question: Consumer created by Admin API is getting deleted when apisix-ingress-router with image: 2.0.0-rc2 is ran

[smitmistry77]

Current Behavior

I have installed APISIX in decoupled mode of deployment.
I have also deployed apisix-ingress-controller with image [2.0.0-rc2].
I have used the admin API to create a consumer. But when I do Get Consumer Admin API call I am not seeing my consumer.
When I check the apsisix-control-plane pod logs, I see that there is DELETE API getting executed. that is done from apisix-ingress-controller.
Please check this issue and recommend the solution

Expected Behavior

No response

Error Logs

10.42.61.199 - - [19/Jul/2025:15:06:34 +0000] apisix-cp.xxxx:9180 "GET /apisix/admin/consumers/consumer-airatelimit-limitcount/credentials HTTP/1.1" 404 39 0.000 "-" "axios/1.7.9" - - - "http://apisix-cp.xxxx:9180"

10.42.61.199 - - [19/Jul/2025:15:06:34 +0000] apisix-cp.ot-model-services:9180 "DELETE /apisix/admin/consumers/consumer-airatelimit-limitcount HTTP/1.1" 200 85 0.009 "-" "axios/1.7.9" - - - "http://apisix-cp.xxxxx:9180"

Steps to Reproduce

1. Install latest Apisix apache/apisix:3.13.0-debian
2. Apisixi ingress controller with 2.0.0-rc2
3. etcd with bitnami/etcd:3.5.7

Environment

• APISIX Ingress controller version (run apisix-ingress-controller version --long)
• Kubernetes cluster version (run kubectl version)
• OS version if running APISIX Ingress controller in a bare-metal environment (run uname -a)

[smitmistry77]

APISIX version: 3.13.0-debian
APISIX Ingress Controller version: 2.0.0-rc2
Kubernetes version: v1.30.6+rke2r1
Deployment method: Helm chart
Operating mode: Decoupled mode with etcd

[juzhiyuan]

Hi @smitmistry77, in APISIX Ingress Controller 2.0.0, there are two architectures: https://github.com/apache/apisix-ingress-controller/blob/v2.0.0/docs/en/latest/upgrade-guide.md#architecture-in-200

Everything will be managed through configurations. If you use the Admin API to write policies, they will be overwritten in the next sync. Refer to https://github.com/apache/apisix-ingress-controller/blob/v2.0.0/docs/en/latest/upgrade-guide.md#controller-only-configuration-source

[smitmistry77]

Thanks @juzhiyuan , for the response to the query.
I want to know, that there are some limitations with CRDs as well in 2.0.0-rc2 like we will not be able to add multiple plugins in ApisixConsumer, like how we are able to do in Admin API.
Also if we use Consumer for this case then will it sync from ingress controller - 2.0.0-rc2?
Also there is no CRD for consumer groups

[smitmistry77]

Writing the configuration details again here:
APISIX version: 3.13.0-debian
APISIX Ingress Controller version: 2.0.0-rc2
Kubernetes version: v1.30.6+rke2r1
Deployment method: Helm chart
Operating mode: Decoupled mode with etcd

[juzhiyuan]

Thanks @smitmistry77, can you please paste all your configurations here with more details? I would like to try them out and confirm. Then we can plan how to resolve the challenge or missed CRD in your case. What do you think?

[smitmistry77]

Sure @juzhiyuan ,
Let me explain you my usecase: I want to divide the traffic based on the lite customers (Consumers) and Premium Consumers.
So firstly via Admin API,
Step1: I am creating two consumer groups: LiteConsumerGroup and PremiumConsumerGroup.
Step2: I am creating one consumer in lite group and associating the LiteConsumerGroup Id to it, one for PremiumConsumer and associating the PremiumConsumerGroup id to it.
Step3: I am create a route for a simple call to Upstream.
Step4: I am executing the API.
Below are the API Curls:
Create lite Consumer Group:
curl --request PUT
--url https://localhost:9180/apisix/admin/consumer_groups/lite
--header 'X-API-KEY: {{Admin_Apikey}}'
--header 'content-type: application/json'
--data '{
"plugins": {
"ai-proxy-multi": {
"fallback_strategy": "instance_health_and_rate_limiting",
"instances": [
{
"name": "gemma3-instance",
"provider": "openai-compatible",
"priority": 2,
"weight": 0,
"auth": {
"header": {
"Authorization": ""
}
},
"options": {
"model": "google/gemma-xxxx"
},
"override": {
"endpoint": "http://abcd/v1/chat/completions"
}
},
{
"name": "llama4-instance",
"provider": "openai-compatible",
"priority": 1,
"weight": 0,
"auth": {
"header": {
"Authorization": ""
}
},
"options": {
"model": "llama4"
},
"override": {
"endpoint": "http://xyz/v1/chat/completions"
}
}
]
},
"ai-rate-limiting": {
"instances": [
{
"name": "gemma3-instance",
"limit": 20,
"time_window": 60
}
],
"limit_strategy": "prompt_tokens"
},
"limit-count": {
"count": 1,
"time_window": 60,
"rejected_code": 429,
"key_type": "var",
"key": "consumer_name"
}
}
}'
Create a Premium Consumer Group

