential type:

   echo '
   apiVersion: v1
   kind: Secret
   metadata:
      name: alex-key-auth
      namespace: kong
      labels:
         konghq.com/credential: key-auth
         konghq.com/secret: "true"
   stringData:
      key: hello_world
   ' | kubectl apply -f -

   Copied!

2. Create a new Consumer and attach the credential:

   echo '
   kind: KongConsumer
   apiVersion: configuration.konghq.com/v1
   metadata:
     name: alex
     namespace: kong
   spec:
     controlPlaneRef:
       type: konnectNamespacedRef
       konnectNamespacedRef:
         name: gateway-control-plane
   username: alex
   credentials:
   - alex-key-auth
   ' | kubectl apply -f -

   Copied!

3. Wait for the Consumer and its credential to be reconciled:

   kubectl wait -n kong kongconsumer/alex --for=condition=Programmed=True --timeout=5m

   Copied!

4. Make a request to the API and provide your apikey:

   curl "http://$PROXY_IP/echo" \
        --no-progress-meter --fail-with-body  \
        -H "apikey:hello_world"

   Copied!

   The request should be successful.