Kong Ingress Controller: Deploying the KIC with no Enterprise license

While installing Kong Gateway with Kong Ingress Controller (KIC) and no Enterprise license present, we noticed that enterprise-only plugins (such as openid-connect) fail to apply.

When reviewing the logs, or the Kubernetes events for the affected resource, we can see a schema violation stating the plugin is enterprise-only, surfaced through one of two paths:

As an admission-webhook rejection when applying the resource:

Error from server: error when creating "plugin.yaml": admission webhook "validations.kong.konghq.com" denied the request: openid-connect is an enterprise only plugin

Or as a KongConfigurationApplyFailed Warning Event on the resource if the webhook path is bypassed:

Warning  KongConfigurationApplyFailed  ingress-controller  openid-connect is an enterprise only plugin

Note: this is specifically an absent-license symptom. An expired (but present) Enterprise license behaves differently — expired licenses do not block enterprise-only plugin creation the way an absent license does.

This occurs because no Enterprise license is loaded on the Gateway/data plane, so enterprise-only plugins are rejected.

We can first verify this by checking the startup logs for the proxy pod for licensing-related messages.

To resolve this, please redeploy the license and verify the steps.

Note: You will need to restart/delete/deploy the pods following the new license secret to see the effect.