Configuration Reference for Kong Gateway - v3.3.x

<!DOCTYPE html> <html lang="en-US" itemscope itemtype="http://schema.org/Article"> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">  <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript" charset="UTF-8" data-domain-script="2c4de954-6bec-4e93-8086-64cb113f151a"> </script> <script type="text/javascript"> function OptanonWrapper() { } </script>   <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer', 'GTM-NL48VKT');</script>  <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Configuration Reference for Kong Gateway - v3.3.x | Kong Docs</title> <meta name="description" content="Documentation for Kong, the Cloud Connectivity Company for APIs and Microservices."> <meta name="author" content="KongHQ"> <meta property="og:title" content="Configuration Reference for Kong Gateway - v3.3.x | Kong Docs"> <meta property="og:site_name" content="Kong Docs">  <meta property="og:url" content="https://docs.konghq.com"> <meta property="og:description" content="Documentation for Kong, the Cloud Connectivity Company for APIs and Microservices."> <meta property="og:type" content="website"> <meta property="og:locale" content="en_US"> <meta property="og:image" content="https://docs.konghq.com/assets/images/share.png"> <meta name="twitter:card" content="summary_large_image"> <meta name="twitter:site" content="@thekonginc"> <meta name="twitter:creator" content="@thekonginc"> <meta name="twitter:url" content="https://docs.konghq.com"> <meta name="twitter:description" content="Documentation for Kong, the Cloud Connectivity Company for APIs and Microservices."> <meta name="twitter:image" content="https://docs.konghq.com/assets/images/share.png"> <meta property="fb:admins" content="227304446"> <meta property="fb:admins" content="576641408"> <meta name="google-site-verification" content="CrU3zp02dNKTe8NSAipL4NCPkrIjDXG8fViTZ-MIzP4"> <script type="application/ld+json"> { "@context": "http://schema.org", "@type": "Organization", "name": "KongHQ", "url": "https://docs.konghq.com", "logo": "https://docs.konghq.com/assets/images/logo.png", "sameAs": [ "https://www.facebook.com/konginc", "https://twitter.com/thekonginc", "https://plus.google.com/+mashape" ] } </script>  <link rel="dns-prefetch" href="https://cloud.typography.com"> <link rel="dns-prefetch" href="https://dev.visualwebsiteoptimizer.com"> <link rel="dns-prefetch" href="https://cdn.segment.com"> <link rel="icon" type="image/x-icon" href="/assets/images/favicon.ico"> <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@docsearch/css@3"> <link rel="canonical" href="https://docs.konghq.com/gateway/latest/reference/configuration/"> <link rel="alternate" hreflang="x-default" href="https://docs.konghq.com/gateway/3.3.x/reference/configuration/"> <link rel="alternate" hreflang="ja" href="https://docs.jp.konghq.com/gateway/3.3.x/reference/configuration/"> <meta name="robots" content="follow,noindex">  <script src="https://kit.fontawesome.com/1332a92967.js" crossorigin="anonymous"> </script> <script src="/vite/assets/application-D8sXFsvE.js" crossorigin="anonymous" type="module"></script> <link href="/vite/assets/_commonjsHelpers-Cpj98o6Y.js" rel="modulepreload" as="script" crossorigin="anonymous"> <link rel="stylesheet" href="/vite/assets/application-C5Quk452.css" media="screen"> </head> <body id="" data-spy="scroll" data-target="#scroll-sidebar" data-offset="350">  <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-NL48VKT" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>  <header class="navbar-v2 closed"> <a class="skip-main" href="#main">Skip to content</a>    <div class="navbar-content"> <a href="https://konghq.com" class="navbar-brand col col-xl-auto" target="_blank" rel="noopener noreferrer"> <img src="/assets/images/logos/konglogo-dark-theme.svg" alt="Kong Logo" id="kong-logo"> </a> <span class="logo-divider">|</span> <a href="/" class="navbar-brand col col-xl-auto"> <img src="/assets/images/logos/docslogo-dark-theme.svg" alt="Kong Docs Logo" id="kong-docs-logo"> </a> <div class="separator mobile"></div> <div class="search-input-wrapper" id="getkong-algolia-search-input"> </div> <div class="search-results-wrapper"></div> <div class="navbar-items" role="navigation" aria-label="Main menu"> <ul class="navbar-items" role="menubar"> <li id="top-module-list" aria-haspopup="true" role="menuitem" aria-expanded="false" class="navbar-item main-menu-item with-submenu active"> <span tabindex="0" id="docs-link" class="main-menu-item-title">Docs</span> <span class="caret"></span> <ul class="navbar-item-submenu" role="menu"> <div class="submenu-section"> <li role="menuitem" class="docs-dropdown-li"> <a href="/api/" class="docs-dropdown-li__link" tabindex="-1"> <div class="docs-dropdown-li__card"> <span class="heading">Explore the API Specs</span> <div class="docs-dropdown-li__card-link"> <img src="/assets/images/landing-page/view-all-api-specs.png" alt="View all API Specs"> <span class="docs-dropdown-li__card-image"> View all API Specs <img src="/assets/images/landing-page/arrow-right.svg" alt="View all API Specs arrow image"> </span> </div> </div> </a> </li> <li role="menuitem" class="docs-dropdown-li" tabindex="-1"> <div class="docs-dropdown-li__section"> <div class="docs-dropdown-li__section-title"> <span class="heading">Documentation</span> </div> <div class="docs-dropdown-li__section-items"> <a class="item item-all" href="/api/" tabindex="-1"> <div class="item__description"> <div class="item__description-title">API Specs</div> </div> </a> <a class="item" href="/gateway/latest/" tabindex="-1"> <div class="item__description"> <div class="item__description-title">Kong Gateway</div> <div class="item__description-desc">Lightweight, fast, and flexible cloud-native API gateway</div> </div> </a> <a class="item" href="/konnect/" tabindex="-1"> <div class="item__description"> <div class="item__description-title">Kong Konnect</div> <div class="item__description-desc">Single platform for SaaS end-to-end connectivity</div> </div> </a> <a class="item" href="/gateway/latest/ai-gateway/" tabindex="-1"> <div class="item__description"> <div class="item__description-title">Kong AI Gateway</div> <div class="item__description-desc">Multi-LLM AI Gateway for GenAI infrastructure</div> </div> </a> <a class="item" href="/mesh/latest/" tabindex="-1"> <div class="item__description"> <div class="item__description-title">Kong Mesh</div> <div class="item__description-desc">Enterprise service mesh based on Kuma and Envoy</div> </div> </a> <a class="item" href="/deck/" tabindex="-1"> <div class="item__description"> <div class="item__description-title">decK</div> <div class="item__description-desc">Helps manage Kong’s configuration in a declarative fashion</div> </div> </a> <a class="item" href="/kubernetes-ingress-controller/latest/" tabindex="-1"> <div class="item__description"> <div class="item__description-title">Kong Ingress Controller</div> <div class="item__description-desc">Works inside a Kubernetes cluster and configures Kong to proxy traffic</div> </div> </a> <a class="item" href="/gateway-operator/latest/" tabindex="-1"> <div class="item__description"> <div class="item__description-title">Kong Gateway Operator</div> <div class="item__description-desc">Manage your Kong deployments on Kubernetes using YAML Manifests</div> </div> </a> <a class="item" href="https://docs.insomnia.rest/" tabindex="-1" target="_blank" rel="noopener nofollow noreferrer "> <div class="item__description"> <div class="item__description-title">Insomnia</div> <div class="item__description-desc">Collaborative API development platform</div> </div> </a> </div> </div> </li> </div> </ul> </li> <li role="menuitem" aria-haspopup="true" aria-expanded="false" class="navbar-item main-menu-item with-submenu navbar-item-hub"> <span id="plugin-link" class="main-menu-item-title" tabindex="0">Plugin Hub</span> <span class="caret"></span> <ul class="navbar-item-submenu" role="menu"> <div class="submenu-section"> <li role="menuitem" class="docs-dropdown-li"> <a href="/hub/" class="docs-dropdown-li__link" tabindex="-1"> <div class="docs-dropdown-li__card"> <span class="heading">Explore the Plugin Hub</span> <div class="docs-dropdown-li__card-link"> <img src="/assets/images/landing-page/view-all-plugins.svg" alt="View all plugins"> <span class="docs-dropdown-li__card-image"> View all plugins <img src="/assets/images/landing-page/arrow-right.svg" alt="View all plugins arrow image"> </span> </div> </div> </a> </li> <li role="menuitem" class="docs-dropdown-li"> <div class="docs-dropdown-li__section"> <div class="docs-dropdown-li__section-title"> <span class="heading">Functionality</span> <a href="/hub/" class="view-all" tabindex="-1"> View all <img src="/assets/images/landing-page/arrow-right.svg" alt="View all arrow image"> </a> </div> <div class="docs-dropdown-li__section-items"> <a class="item item-all" href="/hub/" tabindex="-1"> <div class="item__description"> <div class="item__description-title">View all plugins</div> </div> </a> <a class="item" href="/hub/?category=ai" tabindex="-1"> <div> <img src="/assets/images/nav/hub/ai.svg" alt="AI's icon"> </div> <div class="item__description"> <div class="item__description-title">AI</div> <div class="item__description-desc">Govern, secure, and control AI traffic with multi-LLM AI Gateway plugins</div> </div> </a> <a class="item" href="/hub/?category=authentication" tabindex="-1"> <div> <img src="/assets/images/nav/hub/lock_person.svg" alt="Authentication's icon"> </div> <div class="item__description"> <div class="item__description-title">Authentication</div> <div class="item__description-desc">Protect your services with an authentication layer</div> </div> </a> <a class="item" href="/hub/?category=security" tabindex="-1"> <div> <img src="/assets/images/nav/hub/shield.svg" alt="Security's icon"> </div> <div class="item__description"> <div class="item__description-title">Security</div> <div class="item__description-desc">Protect your services with additional security layer</div> </div> </a> <a class="item" href="/hub/?category=traffic-control" tabindex="-1"> <div> <img src="/assets/images/nav/hub/route.svg" alt="Traffic Control's icon"> </div> <div class="item__description"> <div class="item__description-title">Traffic Control</div> <div class="item__description-desc">Manage, throttle and restrict inbound and outbound API traffic</div> </div> </a> <a class="item" href="/hub/?category=serverless" tabindex="-1"> <div> <img src="/assets/images/nav/hub/serverless.svg" alt="Serverless's icon"> </div> <div class="item__description"> <div class="item__description-title">Serverless</div> <div class="item__description-desc">Invoke serverless functions in combination with other plugins</div> </div> </a> <a class="item" href="/hub/?category=analytics-monitoring" tabindex="-1"> <div> <img src="/assets/images/nav/hub/bar_chart.svg" alt="Analytics & Monitoring's icon"> </div> <div