Discuss: how to configure `admin_key` for multi-APISIX cluster.

[apache]

Discuss: how to configure `admin_key` for multi-APISIX cluster.

[gxthrj]

For now, apisix-ingress-controller do not support the config admin_key from Apache APISIX.
When using apisix-ingress-controller with APISIX, it is recommended to remove the admin_key setting. You can use allow_admin to restrict the access scope of the APISIX control plane to ensure security.

Now we can discuss how to support the admin_key in apisix-ingress-controller.
In different APISIX clusters, there are different admin_keys. Usually we manage admin_key through secret resource. But it is not easy to sync with CRDs in apisix-ingress-controller, for secret may in the different namespace.

We can use ingress.class to specify APISIX cluster, and also can define an annotation for admin_key, such as ingress.admin_key, But it will need to be updated manually in the future, if admin_key need to be changed.

So anyone has a good idea, can discuss it here. Thanks.

[gxthrj]

@tokers what do you think about this ?

[tokers]

Secret is the most appropriate way, we can watch all namespaces except some unexpected like kube-system, istio-system and etc.

[tokers]

The multiple APISIX cluster support should be implemented by Manager API. We as the invoker of Manager API, only need to pass cluster flag to it.

@gxthrj @membphis

[membphis]

for the CP API, need to support mTLS way. The Admin API has supportted this feature. The Manage API, need @nic-chen 's confirming.

if the ingress-controller needs to connect multiple APISIX clusters, I think using mTLS is a better way than the token or JWT method.

[gxthrj]

The multiple APISIX cluster support should be implemented by Manager API. We as the invoker of Manager API, only need to pass cluster flag to it.

@gxthrj @membphis

This sounds good.
But there is another problem. If we need to specify / add an APISIX Cluster in CRD, the manager api need to config too.
The configuration link has become too long and uncontrollable