curl --request PUT
--url https://localhost:9180/apisix/admin/consumer_groups/premium
--header 'X-API-KEY: {{Admin_Apikey}}'
--header 'content-type: application/json'
--data '{
"plugins": {
"ai-proxy-multi": {
"fallback_strategy": "instance_health_and_rate_limiting",
"instances": [
{
"name": "gemma3-instance",
"provider": "openai-compatible",
"priority": 2,
"weight": 0,
"auth": {
"header": {
"Authorization": ""
}
},
"options": {
"model": "google/gemma-xxxx"
},
"override": {
"endpoint": "http://abcd/v1/chat/completions"
}
},
{
"name": "llama4-instance",
"provider": "openai-compatible",
"priority": 1,
"weight": 0,
"auth": {
"header": {
"Authorization": ""
}
},
"options": {
"model": "meta-llama/Llama-xxxx"
},
"override": {
"endpoint": "http://xyz/v1/chat/completions"
}
}
]
},
"ai-rate-limiting": {
"instances": [
{
"name": "gemma3-instance",
"limit": 30,
"time_window": 60
}
],
"limit_strategy": "prompt_tokens"
},
"limit-count": {
"count": 3,
"time_window": 60,
"rejected_code": 429,
"key_type": "var",
"key": "consumer_name"
}
}
}'
Lite Consumer
curl --request PUT
--url https://localhost:9180/apisix/admin/consumers
--header 'X-API-KEY: {{Admin_Apikey}}'
--header 'content-type: application/json'
--data '{
"username": "consumer-lite",
"plugins": {
"key-auth": {
"key": "xxxxx"
}
},
"group_id":"lite"
}'
Premium Consumer
curl --request PUT
--url https://localhost:9180/apisix/admin/consumers
--header 'X-API-KEY: {{Admin_Apikey}}'
--header 'content-type: application/json'
--data '{
"username": "consumer-premium",
"plugins": {
"key-auth": {
"key": "xxxx"
}
},
"group_id":"premium"
}'
Create Route
curl --request PUT
--url https://localhost:9180/apisix/admin/routes
--header 'X-API-KEY: {{Admin_Apikey}}'
--header 'content-type: application/json'
--data '{
"id": "route-consumer-category",
"uri": "/consumercategory",
"methods": [
"POST"
],
"plugins": {
"key-auth": {}
}
}'
Execute Req with Lite Consumer
curl --request POST
--url https://localhost:9180/consumercategory
--header 'apikey: lite'
--header 'content-type: application/json'
--data '{
"model": "google/gemma-xxxx",
"messages": [
{
"role": "user",
"content": "What is APISIX"
}
]
}'

Execute Req with Premium Consumer
curl --request POST
--url https://localhost:9180/consumercategory
--header 'apikey: lite'
--header 'content-type: application/json'
--data '{
"model": "google/gemma-xxxx",
"messages": [
{
"role": "user",
"content": "What is APISIX"
}
]
}'

Now my question is, can I do the above setup in ADC format with the apisix-ingress-controller 2.0.0-rc2 image?
If yes, how? and if no, then why?
In the github repo where the CRD yaml file is present, I don't see the Consumer_Groups CRD. correct me here if I am wrong.

[smitmistry77]

https://docs.api7.ai/apisix/reference/apisix-ingress-controller/examples#configure-plugin-on-consumer - Here it tells that Plugin configuration is not supported for Apsisix Consumer

[smitmistry77]

Any update will be really helpful here