class="item__description"> <div class="item__description-title">Analytics & Monitoring</div> <div class="item__description-desc">Visualize, inspect and monitor APIs and microservices traffic</div> </div> </a> <a class="item" href="/hub/?category=transformations" tabindex="-1"> <div> <img src="/assets/images/nav/hub/swap_horiz.svg" alt="Transformations's icon"> </div> <div class="item__description"> <div class="item__description-title">Transformations</div> <div class="item__description-desc">Transform request and responses on the fly on Kong</div> </div> </a> <a class="item" href="/hub/?category=logging" tabindex="-1"> <div> <img src="/assets/images/nav/hub/list_alt.svg" alt="Logging's icon"> </div> <div class="item__description"> <div class="item__description-title">Logging</div> <div class="item__description-desc">Log request and response data using the best transport for your infrastructure</div> </div> </a> </div> </div> </li> </div> </ul> </li> <li role="menuitem" class="main-menu-item"> <a href="https://support.konghq.com/" class="navbar-item" target="_blank" rel="noopener nofollow noreferrer ">Support</a> </li> <li role="menuitem" class="main-menu-item"> <a href="https://konghq.com/community/" class="navbar-item" target="_blank" rel="noopener noreferrer">Community</a> </li> <li role="menuitem" class="main-menu-item"> <a href="https://education.konghq.com" class="navbar-item" target="_blank" rel="noopener nofollow noreferrer ">Kong Academy</a> </li> </ul> <a id="top-cta" href="https://konghq.com/contact-sales?utm_source=docs.konghq.com" class="navbar-button" target="_blank" rel="noopener nofollow noreferrer "> Get a Demo </a> <a id="konnect-cta" href="https://konghq.com/products/kong-konnect/register?utm_medium=referral&utm_source=docs&utm_campaign=gateway-konnect&utm_content=top-nav" class="navbar-button" target="_blank" rel="noopener nofollow noreferrer "> Start Free Trial </a> </div> <div id="navbar-menu-toggle-button" class="small-screen-button" aria-label="Toggle navigation"> <div></div> <div></div> <div></div> </div> </div> </header> <div class="page v2 " data-url="/gateway/3.3.x/reference/configuration/"> <div class="page--header-background page--header-background-doc"></div> <div class="container"> <header class="page-header page-header-doc"> <div class="page-header-product-version"> <div class="edition"> Kong Gateway </div> <div class="version"> 3.3.x </div> </div> <div class="page-header--nav"> <i class="sidebar-toggle"></i> <ul class="breadcrumbs"> <li class="breadcrumb-item"> <a href="/"> <img src="/assets/images/icons/hub-layout/icn-breadcrumbs.svg" alt="Home icon"> </a> </li> <li class="breadcrumb-item"> <a href="/gateway/3.3.x/">Kong Gateway</a> </li> <li class="breadcrumb-item"> Reference </li> <li class="breadcrumb-item"> <a href="/gateway/3.3.x/reference/configuration/">Configuration Reference for Kong Gateway</a> </li> </ul> <div class="github-links"> <div class="github-links--edit"> <a href="https://github.com/Kong/kong/edit/master/kong.conf.default" target="_blank" rel="noopener nofollow noreferrer "> <img src="/assets/images/icons/third-party/logo-github-white.svg" alt="github-edit-page">Edit this page </a> </div> <div class="github-links--issues"> <a href="https://github.com/Kong/docs.konghq.com/issues/" target="_blank" rel="noopener nofollow noreferrer "> <img src="/assets/images/icons/documentation/icn-monitoring-white.svg" alt="report-issue">Report an issue</a> </div> </div> </div> </header> <aside class="docs-sidebar"> <i class="fa fa-times close-sidebar"></i> <div class="sidebar-title-container"> <div class="docsets-dropdown dropdown"> <button class="dropdown-button" id="module-dropdown" type="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false" tabindex="0"> <span> Kong Gateway </span> <span class="caret"></span> </button> <ul class="dropdown-menu dropdown-menu-right with-submenu" id="module-list" role="menu" aria-labelledby="module-dropdown" aria-hidden="true"> <li role="menuitem" tabindex="-1" class="active"> <a href="/gateway/latest/" class="active">Kong Gateway</a> </li> <li role="menuitem" tabindex="-1"> <a href="/konnect/">Kong Konnect</a> </li> <li role="menuitem" tabindex="-1"> <a href="/mesh/latest/">Kong Mesh</a> </li> <li role="menuitem" tabindex="-1"> <a href="/hub/?category=ai">Kong AI Gateway</a> </li> <li role="menuitem" tabindex="-1"> <a href="/hub/">Plugin Hub</a> </li> <li role="menuitem" tabindex="-1"> <a href="/deck/">decK</a> </li> <li role="menuitem" tabindex="-1"> <a href="/kubernetes-ingress-controller/latest/">Kong Ingress Controller</a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway-operator/latest/">Kong Gateway Operator</a> </li> <li> <a href="https://docs.insomnia.rest/" target="_blank" rel="noopener nofollow noreferrer ">Insomnia</a> </li> <li role="menuitem" tabindex="-1"> <a href="https://kuma.io/docs/" target="_blank" rel="noopener nofollow noreferrer ">Kuma</a> </li> <hr> <li role="menuitem" tabindex="-1"> <a href="/contributing/">Docs contribution guidelines</a> </li> </ul> </div> <div class="versions-dropdown dropdown"> <button class="dropdown-button" id="version-dropdown" type="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false" tabindex="0"> <span> Version 3.3.x </span> <span class="caret"></span> </button> <ul class="dropdown-menu dropdown-menu-right" id="version-list" role="menu" aria-labelledby="version-dropdown" aria-hidden="true"> <li role="menuitem" tabindex="-1"> <a href="/gateway/unreleased/reference/configuration/" data-version-id="3.10.x"> <em>unreleased</em> </a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway/3.9.x/reference/configuration/" data-version-id="3.9.x"> 3.9.x <em>(latest)</em> </a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway/3.8.x/reference/configuration/" data-version-id="3.8.x"> 3.8.x </a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway/3.7.x/reference/configuration/" data-version-id="3.7.x"> 3.7.x </a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway/3.6.x/reference/configuration/" data-version-id="3.6.x"> 3.6.x </a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway/3.5.x/reference/configuration/" data-version-id="3.5.x"> 3.5.x </a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway/3.4.x/reference/configuration/" data-version-id="3.4.x"> 3.4.x (LTS) </a> </li> <li class="active" role="menuitem" tabindex="-1"> <a href="/gateway/3.3.x/reference/configuration/" class="active" data-version-id="3.3.x"> 3.3.x </a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway/3.2.x/reference/configuration/" data-version-id="3.2.x"> 3.2.x </a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway/3.1.x/reference/configuration/" data-version-id="3.1.x"> 3.1.x </a> </li> <li role="menuitem" tabindex="-1"> <a href="/gateway/2.8.x/reference/configuration/" data-version-id="2.8.x"> 2.8.x (LTS) </a> </li> <li role="menuitem" tabindex="-1"> <a href="https://legacy-gateway--kongdocs.netlify.app/" target="_blank" rel="noopener nofollow noreferrer "> Archive (3.0.x and pre-2.8.x) </a> </li> </ul> </div> </div> <ul class="sidebar-container" role="tree" aria-label="Documentation"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-1-introduction-subtree"> <img src="/assets/images/icons/documentation/icn-flag.svg" alt=""> Introduction <button class="sidebar-tree-toggle" aria-label="toggle Introduction subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-1-introduction-subtree" role="group" aria-label="Introduction"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/"> Overview of Kong Gateway </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-1-2-support-subtree"> Support <button class="sidebar-tree-toggle" aria-label="toggle Support subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-1-2-support-subtree" role="group" aria-label="Support"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/support-policy/"> Version Support Policy </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/support/third-party/"> Third Party Dependencies </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/support/browser/"> Browser Support </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/support/sbom/"> Software Bill of Materials </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/stability/"> Stability </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/changelog/"> Release Notes </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-1-5-breaking-changes-subtree"> Breaking Changes <button class="sidebar-tree-toggle" aria-label="toggle Breaking Changes subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-1-5-breaking-changes-subtree" role="group" aria-label="Breaking Changes"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/breaking-changes/"> Kong Gateway 3.3.x </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/breaking-changes/32x/"> Kong Gateway 3.2.x </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/breaking-changes/31x/"> Kong Gateway 3.1.x </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/breaking-changes/30x/"> Kong Gateway 3.0.x </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/breaking-changes/28x/"> Kong Gateway 2.8.x or earlier </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-1-6-key-concepts-subtree"> Key Concepts <button class="sidebar-tree-toggle" aria-label="toggle Key Concepts subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-1-6-key-concepts-subtree" role="group" aria-label="Key Concepts"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/key-concepts/services/"> Services </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/key-concepts/routes/"> Routes </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/key-concepts/consumers/"> Consumers </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/key-concepts/upstreams/"> Upstreams </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/key-concepts/plugins/"> Plugins </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-1-7-how-kong-works-subtree"> How Kong Works <button class="sidebar-tree-toggle" aria-label="toggle How Kong Works subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-1-7-how-kong-works-subtree" role="group" aria-label="How Kong Works"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/how-kong-works/routing-traffic/"> Routing Traffic </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/how-kong-works/load-balancing/"> Load Balancing </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/how-kong-works/health-checks/"> Health Checks and Circuit Breakers </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/how-kong-works/performance-testing/"> Kong Performance Testing </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/glossary/"> Glossary </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-2-get-started-with-kong-subtree"> <img src="/assets/images/icons/documentation/icn-learning.svg" alt=""> Get Started with Kong <button