You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "sebschlue (via GitHub)" <gi...@apache.org> on 2023/09/04 12:59:06 UTC
[GitHub] [apisix-ingress-controller] sebschlue opened a new issue, #1950: bug: There does not seem to be ANY connection between a ApisixRoute object and a ApisixConsumer object
sebschlue opened a new issue, #1950:
URL: https://github.com/apache/apisix-ingress-controller/issues/1950
### Current Behavior
You can specify authentication type inside a ApisixRoute object, but even though there can be more than one ApisixConsumer for the same authentication type in the same namespace, you cannot specify which ApisixConsumer should be connected with which ApisixRoute.
This effectively means that you can only configure ONE type of authentication for the whole namespace.
So, for example:
Given that you have three microservices running in some namespace:
You can configure:
- one to use basic auth
- one to use key auth
- one to use jwt auth
You can also configure:
- all three to use jwt auth with the same key
But you cannot configure:
- all three to use jwt auth but with different keys.
### Expected Behavior
There needs to be a way to connect ApisixRoute object to ApisixConsumer object, for instance by being able to specify the NAME of the consumer object from inside the ApisixRoute object.
### Error Logs
_No response_
### Steps to Reproduce
Follow the tutorial: https://apisix.apache.org/docs/ingress-controller/tutorials/enable-authentication-and-restriction/
and try to configure JWT auth for more than one microservice in the same namespace, so that each microservice uses a different JWT key.
### Environment
k8s: AWS EKS v1.24.13
ingress-controller: container image: apache/apisix-ingress-controller:1.6.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: There does not seem to be ANY connection between a ApisixRoute object and a ApisixConsumer object [apisix-ingress-controller]
Posted by "acuteaura (via GitHub)" <gi...@apache.org>.
acuteaura commented on issue #1950:
URL: https://github.com/apache/apisix-ingress-controller/issues/1950#issuecomment-1747285982
You got the underscore in the wrong place; but it also doesn't matter, because the controller flattens all dashes to underscores, so your consumer_name becomes `kubernetes_dashboard_kubernetes_dashboard_basic_auth`.
You can more easily debug this by just asking the APISIX Admin API for the list of consumers:
https://apisix.apache.org/docs/apisix/admin-api/#consumer
(you can port-forward the apisix-admin service and use the viewer key you hopefully set in your chart values)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-ingress-controller] tao12345666333 commented on issue #1950: bug: There does not seem to be ANY connection between a ApisixRoute object and a ApisixConsumer object
Posted by "tao12345666333 (via GitHub)" <gi...@apache.org>.
tao12345666333 commented on issue #1950:
URL: https://github.com/apache/apisix-ingress-controller/issues/1950#issuecomment-1728950277
Thanks [Aurelia](https://github.com/acuteaura)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-ingress-controller] acuteaura commented on issue #1950: bug: There does not seem to be ANY connection between a ApisixRoute object and a ApisixConsumer object
Posted by "acuteaura (via GitHub)" <gi...@apache.org>.
acuteaura commented on issue #1950:
URL: https://github.com/apache/apisix-ingress-controller/issues/1950#issuecomment-1727678172
FWIW, there is potential for issues here, a large number of consumers might be problematic (you probably want to manage them in APISIX directly then), but it's also hard to have the same keyed value (basic auth username, api key) in more than one namespace which can make running staging / dev / prod side by side challenging. That's a restriction of the APISIX plugin itself though and I opened an issue about it here: https://github.com/apache/apisix/issues/10088
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-ingress-controller] acuteaura commented on issue #1950: bug: There does not seem to be ANY connection between a ApisixRoute object and a ApisixConsumer object
Posted by "acuteaura (via GitHub)" <gi...@apache.org>.
acuteaura commented on issue #1950:
URL: https://github.com/apache/apisix-ingress-controller/issues/1950#issuecomment-1727670722
It's in the article you linked:
https://apisix.apache.org/docs/ingress-controller/tutorials/enable-authentication-and-restriction/#how-to-enable-restriction
Inside the `spec` for ApisixRoute (or ApisixPluginConfig):
```yaml
plugins:
- name: consumer-restriction
enable: true
config:
whitelist:
- "default_jack1"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: There does not seem to be ANY connection between a ApisixRoute object and a ApisixConsumer object [apisix-ingress-controller]
Posted by "sebschlue (via GitHub)" <gi...@apache.org>.
sebschlue commented on issue #1950:
URL: https://github.com/apache/apisix-ingress-controller/issues/1950#issuecomment-1747271779
Thank you very much for your reply.
Unfortunately, this does not work for me.
If I understand this correctly, then "jack1" is the name of the consumer object and "default" is the name of the namespace.
I have now tried to get this working with a simple example of the standard kubernetes dashboard deployed in "kubernetes-dashboard" namespace:
```
apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
http:
- authentication:
enable: true
type: basicAuth
backends:
- serviceName: kubernetes-dashboard
servicePort: 443
match:
hosts:
- XXX
paths:
- /*
name: rule
plugins:
- name: redirect
enable: true
config:
http_to_https: true
- name: ip-restriction
enable: true
config:
whitelist:
- XXX
- name: consumer-restriction
enable: true
config:
whitelist:
- kubernetes-dashboard_kubernetes-dashboard-basic-auth
---
apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
name: kubernetes-dashboard-basic-auth
namespace: kubernetes-dashboard
spec:
authParameter:
basicAuth:
secretRef:
name: kubernets-dashboard-basic-auth
---
apiVersion: apisix.apache.org/v2
kind: ApisixTls
metadata:
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
hosts:
- XXX
secret:
name: XXX
namespace: ingress-apisix
---
apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
scheme: https
```
Basic Auth works, so if I disable consumer-restriction, everything is fine.
But once I enable consumer-restriction, I get error message
```
{"message":"The consumer_name is forbidden."}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: There does not seem to be ANY connection between a ApisixRoute object and a ApisixConsumer object [apisix-ingress-controller]
Posted by "sebschlue (via GitHub)" <gi...@apache.org>.
sebschlue commented on issue #1950:
URL: https://github.com/apache/apisix-ingress-controller/issues/1950#issuecomment-1747313657
Thank you very much for your reply.
I can confirm that it works now.
Honestly, this behavior is not exceptionally pretty ;) but I really appreciate the help that I get here - thank you very much, Aurelia :)
Ticket can be closed from my perspective.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: There does not seem to be ANY connection between a ApisixRoute object and a ApisixConsumer object [apisix-ingress-controller]
Posted by "sebschlue (via GitHub)" <gi...@apache.org>.
sebschlue closed issue #1950: bug: There does not seem to be ANY connection between a ApisixRoute object and a ApisixConsumer object
URL: https://github.com/apache/apisix-ingress-controller/issues/1950
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org