Option to on/off the Kong Admin GUI

[jeremyjpj0916]

Noticed some errors running migration commands for Kong 2.8.x to 3.7.0 in output related to the app trying to make some random certs in my custom docker image we built using the bazel flow:

2024-06-04T16:18:34.192454132-05:00 2024/06/04 21:18:34 [warn] unable to pre-create '/usr/local/kong/ssl/admin-gui-kong-default.key' file: Read-only file system
2024-06-04T16:18:34.192482866-05:00 Error: 
2024-06-04T16:18:34.192486523-05:00 /usr/local/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:173: /usr/local/kong/ssl/admin-gui-kong-default.key: Read-only file system
2024-06-04T16:18:34.192491722-05:00 stack traceback:
2024-06-04T16:18:34.192496040-05:00     [C]: in function 'assert'
2024-06-04T16:18:34.192500308-05:00     /usr/local/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:173: in function 'gen_default_ssl_cert'
2024-06-04T16:18:34.192516348-05:00     /usr/local/share/lua/5.1/kong/cmd/utils/prefix_handler.lua:518: in function 'prepare_prefix'
2024-06-04T16:18:34.192519254-05:00     /usr/local/share/lua/5.1/kong/cmd/migrations.lua:95: in function 'cmd_exec'
2024-06-04T16:18:34.192521588-05:00     /usr/local/share/lua/5.1/kong/cmd/init.lua:31: in function </usr/local/share/lua/5.1/kong/cmd/init.lua:31>
2024-06-04T16:18:34.192523902-05:00     [C]: in function 'xpcall'
2024-06-04T16:18:34.192532117-05:00     /usr/local/share/lua/5.1/kong/cmd/init.lua:31: in function </usr/local/share/lua/5.1/kong/cmd/init.lua:15>
2024-06-04T16:18:34.192534873-05:00     (command line -e):7: in function 'inline_gen'
2024-06-04T16:18:34.192537377-05:00     init_worker_by_lua(nginx.conf:234):44: in function <init_worker_by_lua(nginx.conf:234):43>
2024-06-04T16:18:34.192539712-05:00     [C]: in function 'xpcall'
2024-06-04T16:18:34.192542677-05:00     init_worker_by_lua(nginx.conf:234):52: in function <init_worker_by_lua(nginx.conf:234):50>


2024-06-04T16:18:34.192955256-05:00 2024/06/04 21:18:34 [verbose] SSL enabled on admin_gui, no custom certificate set: using default certificates
2024-06-04T16:18:34.192960235-05:00 2024/06/04 21:18:34 [verbose] generating admin_gui SSL certificate (/usr/local/kong/ssl/admin-gui-kong-default.crt) and key (/usr/local/kong/ssl/admin-gui-kong-default.key) for listener

Was thinking new field here:
https://github.com/Kong/kong/blob/3.7.0/kong.conf.default#L1915

admin_gui = on/off options to dictate if we even want Kong to do anything with it in the runtimes.

To get around the file permissions issue I just updated the env variables of the container to remove the ssl default:

KONG_ADMIN_GUI_LISTEN = "0.0.0.0:8002, 0.0.0.0:8445"

[chronolaw]

@sumimakito , could you take a look? thanks.

[sumimakito]

Hello @jeremyjpj0916, thank you for bringing up this question.

As kong migrations * commands also read configuration parameters from the environment and/or the file specified via the -c or --conf option, it would be a correct way to skip the TLS cert-key pairs generation by overriding this parameter and omitting the ssl in it, because we have 0.0.0.0:8002, 0.0.0.0:8445 ssl as KONG_ADMIN_GUI_LISTEN by default.

• You can omit the ssl in KONG_ADMIN_GUI_LISTEN if you don't want to generate cert-key pairs but still want to use the Admin GUI
• You can also set KONG_ADMIN_GUI_LISTEN: off in your environment or provide admin_gui_listen = off in the configuration file to disable the Admin GUI