class="sidebar-tree-toggle" aria-label="toggle Get Started with Kong subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-2-get-started-with-kong-subtree" role="group" aria-label="Get Started with Kong"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/get-started/"> Get Kong </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/get-started/services-and-routes/"> Services and Routes </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/get-started/rate-limiting/"> Rate Limiting </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/get-started/proxy-caching/"> Proxy Caching </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/get-started/key-authentication/"> Key Authentication </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/get-started/load-balancing/"> Load-Balancing </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-kong-in-production-subtree"> <img src="/assets/images/icons/documentation/icn-deployment-color.svg" alt=""> Kong in Production <button class="sidebar-tree-toggle" aria-label="toggle Kong in Production subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-kong-in-production-subtree" role="group" aria-label="Kong in Production"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-1-deployment-topologies-subtree"> Deployment Topologies <button class="sidebar-tree-toggle" aria-label="toggle Deployment Topologies subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-1-deployment-topologies-subtree" role="group" aria-label="Deployment Topologies"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/deployment-topologies/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/deployment-topologies/kubernetes/"> Kubernetes Topologies </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-1-3-hybrid-mode-subtree"> Hybrid Mode <button class="sidebar-tree-toggle" aria-label="toggle Hybrid Mode subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-1-3-hybrid-mode-subtree" role="group" aria-label="Hybrid Mode"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/deployment-topologies/hybrid-mode/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/deployment-topologies/hybrid-mode/setup/"> Deploy Kong Gateway in Hybrid mode </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/deployment-topologies/db-less-and-declarative-config/"> DB-less Deployment </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/deployment-topologies/traditional/"> Traditional </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-2-installation-options-subtree"> Installation Options <button class="sidebar-tree-toggle" aria-label="toggle Installation Options subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-2-installation-options-subtree" role="group" aria-label="Installation Options"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-2-2-kubernetes-subtree"> Kubernetes <button class="sidebar-tree-toggle" aria-label="toggle Kubernetes subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-2-2-kubernetes-subtree" role="group" aria-label="Kubernetes"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/kubernetes/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/kubernetes/proxy/"> Install Kong Gateway </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/kubernetes/admin/"> Configure the Admin API </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/kubernetes/manager/"> Install Kong Manager </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/kubernetes/portal/"> Install Developer Portal </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-2-3-docker-subtree"> Docker <button class="sidebar-tree-toggle" aria-label="toggle Docker subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-2-3-docker-subtree" role="group" aria-label="Docker"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/docker/"> Using docker run </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/docker/build-custom-images/"> Build your own Docker images </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-2-4-linux-subtree"> Linux <button class="sidebar-tree-toggle" aria-label="toggle Linux subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-2-4-linux-subtree" role="group" aria-label="Linux"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/linux/amazon-linux/"> Amazon Linux </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/linux/debian/"> Debian </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/linux/rhel/"> Red Hat </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/linux/ubuntu/"> Ubuntu </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-2-5-post-installation-subtree"> Post-installation <button class="sidebar-tree-toggle" aria-label="toggle Post-installation subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-2-5-post-installation-subtree" role="group" aria-label="Post-installation"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/post-install/set-up-data-store/"> Set up a data store </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/post-install/enterprise-license/"> Apply Enterprise license </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/install/post-install/kong-manager/"> Enable Kong Manager (Enterprise) </a> </span> </li> </ul> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-3-running-kong-subtree"> Running Kong <button class="sidebar-tree-toggle" aria-label="toggle Running Kong subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-3-running-kong-subtree" role="group" aria-label="Running Kong"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/running-kong/kong-user/"> Running Kong as a non-root user </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/running-kong/secure-admin-api/"> Securing the Admin API </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/running-kong/systemd/"> Using systemd </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-4-access-control-subtree"> Access Control <button class="sidebar-tree-toggle" aria-label="toggle Access Control subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-4-access-control-subtree" role="group" aria-label="Access Control"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/access-control/start-securely/"> Start Kong Gateway Securely </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/access-control/register-admin-api/"> Programmatically Creating Admins </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/access-control/enable-rbac/"> Enabling RBAC </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-5-licenses-subtree"> Licenses <button class="sidebar-tree-toggle" aria-label="toggle Licenses subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-5-licenses-subtree" role="group" aria-label="Licenses"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/licenses/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/licenses/download/"> Download your License </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/licenses/deploy/"> Deploy Enterprise License </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/licenses/examples/"> Using the License API </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/licenses/report/"> Monitor Licenses Usage </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-6-networking-subtree"> Networking <button class="sidebar-tree-toggle" aria-label="toggle Networking subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-6-networking-subtree" role="group" aria-label="Networking"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/networking/default-ports/"> Default Ports </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/networking/dns-considerations/"> DNS Considerations </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/networking/firewall/"> Network and Firewall </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/networking/cp-dp-proxy/"> CP/DP Communication through a Forward Proxy </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-6-5-postgresql-tls-subtree"> PostgreSQL TLS <button class="sidebar-tree-toggle" aria-label="toggle PostgreSQL TLS subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-6-5-postgresql-tls-subtree" role="group" aria-label="PostgreSQL TLS"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/networking/configure-postgres-tls/"> Configure PostgreSQL TLS </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/networking/troubleshoot-postgres-tls/"> Troubleshooting PostgreSQL TLS </a> </span> </li> </ul> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/kong-conf/"> Kong Configuration File </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/environment-variables/"> Environment Variables </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/website-api-serving/"> Serving a Website and APIs from Kong </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-10-monitoring-subtree"> Monitoring <button class="sidebar-tree-toggle" aria-label="toggle Monitoring subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-10-monitoring-subtree" role="group" aria-label="Monitoring"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/monitoring/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/monitoring/prometheus/"> Prometheus </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/monitoring/statsd/"> StatsD </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/monitoring/datadog/"> Datadog </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/monitoring/healthcheck-probes/"> Health Check Probes </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-11-tracing-subtree"> Tracing <button class="sidebar-tree-toggle" aria-label="toggle Tracing subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-11-tracing-subtree" role="group" aria-label="Tracing"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/tracing/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/tracing/write-custom-trace-exporter/"> Writing a Custom Trace Exporter </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/tracing/api/"> Tracing API Reference </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/sizing-guidelines/"> Resource Sizing Guidelines </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/security-update-process/"> Security Update Process </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/blue-green/"> Blue-Green Deployments </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/canary/"> Canary Deployments </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/clustering/"> Clustering Reference </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-17-logging-subtree"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/logging/"> Logging </a> <button class="sidebar-tree-toggle" aria-label="toggle Logging subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-17-logging-subtree" role="group" aria-label="Logging"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/logging/log-reference/"> Log Reference </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/logging/update-log-level-dynamically/"> Dynamic