Consumers created via Kong Administrative API are deleted

[nHurD]

NOTE: GitHub issues are reserved for bug reports only.
For anything else, please join the conversation
in Kong Nation https://discuss.konghq.com/c/kubernetes.

---

Summary

Consumers that are created using the administrative API are deleted after a period of time.

Kong Ingress controller version 0.1.0

Kubernetes version

Client Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.2", GitCommit:"bb9ffb1654d4a729bb4cec18ff088eacc153c239", GitTreeState:"clean", BuildDate:"2018-08-08T16:31:10Z", GoVersion:"go1.10.3", Compiler:"gc", Platform:"darwin/amd64"}

Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.3", GitCommit:"2bba0127d85d5a46ab4b778548be28623b32d0b0", GitTreeState:"clean", BuildDate:"2018-05-21T09:05:37Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}

Environment

• Cloud provider or hardware configuration: AWS
• OS (e.g. from /etc/os-release): Debian 8
• Kernel (e.g. uname -a): 4.4.121-k8s
• Install tools: kops
• Others:

What happened

Consumers that were created via a direct integration to the Kong admin interface are removed after a couple of minutes

Expected behvaior

Consumers created from the administrative interface to not be removed

Steps To Reproduce

1. Deploy Kong Ingress controller using the documented all-in-one-minikube methodology: https://github.com/Kong/kubernetes-ingress-controller/blob/master/deploy/minikube.md
2. Create consumers using the administrative api in Kong
3. Verify consumers exist
4. After about 5 minutes, check list of consumers and verify that list is empty

[hbagdi]

Hello @nHurD,

Thank you for opening this issue.
I'm afraid what you're observing is an expected behavior 0.1.0 onwards as noted in the changelog.

Currently, all the entities in Kong are managed by the Ingress Controller, meaning any entity which doesn't have an associated object in k8s object store, will be remove by the ingress controller.

You can currently create KongConsumer custom resources in k8s, which will be synced via Ingress Controller to Kong.

Having said that, in future, consumers and other entities in Kong created manually will not be deleted by Ingress Controller. This is currently not possible as the entities created by Ingress Controller and those created directly via Admin API of Kong cannot be differentiated, making the syncing of entities from k8s to Kong a challenge. This will solved once Kong includes a feature to tag or label entities.

[leoatpolaris]

@hbagdi Can I ask another question? Can Kong Ingress Controller sync entities from K8s to Kong automatically now? Do I have to create Kong entities by yaml manually? Actually I want to add services to K8s manually and Ingress Controller can sync these resources to Kong automatically.

[hbagdi]

@leoatpolaris,

@hbagdi Can I ask another question?

Sure :)

Can Kong Ingress Controller sync entities from K8s to Kong automatically now?

That is primarily what this controller does. You create resources (like services, ingress rules) in k8s and the ingress controller syncs all those resources to Kong.

Do I have to create Kong entities by yaml manually?

Yes, you'll need to create the entities in k8s. You can automate it, it doesn't have to be manually. Please refer to our getting started guide for a better understanding.

[julianguinard]

Hello

Is there any news about this issue? It has been closed but being bound to statically, YML-declared consumers is still problematic in production use cases

For instance, we may have a service that calls the kong API in order to create kong consumers dynamically (upon app user creation for instance). This behavior cannot work using kong-ingress-controller because the periodic sync will delete all of these entries

What kind of workaround would you suggest? Would calling the Kunernetes API from the user creation code in order to create a KongConsumer entry be considered a good practice?

[hbagdi]

Hi @julianguinard

Is there any news about this issue? It has been closed but being bound to statically, YML-declared consumers is still problematic in production use cases

I totally get this point and this is an issue that we are going to solve in the next couple of releases.

What kind of workaround would you suggest? Would calling the Kunernetes API from the user creation code in order to create a KongConsumer entry be considered a good practice?

This is the only work around that exists to get around this problem (Kong Enterprise users can use workspace feature to get around this problem).
Although, this approach is not scalable. If you have a few hundred or a few thousand consumers in Kong, it should be fine, but larger than that, and this solution is not really feasible.

How are we going to solve this in the upcoming releases?

We developed tagging feature in Kong 1.1 specifically to solve this problem.

In the future releases of the Ingress Controller, all the entities created by the Ingress Controller will be tagged and it won't manage all entities in Kong.
Meaning, if you wish to manage Consumers via another service, that will be possible.

Please stay tuned and follow #246 for updates!