KongConsumer cannot be programmed. Error: Entity tags missing fields {"name": "", "error": "no name"}

[konsti]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I deploy the KIC with the Kubernetes Gateway Operator. Using the example configuration from the documentation with

• kong/kubernetes-ingress-controller:3.3.1 and
• kong/kong:3.8.0

When I try to create a KongConsumer resource, e.g.:

apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: example-consumer
  namespace: example
  annotations:
    kubernetes.io/ingress.class: "kong"
username: example-consumer
credentials:
- example-basic-auth

The controller fails to sync the config to the data plane with the following error:

2024-09-26 11:46:46.570	
2024-09-26T09:46:46Z	error	Entity tags missing fields	{"name": "", "error": "no name"}

The data plane reports an 400 error:

"POST /config?check_hash=1&flatten_errors=1 HTTP/1.1" 400 1133 "-" "Go-http-client/1.1"

Switching to versions:

• kong/kubernetes-ingress-controller:3.2.4 and
• kong/kong:3.7.1

solves the issue and the KongConsumer is synced.

Expected Behavior

The KongConsumer can be synced without an error.

Steps To Reproduce

1. Install the newest versions of the ingress-controller and kong.
2. Try to create a new `KongConsumer` resource.

Kong Ingress Controller version

3.3.1

Kubernetes version

Server Version: v1.30.4+k3s1

Anything else?

No response

[randmonkey]

I could not reproduce the issue without the credentials part. The error seems to be triggered by the credentials.
Could you please provide the details of your secret example-basic-auth?

[m-okm]

I have the same issue and was able to reproduce it with the basic-auth plugin sample data.

Secret config is:

apiVersion: v1
kind: Secret
metadata:
  name: alex-basic-auth
  labels:
    konghq.com/credential: basic-auth
stringData:
  username: alex
  password: secret123

[fredericve]

Seeing the same problem here. Using similar config to the sample data. Works fine with older versions.

[m-okm]

@randmonkey I would like to assist to get this issue solved, as @konsti seems to be unavailable to follow up.

I have used the helm chart to deploy kong, added a custom plugin (nokia oidc) and tried to activate the basic auth plugin following the basic auth plugin guide for Kubernetes (https://docs.konghq.com/hub/kong-inc/basic-auth/how-to/basic-example/).
The result is the error mentioned above.
Do you need additional feedback?

[randmonkey]

@m-okm Looks like there are some invalid configuration generated and sent to Kong gateway. Likely that the plugin got an invalid configuration, but no tags are attached to the translated Kong entity so KIC cannot locate the error. Please provide the related KIC logs related to it.
If possible, Please enable debug log and provide raw errors returned from Kong gateway by:
(1) Add the envs to your ingress-controller (if you used the kong/ingress charts to deploy) to enable diagnostic server of KIC:

controller:
  ingressController:
    env:
      log_level: "debug"
      dump_config: "true"

(2) Use kubectl port-forward to forward the KIC's diagnostic server:

kubectl port-forward pod/kong-contoller-********-***** -n kong 10256

(3) Fetch the raw error from Kong gateway:

curl 127.0.0.1:10256/debug/config/raw-error

and tell us the result.

[m-okm]

Great, I will do so, unfortunately I need some time to do the configuration (at least a couple of days)

[m-okm]

@randmonkey, I am driving mad...
I set up a new cluster with Kubernetes 1.30.5. I was able to install the standard kong ingress helm chart.
Using my chart (just using a custom docker image with plugins) failed on the initContainer Step.
This custom image failed for Kong 3.6.1, 3.7.1 snd 3.8.0

But I was able to install it on Kubernetes 1.29.9, as well as on 1.28.14
Unfortunately I was not able to reproduce the basic-auth issue mentioned above.

From my point of view this ticket can be closed apart someone else can provide the logs / a description to reproduce the issue.

THank you for your effort

[randmonkey]

@konsti @fredericve I will close the issue as "Not reproducible" in 7 days if there are no further detailed reproduction that I can follow. If you have further evidence of the issue or more detailed reproducing scenario, please leave a comment.