log level updates </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/logging/customize-gateway-logs/"> Customize Gateway Logs </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/configuring-a-grpc-service/"> Configure a gRPC service </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/key-concepts/routes/expressions/"> Use the Expressions Router </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-20-upgrade-and-migration-subtree"> Upgrade and Migration <button class="sidebar-tree-toggle" aria-label="toggle Upgrade and Migration subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-20-upgrade-and-migration-subtree" role="group" aria-label="Upgrade and Migration"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/upgrade/"> Upgrading Kong Gateway 3.x.x </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/upgrade/backup-and-restore/"> Backup and Restore </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-3-20-3-upgrade-strategies-subtree"> Upgrade Strategies <button class="sidebar-tree-toggle" aria-label="toggle Upgrade Strategies subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-3-20-3-upgrade-strategies-subtree" role="group" aria-label="Upgrade Strategies"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/upgrade/dual-cluster/"> Dual-Cluster Upgrade </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/upgrade/in-place/"> In-Place Upgrade </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/upgrade/blue-green/"> Blue-Green Upgrade </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/upgrade/rolling-upgrade/"> Rolling Upgrade </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/upgrade/lts-upgrade/"> Upgrade from 2.8 LTS to 3.4 LTS </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/migrate-ce-to-ke/"> Migrate from OSS to Enterprise </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/migrate-cassandra-to-postgres/"> Migration Guidelines Cassandra to PostgreSQL </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/production/breaking-changes/"> Breaking Changes </a> </span> </li> </ul> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-kong-gateway-enterprise-subtree"> <img src="/assets/images/icons/documentation/icn-enterprise-blue.svg" alt=""> Kong Gateway Enterprise <button class="sidebar-tree-toggle" aria-label="toggle Kong Gateway Enterprise subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-kong-gateway-enterprise-subtree" role="group" aria-label="Kong Gateway Enterprise"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-2-kong-vitals-subtree"> Kong Vitals <button class="sidebar-tree-toggle" aria-label="toggle Kong Vitals subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-2-kong-vitals-subtree" role="group" aria-label="Kong Vitals"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/analytics/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/analytics/metrics/"> Metrics </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/analytics/influx-strategy/"> Analytics with InfluxDB </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/analytics/prometheus-strategy/"> Analytics with Prometheus </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/analytics/estimates/"> Estimate Analytics Storage in PostgreSQL </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-3-secrets-management-subtree"> Secrets Management <button class="sidebar-tree-toggle" aria-label="toggle Secrets Management subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-3-secrets-management-subtree" role="group" aria-label="Secrets Management"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/getting-started/"> Getting Started </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/advanced-usage/"> Advanced Usage </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-3-4-backends-subtree"> Backends <button class="sidebar-tree-toggle" aria-label="toggle Backends subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-3-4-backends-subtree" role="group" aria-label="Backends"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/backends/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/backends/env/"> Environment Variables </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/backends/aws-sm/"> AWS Secrets Manager </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/backends/gcp-sm/"> Google Cloud Secret Manager </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/backends/hashicorp-vault/"> HashiCorp Vault </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-3-5-how-to-subtree"> How-To <button class="sidebar-tree-toggle" aria-label="toggle How-To subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-3-5-how-to-subtree" role="group" aria-label="How-To"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/how-to/aws-secrets-manager/"> Securing the Database with AWS Secrets Manager </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/secrets-management/reference-format/"> Reference Format </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-4-dynamic-plugin-ordering-subtree"> Dynamic Plugin Ordering <button class="sidebar-tree-toggle" aria-label="toggle Dynamic Plugin Ordering subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-4-dynamic-plugin-ordering-subtree" role="group" aria-label="Dynamic Plugin Ordering"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/plugin-ordering/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/plugin-ordering/get-started/"> Get Started with Dynamic Plugin Ordering </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-5-dev-portal-subtree"> Dev Portal <button class="sidebar-tree-toggle" aria-label="toggle Dev Portal subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-5-dev-portal-subtree" role="group" aria-label="Dev Portal"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/enable/"> Enable the Dev Portal </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/publish-spec/"> Publish an OpenAPI Spec </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/structure-and-file-types/"> Structure and File Types </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/themes/"> Themes Files </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/working-with-templates/"> Working with Templates </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/using-the-editor/"> Using the Editor </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-5-8-authentication-and-authorization-subtree"> Authentication and Authorization <button class="sidebar-tree-toggle" aria-label="toggle Authentication and Authorization subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-5-8-authentication-and-authorization-subtree" role="group" aria-label="Authentication and Authorization"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/basic-auth/"> Basic Auth </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/key-auth/"> Key Auth </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/oidc/"> OIDC </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/sessions/"> Sessions </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/adding-registration-fields/"> Adding Custom Registration Fields </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/managing-developers/"> Manage Developers </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/developer-permissions/"> Developer Roles and Content Permissions </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-5-9-application-registration-subtree"> Application Registration <button class="sidebar-tree-toggle" aria-label="toggle Application Registration subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-5-9-application-registration-subtree" role="group" aria-label="Application Registration"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/applications/auth-provider-strategy/"> Authorization Provider Strategy </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/applications/enable-application-registration/"> Enable Application Registration </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/applications/enable-key-auth-plugin/"> Enable Key Authentication for Application Registration </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-5-9-4-enable-external-authentication-subtree"> Enable External Authentication <button class="sidebar-tree-toggle" aria-label="toggle Enable External Authentication subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-5-9-4-enable-external-authentication-subtree" role="group" aria-label="Enable External Authentication"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/3rd-party-oauth/"> External OAuth2 Support </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/okta-config/"> Set up Okta and Kong for External Oauth </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/authentication/azure-oidc-config/"> Set up Azure AD and Kong for External Authentication </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/applications/managing-applications/"> Manage Applications </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-5-10-customize-dev-portal-subtree"> Customize Dev Portal <button class="sidebar-tree-toggle" aria-label="toggle Customize Dev Portal subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-5-10-customize-dev-portal-subtree" role="group" aria-label="Customize Dev Portal"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/customize/theme-editing/"> Theme Editing </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/customize/migrating-templates/"> Migrating Templates Between Workspaces </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/customize/markdown-extended/"> Markdown Rendering Module </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/customize/emails/"> Customizing Portal Emails </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/customize/adding-javascript-assets/"> Adding and Using JavaScript Assets </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/customize/single-page-app/"> Single Page App in Dev Portal </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/customize/alternate-openapi-renderer/"> Alternate OpenAPI Renderer </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/smtp/"> SMTP </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/workspaces/"> Workspaces </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/dev-portal/cli/"> Helpers CLI </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/dev-portal/api/v1/"> Portal API Documentation </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/audit-log/"> Audit Logging </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/db-encryption/"> Keyring and Data Encryption </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/workspaces/"> Workspaces </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/consumer-groups/"> Consumer Groups </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/event-hooks/"> Event Hooks </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/cp-outage-handling/"> Configure