Add AI Consumers with Kong Operator

The AIGatewayAuthStrategy resource configures the authentication scheme Kong AI Gateway uses to verify downstream clients. This example uses API key authentication.

1. Create a key-auth AI Auth Strategy:

   echo '
   apiVersion: aiconfiguration.konghq.com/v1alpha1
   kind: AIGatewayAuthStrategy
   metadata:
     name: key-auth-provider
     namespace: kong
   spec:
     aiGatewayRef:
       type: namespacedRef
       namespacedRef:
         name: my-ai-gateway-cp
     apiSpec:
       type: key-auth
       key-auth:
         name: key-auth-provider
         displayName: API Key Authentication
         config:
           hideCredentials: Enabled
           keyNames:
             - x-api-key
   ' | kubectl apply -f -

   Copied!

2. Wait for the AI Auth Strategy to be ready:

   kubectl wait aigatewayauthstrategy/key-auth-provider -n kong \
     --for=condition=Programmed=True \
     --timeout=5m

   Copied!

An AIGatewayAuthStrategy takes effect only when it is attached to an AI Model via spec.apiSpec.model.access.authStrategies. Patch the AI Model you created in the deployment step to enable authentication:

kubectl patch aigatewaymodel gpt-4o-mini -n kong \
  --type=merge \
  -p '{"spec":{"apiSpec":{"model":{"access":{"authStrategies":[{"name":"key-auth-provider"}]}}}}}'

Wait for the AI Model to be reconciled with the updated configuration:

kubectl wait aigatewaymodel/gpt-4o-mini -n kong \
  --for=condition=Programmed=True \
  --timeout=5m

The AIGatewayConsumer resource registers a downstream client with the AI Gateway control plane in Konnect.

1. Create an AI Consumer for your platform engineering team:

   echo '
   apiVersion: aiconfiguration.konghq.com/v1alpha1
   kind: AIGatewayConsumer
   metadata:
     name: team-platform
     namespace: kong
   spec:
     aiGatewayRef:
       type: namespacedRef
       namespacedRef:
         name: my-ai-gateway-cp
     apiSpec:
       name: team-platform
       displayName: Platform Engineering
       type: api-key
   ' | kubectl apply -f -

   Copied!

2. Wait for the AI Consumer to be reconciled:

   kubectl wait aigatewayconsumer/team-platform -n kong \
     --for=condition=Programmed=True \
     --timeout=5m

   Copied!

The AIGatewayConsumerCredential resource attaches an API key to an AIGatewayConsumer. Store the key in a Kubernetes Secret first; Kong Operator reads the value from the Secret and never stores it in plain text.

1. Create the Secret:

   kubectl create secret generic team-platform-key \
     --from-literal=api-key=my-platform-team-api-key \
     -n kong
   kubectl label secret team-platform-key konghq.com/secret=true -n kong

   Copied!

2. Create the credential resource:

   echo '
   apiVersion: aiconfiguration.konghq.com/v1alpha1
   kind: AIGatewayConsumerCredential
   metadata:
     name: team-platform-key-auth
     namespace: kong
   spec:
     aiGatewayConsumerRef:
       type: namespacedRef
       namespacedRef:
         name: team-platform
     apiSpec:
       name: team-platform-key-auth
       displayName: Platform Team API Key
       type: api-key
       apiKey:
         type: secretRef
         secretRef:
           name: team-platform-key
           key: api-key
   ' | kubectl apply -f -

   Copied!

3. Wait for the credential to be reconciled:

   kubectl wait aigatewayconsumercredential/team-platform-key-auth -n kong \
     --for=condition=Programmed=True \
     --timeout=5m

   Copied!

Credentials are immutable: AIGatewayConsumerCredential only supports create and delete; updates are not propagated. To rotate a key, delete the credential and create a new one.

Send an authenticated request using the API key:

curl -s -o /dev/null -w "%{http_code}\n" \
  http://$AIGW_HOST:8000/v1/chat/completions \
  -H "x-api-key: my-platform-team-api-key" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"How do I configure a Kong service?"}]}'

Send an unauthenticated request:

curl -s -o /dev/null -w "%{http_code}\n" \
  http://$AIGW_HOST:8000/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"How do I configure a Kong service?"}]}'

You should get a 401 Unauthorized.

AIGatewayConsumerGroup is a named set of AI Consumers that you can target as a unit. Use AI Consumer Groups to:

• Apply shared AI Policies to a team via spec.apiSpec.policies on the AI Consumer Group — each entry is an object with a name field referencing an AIGatewayPolicy by its Kubernetes resource name, which is useful for AI Policies scoped with global: Disabled
• Restrict or allow group access to individual AI Models via spec.apiSpec.model.access.acls on the AIGatewayModel
• Attribute usage across multiple AI Consumers to a single AI Consumer Group in Konnect analytics

AI Consumer membership is declared on the AIGatewayConsumer, not on the AI Consumer Group. Use spec.consumerGroups on the AI Consumer to reference the AI Consumer Groups it belongs to.

1. Create an AI Consumer Group:

   echo '
   apiVersion: aiconfiguration.konghq.com/v1alpha1
   kind: AIGatewayConsumerGroup
   metadata:
     name: platform-team-group
     namespace: kong
   spec:
     aiGatewayRef:
       type: namespacedRef
       namespacedRef:
         name: my-ai-gateway-cp
     apiSpec:
       name: platform-team-group
       displayName: Platform Team
       policies: []
   ' | kubectl apply -f -

   Copied!

2. Wait for the AI Consumer Group to be reconciled:

   kubectl wait aigatewayconsumergroup/platform-team-group -n kong \
     --for=condition=Programmed=True \
     --timeout=5m

   Copied!

3. Enroll the AI Consumer in the AI Consumer Group by patching the consumer resource:

   kubectl patch aigatewayconsumer team-platform -n kong \
     --type=merge \
     -p '{"spec":{"consumerGroups":[{"name":"platform-team-group"}]}}'

   Copied!

4. Wait for the AI Consumer to reconcile with the updated AI Consumer Group membership:

   kubectl wait aigatewayconsumer/team-platform -n kong \
     --for=condition=Programmed=True \
     --timeout=5m

   Copied!

5. Confirm both resources are visible:

   kubectl get aigatewayconsumer,aigatewayconsumergroup -n kong

   Copied!

List all AI Consumers and their reconciliation status:

kubectl get aigatewayconsumer -n kong

You should see an output like the following: NAME ID PROGRAMMED AGE team-platform True 2m

Describe an AI Consumer to see the full status and any reconciliation errors:

kubectl describe aigatewayconsumer/team-platform -n kong