Get Started with Dynamic Plugin Ordering

Here are some common use cases for dynamic plugin ordering.

Rate limiting before authentication

Let’s say you want to limit the amount of requests against your service and route before Kong requests authentication. You can describe this dependency with the token before.

The following example uses the Rate Limiting Advanced plugin with the Key Authentication plugin as the authentication method.

Admin API

Kubernetes

decK (YAML)

Kong Manager UI

Call the Admin API on port 8001 and enable the rate-limiting plugin, configuring it to run before key-auth:

curl -i -X POST http://localhost:8001/plugins \
  --data name=rate-limiting \
  --data config.minute=5 \
  --data config.policy=local \
  --data config.limit_by=ip \
  --data ordering.before.access=key-auth

apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: limit-before-key-auth
  labels:
    global: "true"
  annotations:
    kubernetes.io/ingress.class: "kong"
config:
  minute: 5
  policy: local
  limit_by: ip
plugin: rate-limiting
ordering:
  before:
    access:
    - key-auth

Add a new plugins section to the bottom of your kong.yaml file. Enable rate-limiting and set the plugin to run before key-auth:

 plugins:
 - name: rate-limiting
   config:
     minute: 5
     policy: local
     limit_by: ip
   ordering:
     before:
       access:
         - key-auth

Your file should now look like this:

 _format_version: "3.0"
 services:
 - host: httpbin.konghq.com
   name: example_service
   port: 80
   protocol: http
   routes:
   - name: mocking
     paths:
     - /mock
     strip_path: true
 plugins:
 - name: rate-limiting
   config:
     minute: 5
     policy: local
     limit_by: ip
   ordering:
     before:
       access:
         - key-auth

This plugin will be applied globally, which means the rate limiting applies to all requests, including every Service and Route in the Workspace.

If you pasted the plugin section under an existing Service, Route, or Consumer, the rate limiting would only apply to that specific entity.

Note: By default, enabled is set to true for the plugin. You can disable the plugin at any time by setting enabled: false.

Sync the configuration:
```
 deck gateway sync kong.yaml
```

Note: Kong Manager support for dynamic plugin ordering is available starting in Kong Gateway 3.1.x.

In Kong Manager, open the default workspace.
From the menu, open Plugins, then click Install Plugin.
Find the Rate Limiting plugin, then click Enable.
Apply the plugin as Global, which means the rate limiting applies to all requests, including every service and route in the workspace.
Complete only the following fields with the following parameters.
1. config.minute: 5
2. config.policy: local
3. config.limit_by: ip
Besides the above fields, there may be others populated with default values. For this example, leave the rest of the fields as they are.
Click Install.
From the Rate Limiting plugin page, click the Ordering tab.
Click Add ordering.
For Before access, click Add plugin.
Choose Key Auth from the Plugin 1 dropdown menu.
Click Update.

The rate limiting plugin now limits the amount of requests against all services and routes in the default workspace before Kong Gateway requests authentication.

Authentication after request transformation

The following example is similar to running rate limiting before authentication.

For example, you may want to first transform a request, then request authentication after transformation. You can describe this dependency with the token after.

Instead of changing the order of the Request Transformer plugin, you can change the order of the authentication plugin (Basic Authentication, in this example).