Data Plane Resilience </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/cp-outage-handling-faq/"> About Control Plane Outage Management </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-4-13-fips-140-2-subtree"> FIPS 140-2 <button class="sidebar-tree-toggle" aria-label="toggle FIPS 140-2 subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-4-13-fips-140-2-subtree" role="group" aria-label="FIPS 140-2"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/fips-support/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/fips-support/install/"> Install the FIPS Compliant Package </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/fips-support/plugins/"> FIPS 140-2 Compliant Plugins </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-enterprise/aws-iam-auth-to-rds-database/"> Authenticate your Kong Gateway Amazon RDS database with AWS IAM </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-5-kong-manager-subtree"> <img src="/assets/images/icons/documentation/icn-manager-color.svg" alt=""> Kong Manager <button class="sidebar-tree-toggle" aria-label="toggle Kong Manager subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-5-kong-manager-subtree" role="group" aria-label="Kong Manager"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/enable/"> Enable Kong Manager </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-5-3-get-started-with-kong-manager-subtree"> Get Started with Kong Manager <button class="sidebar-tree-toggle" aria-label="toggle Get Started with Kong Manager subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-5-3-get-started-with-kong-manager-subtree" role="group" aria-label="Get Started with Kong Manager"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/get-started/services-and-routes/"> Services and Routes </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/get-started/rate-limiting/"> Rate Limiting </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/get-started/proxy-caching/"> Proxy Caching </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/get-started/consumers/"> Authentication with Consumers </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/get-started/load-balancing/"> Load Balancing </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-5-4-authentication-and-authorization-subtree"> Authentication and Authorization <button class="sidebar-tree-toggle" aria-label="toggle Authentication and Authorization subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-5-4-authentication-and-authorization-subtree" role="group" aria-label="Authentication and Authorization"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/super-admin/"> Create a Super Admin </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/workspaces-and-teams/"> Workspaces and Teams </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/reset-password/"> Reset Passwords and RBAC Tokens </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/basic/"> Basic Auth </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-5-4-6-ldap-subtree"> LDAP <button class="sidebar-tree-toggle" aria-label="toggle LDAP subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-5-4-6-ldap-subtree" role="group" aria-label="LDAP"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/ldap/configure/"> Configure LDAP </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/ldap/service-directory-mapping/"> LDAP Service Directory Mapping </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-5-4-7-oidc-subtree"> OIDC <button class="sidebar-tree-toggle" aria-label="toggle OIDC subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-5-4-7-oidc-subtree" role="group" aria-label="OIDC"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/oidc/configure/"> Configure OIDC </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/oidc/mapping/"> OIDC Authenticated Group Mapping </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/sessions/"> Sessions </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-5-4-9-rbac-subtree"> RBAC <button class="sidebar-tree-toggle" aria-label="toggle RBAC subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-5-4-9-rbac-subtree" role="group" aria-label="RBAC"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/rbac/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/rbac/enable/"> Enable RBAC </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/rbac/add-role/"> Add a Role and Permissions </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/rbac/add-user/"> Create a User </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/auth/rbac/add-admin/"> Create an Admin </a> </span> </li> </ul> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/networking/"> Networking Configuration </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/workspaces/"> Workspaces </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/consumer-groups/"> Create Consumer Groups </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-manager/configuring-to-send-email/"> Sending Email </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-6-develop-custom-plugins-subtree"> <img src="/assets/images/icons/documentation/icn-dev-portal-color.svg" alt=""> Develop Custom Plugins <button class="sidebar-tree-toggle" aria-label="toggle Develop Custom Plugins subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-6-develop-custom-plugins-subtree" role="group" aria-label="Develop Custom Plugins"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/file-structure/"> File Structure </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/custom-logic/"> Implementing Custom Logic </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/configuration/"> Plugin Configuration </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/access-the-datastore/"> Accessing the Data Store </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/custom-entities/"> Storing Custom Entities </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/entities-cache/"> Caching Custom Entities </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/admin-api/"> Extending the Admin API </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/tests/"> Writing Tests </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/distribution/"> (un)Installing your Plugin </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-6-11-plugin-development-kit-subtree"> Plugin Development Kit <button class="sidebar-tree-toggle" aria-label="toggle Plugin Development Kit subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-6-11-plugin-development-kit-subtree" role="group" aria-label="Plugin Development Kit"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.client/"> kong.client </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.client.tls/"> kong.client.tls </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.cluster/"> kong.cluster </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.ctx/"> kong.ctx </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.ip/"> kong.ip </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.jwe/"> kong.jwe </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.log/"> kong.log </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.nginx/"> kong.nginx </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.node/"> kong.node </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.request/"> kong.request </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.response/"> kong.response </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.router/"> kong.router </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.service/"> kong.service </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.service.request/"> kong.service.request </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.service.response/"> kong.service.response </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.table/"> kong.table </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.tracing/"> kong.tracing </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.vault/"> kong.vault </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.websocket.client/"> kong.websocket.client </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pdk/kong.websocket.upstream/"> kong.websocket.upstream </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-6-12-plugins-in-other-languages-subtree"> Plugins in Other Languages <button class="sidebar-tree-toggle" aria-label="toggle Plugins in Other Languages subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-6-12-plugins-in-other-languages-subtree" role="group" aria-label="Plugins in Other Languages"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pluginserver/go/"> Go </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pluginserver/javascript/"> Javascript </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pluginserver/python/"> Python </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pluginserver/plugins-kubernetes/"> Running Plugins in Containers </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/plugin-development/pluginserver/performance/"> External Plugin Performance </a> </span> </li> </ul> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-7-kong-plugins-subtree"> <img src="/assets/images/icons/documentation/icn-api-plugins-color.svg" alt=""> Kong Plugins <button class="sidebar-tree-toggle" aria-label="toggle Kong Plugins subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-7-kong-plugins-subtree" role="group" aria-label="Kong Plugins"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-plugins/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-plugins/authentication/reference/"> Authentication Reference </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-plugins/authentication/allowing-multiple-authentication-methods/"> Allow Multiple Authentication Plugins </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-7-4-plugin-queuing-subtree"> Plugin Queuing <button class="sidebar-tree-toggle" aria-label="toggle Plugin Queuing subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-7-4-plugin-queuing-subtree" role="group" aria-label="Plugin Queuing"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-plugins/queue/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/kong-plugins/queue/reference/"> Plugin Queuing Reference </a> </span> </li> </ul> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-8-admin-api-subtree"> <img src="/assets/images/icons/documentation/icn-admin-api-color.svg" alt=""> Admin API <button class="sidebar-tree-toggle" aria-label="toggle Admin API subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-8-admin-api-subtree" role="group" aria-label="Admin API"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#information-routes"> Information Routes </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#health-routes"> Health Routes </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#tags"> Tags </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#debug-routes"> Debug Routes </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#service-object"> Services </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#route-object"> Routes </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#consumer-object"> Consumers </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#plugin-object"> Plugins </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#certificate-object"> Certificates </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#ca-certificate-object"> CA Certificates </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#sni-object"> SNIs </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#upstream-object"> Upstreams </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#target-object"> Targets </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#vaults-object"> Vaults </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/#keys-object"> Keys </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/licenses/reference/"> Licenses </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/workspaces/reference/"> Workspaces </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/rbac/reference/"> RBAC </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/admins/reference/"> Admins </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/developers/reference/"> Developers </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/consumer-groups/reference/"> Consumer Groups </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/event-hooks/reference/"> Event Hooks </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/db-encryption/"> Keyring and Data Encryption </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/admin-api/audit-logs/"> Audit Logs </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/api/status/v1/"> Status API </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-9-reference-subtree"> <img src="/assets/images/icons/documentation/icn-references-color.svg" alt=""> Reference <button class="sidebar-tree-toggle" aria-label="toggle Reference subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-9-reference-subtree" role="group" aria-label="Reference"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/configuration/"> kong.conf </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/nginx-directives/"> Injecting Nginx Directives </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/cli/"> CLI </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/key-management/"> Key Management </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/performance-testing-framework/"> Performance Testing Framework </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label" aria-expanded="false" aria-owns="id-9-6-the-expressions-language-subtree"> The Expressions Language <button class="sidebar-tree-toggle" aria-label="toggle The Expressions Language subtree" tabindex="-1"> <i class="fa fa-chevron-down"></i> </button> </span> <ul class="items" id="id-9-6-the-expressions-language-subtree" role="group" aria-label="The Expressions Language"> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/expressions-language/"> Overview </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/expressions-language/language-references/"> Language References </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/expressions-language/performance/"> Performance Optimizations </a> </span> </li> </ul> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/rate-limiting/"> Rate Limiting Library </a> </span> </li> <li class="sidebar-item" role="none"> <span role="treeitem" class="sidebar-label"> <a class="sidebar-link" tabindex="-1" href="/gateway/3.3.x/reference/faq/"> FAQ </a> </span> </li> </ul> </li> </ul> </aside> <aside class="docs-toc"> <i class="fa fa-times close-sidebar"></i> <i class="fa fa-chevron-right collapse-toc"></i> <i class="far fa-list-alt expand-toc"></i> <div id="oss-ee-toggle" data-current="Enterprise" style="display: none"> <span class="oss-ee-toggle-inner"> <img src="/assets/images/icons/icn-enterprise-black.svg" alt="enterprise-switcher-icon"> <span>Switch to <span id="switch-to-version">OSS</span></span> </span> </div> <div class="docs-toc-title"> <img src="/assets/images/icons/hub-layout/icn-on-this-page.svg" alt="On this page"><a href="#">On this page</a> </div> <ul> <li> <a href="#general-section" class="active scroll-to">General section</a> <ul> <li><a href="#prefix" class="scroll-to">prefix</a></li> <li><a href="#log_level" class="scroll-to">log_level</a></li> <li><a href="#proxy_access_log" class="scroll-to">proxy_access_log</a></li> <li><a href="#proxy_error_log" class="scroll-to">proxy_error_log</a></li> <li><a href="#proxy_stream_access_log" class="scroll-to">proxy_stream_access_log</a></li> <li><a href="#proxy_stream_error_log" class="scroll-to">proxy_stream_error_log</a></li> <li><a href="#admin_access_log" class="scroll-to">admin_access_log</a></li> <li><a href="#admin_error_log" class="scroll-to">admin_error_log</a></li> <li><a href="#status_access_log" class="scroll-to">status_access_log</a></li> <li><a href="#status_error_log" class="scroll-to">status_error_log</a></li> <li><a href="#debug_access_log" class="scroll-to">debug_access_log</a></li> <li><a href="#debug_error_log" class="scroll-to">debug_error_log</a></li> <li><a href="#vaults" class="scroll-to">vaults</a></li> <li><a href="#opentelemetry_tracing" class="scroll-to">opentelemetry_tracing</a></li> <li><a href="#tracing_instrumentations" class="scroll-to">tracing_instrumentations</a></li> <li><a href="#opentelemetry_tracing_sampling_rate" class="scroll-to">opentelemetry_tracing_sampling_rate</a></li> <li><a href="#tracing_sampling_rate" class="scroll-to">tracing_sampling_rate</a></li> <li><a href="#plugins" class="scroll-to">plugins</a></li> <li><a href="#pluginserver_names" class="scroll-to">pluginserver_names</a></li> <li><a href="#pluginserver_xxx_socket" class="scroll-to">pluginserver_XXX_socket</a></li> <li><a href="#pluginserver_xxx_start_cmd" class="scroll-to">pluginserver_XXX_start_cmd</a></li> <li><a href="#pluginserver_xxx_query_cmd" class="scroll-to">pluginserver_XXX_query_cmd</a></li> <li><a href="#port_maps" class="scroll-to">port_maps</a></li> <li><a href="#anonymous_reports" class="scroll-to">anonymous_reports</a></li> <li><a href="#proxy_server" class="scroll-to">proxy_server</a></li> <li><a href="#proxy_server_ssl_verify" class="scroll-to">proxy_server_ssl_verify</a></li> <li><a href="#error_template_html" class="scroll-to">error_template_html</a></li> <li><a href="#error_template_json" class="scroll-to">error_template_json</a></li> <li><a href="#error_template_xml" class="scroll-to">error_template_xml</a></li> <li><a href="#error_template_plain" class="scroll-to">error_template_plain</a></li> </ul> </li> <li> <a href="#hybrid-mode-section" class="scroll-to">Hybrid Mode section</a> <ul> <li><a href="#role" class="scroll-to">role</a></li> <li><a href="#cluster_mtls" class="scroll-to">cluster_mtls</a></li> <li><a href="#cluster_cert" class="scroll-to">cluster_cert</a></li> <li><a href="#cluster_cert_key" class="scroll-to">cluster_cert_key</a></li> <li><a href="#cluster_ca_cert" class="scroll-to">cluster_ca_cert</a></li> <li><a href="#cluster_allowed_common_names" class="scroll-to">cluster_allowed_common_names</a></li> </ul> </li> <li> <a href="#hybrid-mode-data-plane-section" class="scroll-to">Hybrid Mode Data Plane section</a> <ul> <li><a href="#cluster_server_name" class="scroll-to">cluster_server_name</a></li> <li><a href="#cluster_control_plane" class="scroll-to">cluster_control_plane</a></li> <li><a href="#cluster_telemetry_endpoint" class="scroll-to">cluster_telemetry_endpoint</a></li> <li><a href="#cluster_telemetry_server_name" class="scroll-to">cluster_telemetry_server_name</a></li> <li><a href="#cluster_dp_labels" class="scroll-to">cluster_dp_labels</a></li> </ul> </li> <li> <a href="#hybrid-mode-control-plane-section" class="scroll-to">Hybrid Mode Control Plane section</a> <ul> <li><a href="#cluster_listen" class="scroll-to">cluster_listen</a></li> <li><a href="#cluster_telemetry_listen" class="scroll-to">cluster_telemetry_listen</a></li> <li><a href="#cluster_data_plane_purge_delay" class="scroll-to">cluster_data_plane_purge_delay</a></li> <li><a href="#cluster_ocsp" class="scroll-to">cluster_ocsp</a></li> <li><a href="#cluster_use_proxy" class="scroll-to">cluster_use_proxy</a></li> <li><a href="#cluster_max_payload" class="scroll-to">cluster_max_payload</a></li> </ul> </li> <li> <a href="#nginx-section" class="scroll-to">NGINX section</a> <ul> <li><a href="#proxy_listen" class="scroll-to">proxy_listen</a></li> <li><a href="#proxy_url" class="scroll-to">proxy_url</a></li> <li><a href="#stream_listen" class="scroll-to">stream_listen</a></li> <li><a href="#admin_api_uri" class="scroll-to">admin_api_uri</a></li> <li><a href="#admin_listen" class="scroll-to">admin_listen</a></li> <li><a href="#status_listen" class="scroll-to">status_listen</a></li> <li><a href="#debug_listen" class="scroll-to">debug_listen</a></li> <li><a href="#nginx_user" class="scroll-to">nginx_user</a></li> <li><a href="#nginx_worker_processes" class="scroll-to">nginx_worker_processes</a></li> <li><a href="#nginx_daemon" class="scroll-to">nginx_daemon</a></li> <li><a href="#mem_cache_size" class="scroll-to">mem_cache_size</a></li> <li><a href="#ssl_cipher_suite" class="scroll-to">ssl_cipher_suite</a></li> <li><a href="#ssl_ciphers" class="scroll-to">ssl_ciphers</a></li> <li><a href="#ssl_protocols" class="scroll-to">ssl_protocols</a></li> <li><a href="#ssl_prefer_server_ciphers" class="scroll-to">ssl_prefer_server_ciphers</a></li> <li><a href="#ssl_dhparam" class="scroll-to">ssl_dhparam</a></li> <li><a href="#ssl_session_tickets" class="scroll-to">ssl_session_tickets</a></li> <li><a href="#ssl_session_timeout" class="scroll-to">ssl_session_timeout</a></li> <li><a href="#ssl_session_cache_size" class="scroll-to">ssl_session_cache_size</a></li> <li><a href="#ssl_cert" class="scroll-to">ssl_cert</a></li> <li><a href="#ssl_cert_key" class="scroll-to">ssl_cert_key</a></li> <li><a href="#client_ssl" class="scroll-to">client_ssl</a></li> <li><a href="#client_ssl_cert" class="scroll-to">client_ssl_cert</a></li> <li><a href="#client_ssl_cert_key" class="scroll-to">client_ssl_cert_key</a></li> <li><a href="#admin_ssl_cert" class="scroll-to">admin_ssl_cert</a></li> <li><a href="#admin_ssl_cert_key" class="scroll-to">admin_ssl_cert_key</a></li> <li><a href="#status_ssl_cert" class="scroll-to">status_ssl_cert</a></li> <li><a href="#status_ssl_cert_key" class="scroll-to">status_ssl_cert_key</a></li> <li><a href="#debug_ssl_cert" class="scroll-to">debug_ssl_cert</a></li> <li><a href="#debug_ssl_cert_key" class="scroll-to">debug_ssl_cert_key</a></li> <li><a href="#headers" class="scroll-to">headers</a></li> <li><a href="#trusted_ips" class="scroll-to">trusted_ips</a></li> <li><a