"RBAC is disabled!" and "Authentication is not enabled." messages regardless of correct auth configuration

maraswrona commented 3 years ago

Summary

Kong version: Kong Gateway Enterprise 2.4.1.1
Despite of following the documentation and correct (afaik) configuration of authentication the Kong Manager still reports that RBAC is disabled and that Authentication is not enabled.

Steps To Reproduce

I installed Kong Gateway Enterprise 2.4.1.1 using these instructions: https://docs.konghq.com/enterprise/2.4.x/deployment/installation/amazon-linux-2/
I then followed to https://docs.konghq.com/enterprise/2.4.x/kong-manager/security/ and https://docs.konghq.com/enterprise/2.4.x/kong-manager/authentication/basic/ and https://docs.konghq.com/enterprise/2.4.x/kong-manager/authentication/super-admin/ to configure security.
Despite of following this rather simple set of instructions carefuly, I still receive the "RBAC is disabled! Configuration will not be applied until RBAC is enabled." message on /teams page.
I also tried /login page but the message says "Authentication is not enabled."
When visiting the :8001 (kong admin API root) I noticed that fields like rbac and enforce_rbac are set to "off" even though they are 100% set to on in kong.conf and all the relevant configuration is done according to documentation.

There is nothing useful or at least obvious in startup or error logs.

What am I missing? How can I further debug or troubleshoot this? This seems like a bug to me, hence the bug report, but maybe I'm just so blind. Also noticed very similar issue reported in the Charts repository: https://github.com/Kong/charts/issues/357 - maybe these are related.

Additional Details & Logs

Operating system: Amazon Linux 2 (AWS)

RobSerafini commented 3 years ago

@maraswrona - RBAC is a licensed feature of the Kong Gateway. https://docs.konghq.com/enterprise/changelog/#enterprise-8. If no license is present either on the file system, environment variable or applied via the admin API the setting in kong.conf is not used. Have you applied a license?

maraswrona commented 3 years ago

Following this announcement: https://konghq.com/blog/kong-gateway-enterprise-2-3-now-generally-available/ I assumed the Kong Gateway Enterprise is now available for free. I assumed that Kong Manager, being the part of the Kong Gateway is also included and available for free, along with its features. I simply followed the documentation to set it up and got stuck on the issue described above.

So based on what you're saying, the RBAC (or authentication in general?) is only available on the paid plan of Kong Gateway / Kong Manager? Can I still use Kong + Kong Manager with all its other features without authentication enabled? Unfortunately I haven't found in the documentation any explicit listing of the features available and unavailable in the free version.

BTW. I'm currently using Kong OSS but since I saw the Enteprise version was now free I thought I could try migrating, but maybe it is not worthwhile afterall? What do you think?

mikefero commented 3 years ago

So based on what you're saying, the RBAC (or authentication in general?) is only available on the paid plan of Kong Gateway / Kong Manager?

The link to a change log entry @RobSerafini referenced discuses a portion of the free vs licensed features that are available:

Kong Gateway can now run in free mode, without a license, which gives users access to Kong Manager and an easy upgrade path to Enterprise.
A (non-OSS) Kong Gateway running in its default free Mode can be upgraded to add Enterprise functionality modules and features including Kong Vitals, RBAC, Workspaces, and Enterprise Plugins simply by applying a new Kong license. Contact your Kong sales representative for more information.

The TL;DR there is that yes you can use Kong Manager in free mode with Kong Gateway, but not all features will be available to you; UI notifications should be present in Kong Manager when attempting to use a licensed feature.

Unfortunately I haven't found in the documentation any explicit listing of the features available and unavailable in the free version.

There is a small matrix that helps differentiate between free and licensed mode, but it currently doesn't indicate portions of the Kong Gateway that are enable/disabled based on a license being applied. We'll get this list enhanced and make sure it is prominent in our documentation; thank you for bringing this to our attention.

An older video describing the difference between Kong Gateway (previously known as Kong Enterprise Edition) and Kong Gateway (OSS) (e.g Kong Community Edition) can be found here. To key in on the differences I captured a screenshot from this video; the one area to note is Kong Manager is now available starting with Kong Gateway 2.3.

BTW. I'm currently using Kong OSS but since I saw the Enterprise version was now free I thought I could try migrating, but maybe it is not worthwhile after all? What do you think?

Using Kong Gateway in free mode opens up the ability to use Kong Manager and easily migrate to a licensed/paid tier should the need arise for using licensed only features. All Kong Gateway (OSS) functionality is available within the free mode of Kong Gateway, issues/discussions can still occur here for the mode items, and you get the extra benefits listed in the announcement link presented earlier. With all of that said it is definitely worthwhile to continue using Kong Gateway in free mode.

maraswrona commented 3 years ago

@mikefero Thank you for your insightful response. This clarifies everything.

koushikraghu1297 commented 2 years ago

This actually means if i were to use the enterprise image of kong kong/kong-manager tag:"2.8"

and just enable kong manager in my values configuration - i would not be ale to use kong manager in the free mode ??

This is how my kong manager gui looks -

i have exposed it as ELB ... enabled rbac as well in my values file. Also have changed service port of manager and admin to 80

 http:
    # Enable plaintext HTTP listen for Kong Manager
    enabled: true
    servicePort: 80
    containerPort: 8002
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32080
    # Additional listen parameters, e.g. "reuseport", "backlog=16384"
    parameters: []

  tls:
    # Enable HTTPS listen for Kong Manager
    enabled: true
    servicePort: 443
    containerPort: 8445
    # Set a nodePort which is available if service type is NodePort
    # nodePort: 32443
    # Additional listen parameters, e.g. "reuseport", "backlog=16384"
    parameters:
    - http2

My browser network trace :

That is the IP of kong-manager service ELB..... but the port is mapping to :8001 which is of kong admins service.

How do i use kong manager without authentication in free mode ... Do help me out.

mloskot commented 2 years ago

@koushikraghu1297 Yes, this is very non-intuitive how to use the Manager in the free mode. Do I need to add an admin, login, authenticate, ...

Do you see the default workspace as here? Click it and voila...

from https://youtu.be/kGZyAEVioWg?t=339

Serikpa commented 11 months ago

I have the same problem but the defauit Workspaces not enable

Kong / kong