Why does the default Kong configuration have the GUI (Kong Manager) listen on all IPs

[janv8000]

See title.

Default configuration:

admin_gui_listen = 0.0.0.0:8002

This leaks the following information:

window.K_CONFIG = {
  'ADMIN_API_SSL_PORT': '8444',
  'ADMIN_GUI_URL': '',
  'KONG_EDITION': 'community',
  'ADMIN_GUI_PATH': '/',
  'ANONYMOUS_REPORTS': 'false',
  'ADMIN_API_URL': '',
  'KONG_VERSION': '3.4.0',
  'ADMIN_API_PORT': '8001'
}

The config specifically mentions not listening on all ip's

It is highly recommended to avoid exposing the Admin API to public
interface(s), by using values such as 0.0.0.0:8001

[chronolaw]

@raoxiaoyan , could you give us some comments? thanks.

[hanshuebner]

Kong Manager listens to 0.0.0.0 as a developer convenience. Careful review of the configuration is required for production use.