href="#real_ip_header" class="scroll-to">real_ip_header</a></li> <li><a href="#real_ip_recursive" class="scroll-to">real_ip_recursive</a></li> <li><a href="#error_default_type" class="scroll-to">error_default_type</a></li> <li><a href="#upstream_keepalive_pool_size" class="scroll-to">upstream_keepalive_pool_size</a></li> <li><a href="#upstream_keepalive_max_requests" class="scroll-to">upstream_keepalive_max_requests</a></li> <li><a href="#upstream_keepalive_idle_timeout" class="scroll-to">upstream_keepalive_idle_timeout</a></li> <li><a href="#allow_debug_header" class="scroll-to">allow_debug_header</a></li> </ul> </li> <li> <a href="#nginx-injected-directives-section" class="scroll-to">NGINX Injected Directives section</a> <ul> <li><a href="#nginx_main_worker_rlimit_nofile" class="scroll-to">nginx_main_worker_rlimit_nofile</a></li> <li><a href="#nginx_events_worker_connections" class="scroll-to">nginx_events_worker_connections</a></li> <li><a href="#nginx_http_client_header_buffer_size" class="scroll-to">nginx_http_client_header_buffer_size</a></li> <li><a href="#nginx_http_large_client_header_buffers" class="scroll-to">nginx_http_large_client_header_buffers</a></li> <li><a href="#nginx_http_client_max_body_size" class="scroll-to">nginx_http_client_max_body_size</a></li> <li><a href="#nginx_admin_client_max_body_size" class="scroll-to">nginx_admin_client_max_body_size</a></li> <li><a href="#nginx_http_charset" class="scroll-to">nginx_http_charset</a></li> <li><a href="#nginx_http_client_body_buffer_size" class="scroll-to">nginx_http_client_body_buffer_size</a></li> <li><a href="#nginx_admin_client_body_buffer_size" class="scroll-to">nginx_admin_client_body_buffer_size</a></li> <li><a href="#nginx_http_lua_regex_match_limit" class="scroll-to">nginx_http_lua_regex_match_limit</a></li> <li><a href="#nginx_http_lua_regex_cache_max_entries" class="scroll-to">nginx_http_lua_regex_cache_max_entries</a></li> </ul> </li> <li> <a href="#datastore-section" class="scroll-to">Datastore section</a> <ul> <li><a href="#database" class="scroll-to">database</a></li> <li><a href="#postgres-settings" class="scroll-to">Postgres settings</a></li> <li><a href="#cassandra-settings" class="scroll-to">Cassandra settings</a></li> <li><a href="#declarative_config" class="scroll-to">declarative_config</a></li> <li><a href="#declarative_config_string" class="scroll-to">declarative_config_string</a></li> <li><a href="#declarative_config_encryption_mode" class="scroll-to">declarative_config_encryption_mode</a></li> <li><a href="#lmdb_environment_path" class="scroll-to">lmdb_environment_path</a></li> <li><a href="#lmdb_map_size" class="scroll-to">lmdb_map_size</a></li> </ul> </li> <li> <a href="#datastore-cache-section" class="scroll-to">Datastore Cache section</a> <ul> <li><a href="#db_update_frequency" class="scroll-to">db_update_frequency</a></li> <li><a href="#db_update_propagation" class="scroll-to">db_update_propagation</a></li> <li><a href="#db_cache_ttl" class="scroll-to">db_cache_ttl</a></li> <li><a href="#db_cache_neg_ttl" class="scroll-to">db_cache_neg_ttl</a></li> <li><a href="#db_resurrect_ttl" class="scroll-to">db_resurrect_ttl</a></li> <li><a href="#db_cache_warmup_entities" class="scroll-to">db_cache_warmup_entities</a></li> </ul> </li> <li> <a href="#dns-resolver-section" class="scroll-to">DNS Resolver section</a> <ul> <li><a href="#dns_resolver" class="scroll-to">dns_resolver</a></li> <li><a href="#dns_hostsfile" class="scroll-to">dns_hostsfile</a></li> <li><a href="#dns_order" class="scroll-to">dns_order</a></li> <li><a href="#dns_valid_ttl" class="scroll-to">dns_valid_ttl</a></li> <li><a href="#dns_stale_ttl" class="scroll-to">dns_stale_ttl</a></li> <li><a href="#dns_cache_size" class="scroll-to">dns_cache_size</a></li> <li><a href="#dns_not_found_ttl" class="scroll-to">dns_not_found_ttl</a></li> <li><a href="#dns_error_ttl" class="scroll-to">dns_error_ttl</a></li> <li><a href="#dns_no_sync" class="scroll-to">dns_no_sync</a></li> </ul> </li> <li> <a href="#vaults-section" class="scroll-to">Vaults section</a> <ul> <li><a href="#vault_env_prefix" class="scroll-to">vault_env_prefix</a></li> <li><a href="#vault_aws_region" class="scroll-to">vault_aws_region</a></li> <li><a href="#vault_gcp_project_id" class="scroll-to">vault_gcp_project_id</a></li> <li><a href="#vault_hcv_protocol" class="scroll-to">vault_hcv_protocol</a></li> <li><a href="#vault_hcv_host" class="scroll-to">vault_hcv_host</a></li> <li><a href="#vault_hcv_port" class="scroll-to">vault_hcv_port</a></li> <li><a href="#vault_hcv_namespace" class="scroll-to">vault_hcv_namespace</a></li> <li><a href="#vault_hcv_mount" class="scroll-to">vault_hcv_mount</a></li> <li><a href="#vault_hcv_kv" class="scroll-to">vault_hcv_kv</a></li> <li><a href="#vault_hcv_token" class="scroll-to">vault_hcv_token</a></li> <li><a href="#vault_hcv_auth_method" class="scroll-to">vault_hcv_auth_method</a></li> <li><a href="#vault_hcv_kube_role" class="scroll-to">vault_hcv_kube_role</a></li> <li><a href="#vault_hcv_kube_api_token_file" class="scroll-to">vault_hcv_kube_api_token_file</a></li> </ul> </li> <li> <a href="#tuning--behavior-section" class="scroll-to">Tuning & Behavior section</a> <ul> <li><a href="#worker_consistency" class="scroll-to">worker_consistency</a></li> <li><a href="#worker_state_update_frequency" class="scroll-to">worker_state_update_frequency</a></li> <li><a href="#router_flavor" class="scroll-to">router_flavor</a></li> </ul> </li> <li> <a href="#default-traditional_compatible" class="scroll-to"><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">traditional_compatible</code></a> <ul> <li><a href="#lua_max_req_headers" class="scroll-to">lua_max_req_headers</a></li> <li><a href="#lua_max_resp_headers" class="scroll-to">lua_max_resp_headers</a></li> <li><a href="#lua_max_uri_args" class="scroll-to">lua_max_uri_args</a></li> <li><a href="#lua_max_post_args" class="scroll-to">lua_max_post_args</a></li> </ul> </li> <li> <a href="#miscellaneous-section" class="scroll-to">Miscellaneous section</a> <ul> <li><a href="#lua_ssl_trusted_certificate" class="scroll-to">lua_ssl_trusted_certificate</a></li> <li><a href="#lua_ssl_verify_depth" class="scroll-to">lua_ssl_verify_depth</a></li> <li><a href="#lua_ssl_protocols" class="scroll-to">lua_ssl_protocols</a></li> <li><a href="#lua_package_path" class="scroll-to">lua_package_path</a></li> <li><a href="#lua_package_cpath" class="scroll-to">lua_package_cpath</a></li> <li><a href="#lua_socket_pool_size" class="scroll-to">lua_socket_pool_size</a></li> <li><a href="#enforce_rbac" class="scroll-to">enforce_rbac</a></li> <li><a href="#rbac_auth_header" class="scroll-to">rbac_auth_header</a></li> <li><a href="#event_hooks_enabled" class="scroll-to">event_hooks_enabled</a></li> <li><a href="#fips" class="scroll-to">fips</a></li> </ul> </li> <li> <a href="#kong-manager-section" class="scroll-to">Kong Manager section</a> <ul> <li><a href="#admin_gui_listen" class="scroll-to">admin_gui_listen</a></li> <li><a href="#admin_gui_url" class="scroll-to">admin_gui_url</a></li> <li><a href="#admin_gui_path" class="scroll-to">admin_gui_path</a></li> <li><a href="#admin_gui_ssl_cert" class="scroll-to">admin_gui_ssl_cert</a></li> <li><a href="#admin_gui_ssl_cert_key" class="scroll-to">admin_gui_ssl_cert_key</a></li> <li><a href="#admin_gui_flags" class="scroll-to">admin_gui_flags</a></li> <li><a href="#admin_gui_access_log" class="scroll-to">admin_gui_access_log</a></li> <li><a href="#admin_gui_error_log" class="scroll-to">admin_gui_error_log</a></li> <li><a href="#admin_gui_auth" class="scroll-to">admin_gui_auth</a></li> <li><a href="#admin_gui_auth_conf" class="scroll-to">admin_gui_auth_conf</a></li> <li><a href="#admin_gui_auth_password_complexity" class="scroll-to">admin_gui_auth_password_complexity</a></li> <li><a href="#admin_gui_session_conf" class="scroll-to">admin_gui_session_conf</a></li> <li><a href="#admin_gui_auth_header" class="scroll-to">admin_gui_auth_header</a></li> <li><a href="#admin_gui_auth_login_attempts" class="scroll-to">admin_gui_auth_login_attempts</a></li> <li><a href="#admin_gui_header_txt" class="scroll-to">admin_gui_header_txt</a></li> <li><a href="#admin_gui_header_bg_color" class="scroll-to">admin_gui_header_bg_color</a></li> <li><a href="#admin_gui_header_txt_color" class="scroll-to">admin_gui_header_txt_color</a></li> <li><a href="#admin_gui_footer_txt" class="scroll-to">admin_gui_footer_txt</a></li> <li><a href="#admin_gui_footer_bg_color" class="scroll-to">admin_gui_footer_bg_color</a></li> <li><a href="#admin_gui_footer_txt_color" class="scroll-to">admin_gui_footer_txt_color</a></li> <li><a href="#admin_gui_login_banner_title" class="scroll-to">admin_gui_login_banner_title</a></li> <li><a href="#admin_gui_login_banner_body" class="scroll-to">admin_gui_login_banner_body</a></li> </ul> </li> <li> <a href="#vitals-section" class="scroll-to">Vitals section</a> <ul> <li><a href="#vitals" class="scroll-to">vitals</a></li> <li><a href="#vitals_strategy" class="scroll-to">vitals_strategy</a></li> <li><a href="#vitals_tsdb_address" class="scroll-to">vitals_tsdb_address</a></li> <li><a href="#vitals_tsdb_user" class="scroll-to">vitals_tsdb_user</a></li> <li><a href="#vitals_tsdb_password" class="scroll-to">vitals_tsdb_password</a></li> <li><a href="#vitals_statsd_address" class="scroll-to">vitals_statsd_address</a></li> <li><a href="#vitals_statsd_prefix" class="scroll-to">vitals_statsd_prefix</a></li> <li><a href="#vitals_statsd_udp_packet_size" class="scroll-to">vitals_statsd_udp_packet_size</a></li> <li><a href="#vitals_prometheus_scrape_interval" class="scroll-to">vitals_prometheus_scrape_interval</a></li> </ul> </li> <li> <a href="#konnect-section" class="scroll-to">Konnect section</a> <ul> <li><a href="#konnect_mode" class="scroll-to">konnect_mode</a></li> </ul> </li> <li> <a href="#analytics-for-konnect-section" class="scroll-to">Analytics For Konnect section</a> <ul> <li><a href="#analytics_flush_interval" class="scroll-to">analytics_flush_interval</a></li> <li><a href="#analytics_buffer_size_limit" class="scroll-to">analytics_buffer_size_limit</a></li> </ul> </li> <li> <a href="#developer-portal-section" class="scroll-to">Developer Portal section</a> <ul> <li><a href="#portal" class="scroll-to">portal</a></li> <li><a href="#portal_gui_listen" class="scroll-to">portal_gui_listen</a></li> <li><a href="#portal_gui_protocol" class="scroll-to">portal_gui_protocol</a></li> <li><a href="#portal_gui_host" class="scroll-to">portal_gui_host</a></li> <li><a href="#portal_cors_origins" class="scroll-to">portal_cors_origins</a></li> <li><a href="#portal_gui_use_subdomains" class="scroll-to">portal_gui_use_subdomains</a></li> <li><a href="#portal_gui_ssl_cert" class="scroll-to">portal_gui_ssl_cert</a></li> <li><a href="#portal_gui_ssl_cert_key" class="scroll-to">portal_gui_ssl_cert_key</a></li> <li><a href="#portal_gui_access_log" class="scroll-to">portal_gui_access_log</a></li> <li><a