このページは、まだ日本語ではご利用いただけません。翻訳中です。
旧バージョンのドキュメントを参照しています。
最新のドキュメントはこちらをご参照ください。
Get Started with Dynamic Plugin Ordering
Here are some common use cases for dynamic plugin ordering.
Rate limiting before authentication
Let’s say you want to limit the amount of requests against your service and route
before Kong requests authentication. You can describe this dependency with the
token before
.
The following example uses the Rate Limiting Advanced
plugin with the Key Authentication plugin as the
authentication method.
Admin API
Kubernetes
decK (YAML)
Kong Manager UI
Call the Admin API on port 8001
and enable the
rate-limiting
plugin, configuring it to run before key-auth
:
curl -i -X POST http://localhost:8001/plugins \
--data name=rate-limiting \
--data config.minute=5 \
--data config.policy=local \
--data config.limit_by=ip \
--data ordering.before.access=key-auth
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
name: limit-before-key-auth
labels:
global: "true"
annotations:
kubernetes.io/ingress.class: "kong"
config:
minute: 5
policy: local
limit_by: ip
plugin: rate-limiting
ordering:
before:
access:
- key-auth
-
Add a new plugins
section to the bottom of your kong.yaml
file. Enable
rate-limiting
and set the plugin to run before key-auth
:
plugins:
- name: rate-limiting
config:
minute: 5
policy: local
limit_by: ip
ordering:
before:
access:
- key-auth
Your file should now look like this:
_format_version: "3.0"
services:
- host: httpbin.konghq.com
name: example_service
port: 80
protocol: http
routes:
- name: mocking
paths:
- /mock
strip_path: true
plugins:
- name: rate-limiting
config:
minute: 5
policy: local
limit_by: ip
ordering:
before:
access:
- key-auth
This plugin will be applied globally, which means the rate limiting
applies to all requests, including every Service and Route in the Workspace.
If you pasted the plugin section under an existing Service, Route, or
Consumer, the rate limiting would only apply to that specific
entity.
Note: By default, enabled
is set to true
for the plugin. You can
disable the plugin at any time by setting enabled: false
.
-
Sync the configuration:
deck gateway sync kong.yaml
Note: Kong Manager support for dynamic plugin ordering is available starting in Kong Gateway 3.1.x.
- In Kong Manager, open the default workspace.
- From the menu, open Plugins, then click Install Plugin.
- Find the Rate Limiting plugin, then click Enable.
- Apply the plugin as Global, which means the rate limiting applies to all requests, including every service and route in the workspace.
- Complete only the following fields with the following parameters.
- config.minute:
5
- config.policy:
local
- config.limit_by:
ip
Besides the above fields, there may be others populated with default values. For this example, leave the rest of the fields as they are.
- Click Install.
- From the Rate Limiting plugin page, click the Ordering tab.
- Click Add ordering.
- For Before access, click Add plugin.
- Choose Key Auth from the Plugin 1 dropdown menu.
- Click Update.
The rate limiting plugin now limits the amount of requests against all services and routes in the default workspace before Kong Gateway requests authentication.
The following example is similar to running rate limiting before authentication.
For example, you may want to first transform a request, then request authentication
after transformation. You can describe this dependency with the token after
.
Instead of changing the order of the Request Transformer
plugin, you can change the order of the authentication plugin
(Basic Authentication, in this example).
Admin API
Kubernetes
decK (YAML)
Kong Manager UI
Call the Admin API on port 8001
and enable the
basic-auth
plugin, configuring it to run after request-transformer
:
curl -i -X POST http://localhost:8001/plugins \
--data name=basic-auth \
--data ordering.after.access=request-transformer
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
name: auth-after-transform
labels:
global: "true"
annotations:
kubernetes.io/ingress.class: "kong"
plugin: basic-auth
ordering:
after:
access:
- request-transformer
-
Add a new plugins
section to the bottom of your kong.yaml
file. Enable
basic-auth
and set the plugin to run after request-transformer
:
plugins:
- name: basic-auth
config: {}
ordering:
after:
access:
- request-transformer
Your file should now look like this:
_format_version: "3.0"
services:
- host: httpbin.konghq.com
name: example_service
port: 80
protocol: http
routes:
- name: mocking
paths:
- /mock
strip_path: true
plugins:
- name: basic-auth
config: {}
ordering:
after:
access:
- request-transformer
Note: By default, enabled
is set to true
for the plugin. You can
disable the plugin at any time by setting enabled: false
.
-
Sync the configuration:
deck gateway sync kong.yaml
Note: Kong Manager support for dynamic plugin ordering is available starting in Kong Gateway 3.1.x.
- In Kong Manager, open the default workspace.
- From the menu, open Plugins, then click Install Plugin.
- Find the Basic Authentication plugin, then click Enable.
- Apply the plugin as Global, which means the rate limiting applies to all requests, including every service and route in the workspace.
- Click Install.
- From the Basic Authentication plugin page, click the Ordering tab.
- Click Add ordering.
- For After access, click Add plugin.
- Choose Request Transformer from the Plugin 1 dropdown menu.
- Click Update.
The basic authentication plugin now requests authentication after the request is transformed.