Networking Configuration for Kong Manager

    Here are some common configuration scenarios for Kong Manager.

    When Kong Manager is on a dedicated Kong node, it must make external calls to the Admin API. Set admin_api_uri to the location of your Admin API.

    Securing Kong Manager through an authentication plugin

    When Kong Manager is secured through an authentication plugin and is not on a dedicated node, it makes calls to the Admin API on the same host. By default, the Admin API listens on ports 8001 and 8444 on localhost. Change admin_listen if necessary, or set .

    When Kong Manager is secured and served from a dedicated node, set to the location of the Admin API.

    Connecting to the Admin API

    The table below summarizes which properties to set (or defaults to verify) when configuring Kong Manager connectivity to the Admin API.

    To enable authentication, configure the following properties:

    Important: When Kong Manager authentication is enabled, RBAC must be turned on to enforce authorization rules. Otherwise, whoever can log in to Kong Manager can perform any operation available on the Admin API.

    In order to serve Kong Manager over HTTPS, use a trusted certificate authority to issue TLS certificates, and have the resulting .crt and .key files ready for the next step.

    1) Move .crt and files into the desired directory of the Kong node.

    2) Point admin_gui_ssl_cert and at the absolute paths of the certificate and key.

    3) Ensure that admin_gui_url is prefixed with https to use TLS, e.g.,

    1. admin_gui_url = https://test.com:8445

    Using

    External CAs cannot provide a certificate since no one uniquely owns localhost, nor is it rooted in a top-level domain (e.g., .com, ). Likewise, self-signed certificates will not be trusted in modern browsers. Instead, it is necessary to use a private CA that allows you to issue your own certificates. Also ensure that the SSL state is cleared from the browser after testing to prevent stale certificates from interfering with future access to localhost.