href="#portal_gui_error_log" class="scroll-to">portal_gui_error_log</a></li> <li><a href="#portal_api_listen" class="scroll-to">portal_api_listen</a></li> <li><a href="#portal_api_url" class="scroll-to">portal_api_url</a></li> <li><a href="#portal_api_ssl_cert" class="scroll-to">portal_api_ssl_cert</a></li> <li><a href="#portal_api_ssl_cert_key" class="scroll-to">portal_api_ssl_cert_key</a></li> <li><a href="#portal_api_access_log" class="scroll-to">portal_api_access_log</a></li> <li><a href="#portal_api_error_log" class="scroll-to">portal_api_error_log</a></li> <li><a href="#portal_is_legacy" class="scroll-to">portal_is_legacy</a></li> <li><a href="#portal_app_auth" class="scroll-to">portal_app_auth</a></li> </ul> </li> <li> <a href="#default-developer-portal-authentication-section" class="scroll-to">Default Developer Portal Authentication section</a> <ul> <li><a href="#portal_auth" class="scroll-to">portal_auth</a></li> <li><a href="#portal_auth_password_complexity" class="scroll-to">portal_auth_password_complexity</a></li> <li><a href="#portal_auth_conf" class="scroll-to">portal_auth_conf</a></li> <li><a href="#portal_auth_login_attempts" class="scroll-to">portal_auth_login_attempts</a></li> <li><a href="#portal_session_conf" class="scroll-to">portal_session_conf</a></li> <li><a href="#portal_auto_approve" class="scroll-to">portal_auto_approve</a></li> <li><a href="#portal_token_exp" class="scroll-to">portal_token_exp</a></li> <li><a href="#portal_email_verification" class="scroll-to">portal_email_verification</a></li> </ul> </li> <li> <a href="#default-portal-smtp-configuration-section" class="scroll-to">Default Portal Smtp Configuration section</a> <ul> <li><a href="#portal_invite_email" class="scroll-to">portal_invite_email</a></li> <li><a href="#portal_access_request_email" class="scroll-to">portal_access_request_email</a></li> <li><a href="#portal_approved_email" class="scroll-to">portal_approved_email</a></li> <li><a href="#portal_reset_email" class="scroll-to">portal_reset_email</a></li> <li><a href="#portal_reset_success_email" class="scroll-to">portal_reset_success_email</a></li> <li><a href="#portal_application_status_email" class="scroll-to">portal_application_status_email</a></li> <li><a href="#portal_application_request_email" class="scroll-to">portal_application_request_email</a></li> <li><a href="#portal_emails_from" class="scroll-to">portal_emails_from</a></li> <li><a href="#portal_emails_reply_to" class="scroll-to">portal_emails_reply_to</a></li> <li><a href="#portal_smtp_admin_emails" class="scroll-to">portal_smtp_admin_emails</a></li> </ul> </li> <li> <a href="#admin-smtp-configuration-section" class="scroll-to">Admin Smtp Configuration section</a> <ul> <li><a href="#admin_emails_from" class="scroll-to">admin_emails_from</a></li> <li><a href="#admin_emails_reply_to" class="scroll-to">admin_emails_reply_to</a></li> <li><a href="#admin_invitation_expiry" class="scroll-to">admin_invitation_expiry</a></li> </ul> </li> <li> <a href="#general-smtp-configuration-section" class="scroll-to">General Smtp Configuration section</a> <ul> <li><a href="#smtp_mock" class="scroll-to">smtp_mock</a></li> <li><a href="#smtp_host" class="scroll-to">smtp_host</a></li> <li><a href="#smtp_port" class="scroll-to">smtp_port</a></li> <li><a href="#smtp_starttls" class="scroll-to">smtp_starttls</a></li> <li><a href="#smtp_username" class="scroll-to">smtp_username</a></li> <li><a href="#smtp_password" class="scroll-to">smtp_password</a></li> <li><a href="#smtp_ssl" class="scroll-to">smtp_ssl</a></li> <li><a href="#smtp_auth_type" class="scroll-to">smtp_auth_type</a></li> <li><a href="#smtp_domain" class="scroll-to">smtp_domain</a></li> <li><a href="#smtp_timeout_connect" class="scroll-to">smtp_timeout_connect</a></li> <li><a href="#smtp_timeout_send" class="scroll-to">smtp_timeout_send</a></li> <li><a href="#smtp_timeout_read" class="scroll-to">smtp_timeout_read</a></li> <li><a href="#smtp_admin_emails" class="scroll-to">smtp_admin_emails</a></li> </ul> </li> <li> <a href="#data--admin-audit-section" class="scroll-to">Data & Admin Audit section</a> <ul> <li><a href="#audit_log" class="scroll-to">audit_log</a></li> <li><a href="#audit_log_ignore_methods" class="scroll-to">audit_log_ignore_methods</a></li> <li><a href="#audit_log_ignore_paths" class="scroll-to">audit_log_ignore_paths</a></li> <li><a href="#audit_log_ignore_tables" class="scroll-to">audit_log_ignore_tables</a></li> <li><a href="#audit_log_payload_exclude" class="scroll-to">audit_log_payload_exclude</a></li> <li><a href="#audit_log_record_ttl" class="scroll-to">audit_log_record_ttl</a></li> <li><a href="#audit_log_signing_key" class="scroll-to">audit_log_signing_key</a></li> </ul> </li> <li> <a href="#granular-tracing-section" class="scroll-to">Granular Tracing section</a> <ul> <li><a href="#tracing" class="scroll-to">tracing</a></li> <li><a href="#tracing_write_strategy" class="scroll-to">tracing_write_strategy</a></li> <li><a href="#tracing_write_endpoint" class="scroll-to">tracing_write_endpoint</a></li> <li><a href="#tracing_time_threshold" class="scroll-to">tracing_time_threshold</a></li> <li><a href="#tracing_types" class="scroll-to">tracing_types</a></li> <li><a href="#tracing_debug_header" class="scroll-to">tracing_debug_header</a></li> <li><a href="#generate_trace_details" class="scroll-to">generate_trace_details</a></li> </ul> </li> <li> <a href="#route-collision-detectionprevention-section" class="scroll-to">Route Collision Detection/Prevention section</a> <ul> <li><a href="#route_validation_strategy" class="scroll-to">route_validation_strategy</a></li> <li><a href="#enforce_route_path_pattern" class="scroll-to">enforce_route_path_pattern</a></li> </ul> </li> <li> <a href="#database-encryption--keyring-management-section" class="scroll-to">Database Encryption & Keyring Management section</a> <ul> <li><a href="#keyring_enabled" class="scroll-to">keyring_enabled</a></li> <li><a href="#keyring_strategy" class="scroll-to">keyring_strategy</a></li> <li><a href="#keyring_public_key" class="scroll-to">keyring_public_key</a></li> <li><a href="#keyring_private_key" class="scroll-to">keyring_private_key</a></li> <li><a href="#keyring_recovery_public_key" class="scroll-to">keyring_recovery_public_key</a></li> <li><a href="#keyring_blob_path" class="scroll-to">keyring_blob_path</a></li> <li><a href="#keyring_vault_host" class="scroll-to">keyring_vault_host</a></li> <li><a href="#keyring_vault_mount" class="scroll-to">keyring_vault_mount</a></li> <li><a href="#keyring_vault_path" class="scroll-to">keyring_vault_path</a></li> <li><a href="#keyring_vault_auth_method" class="scroll-to">keyring_vault_auth_method</a></li> <li><a href="#keyring_vault_token" class="scroll-to">keyring_vault_token</a></li> <li><a href="#keyring_vault_kube_role" class="scroll-to">keyring_vault_kube_role</a></li> <li><a href="#keyring_vault_kube_api_token_file" class="scroll-to">keyring_vault_kube_api_token_file</a></li> <li><a href="#untrusted_lua" class="scroll-to">untrusted_lua</a></li> <li><a href="#untrusted_lua_sandbox_requires" class="scroll-to">untrusted_lua_sandbox_requires</a></li> <li><a href="#untrusted_lua_sandbox_environment" class="scroll-to">untrusted_lua_sandbox_environment</a></li> <li><a href="#openresty_path" class="scroll-to">openresty_path</a></li> <li><a href="#node_id" class="scroll-to">node_id</a></li> <li><a href="#cluster_fallback_config_import" class="scroll-to">cluster_fallback_config_import</a></li> <li><a href="#cluster_fallback_config_import-1" class="scroll-to">cluster_fallback_config_import</a></li> <li><a href="#cluster_fallback_config_storage" class="scroll-to">cluster_fallback_config_storage</a></li> <li><a href="#cluster_fallback_config_export" class="scroll-to">cluster_fallback_config_export</a></li> <li><a href="#cluster_fallback_config_export_delay" class="scroll-to">cluster_fallback_config_export_delay</a></li> <li><a href="#max_queued_batches" class="scroll-to">max_queued_batches</a></li> </ul> </li> </ul> </aside> <div class="page-content-container page-content-container-doc v2 " id="documentation"> <div class="toggles "> <i class="far fa-list-alt toc-sidebar-toggle"></i> </div> <div class="page-content"> <div class="content show-anchor-links"> <blockquote id="version-notice" class="important"> You are browsing documentation for an older version. See the <a href="/gateway/latest/reference/configuration/">latest documentation here</a>. </blockquote> <h1 tabindex="-1" id="main" class="page-content-title">Configuration Reference for Kong Gateway </h1>  <p>Reference for Kong Gateway configuration parameters. Set these parameters in <code class="language-plaintext highlighter-rouge">kong.conf</code>.</p> <p>To learn more about the <code class="language-plaintext highlighter-rouge">kong.conf</code> file, see the guide on the <a href="/gateway/3.3.x/production/kong-conf/">Kong Configuration File</a>.</p> <hr> <h2 id="general-section">General section</h2> <h3 id="prefix">prefix</h3> <p>Working directory. Equivalent to Nginx’s prefix path, containing temporary files and logs.</p> <p>Each Kong process must have a separate working directory.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">/usr/local/kong/</code></p> <h3 id="log_level">log_level</h3> <p>Log level of the Nginx server. Logs are found at <code class="language-plaintext highlighter-rouge"><prefix>/logs/error.log</code>.</p> <p>See http://nginx.org/en/docs/ngx_core_module.html#error_log for a list of accepted values.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">notice</code></p> <h3 id="proxy_access_log">proxy_access_log</h3> <p>Path for proxy port request access logs. Set this value to <code class="language-plaintext highlighter-rouge">off</code> to disable logging proxy requests.</p> <p>If this value is a relative path, it will be placed under the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/access.log</code></p> <h3 id="proxy_error_log">proxy_error_log</h3> <p>Path for proxy port request error logs. The granularity of these logs is adjusted by the <code class="language-plaintext highlighter-rouge">log_level</code> property.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/error.log</code></p> <h3 id="proxy_stream_access_log">proxy_stream_access_log</h3> <p>Path for tcp streams proxy port access logs. Set this value to <code class="language-plaintext highlighter-rouge">off</code> to disable logging proxy requests.</p> <p>If this value is a relative path, it will be placed under the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p><code class="language-plaintext highlighter-rouge">basic</code> is defined as <code class="language-plaintext highlighter-rouge">'$remote_addr [$time_local] ' '$protocol $status $bytes_sent $bytes_received ' '$session_time'</code></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/access.log basic</code></p> <h3 id="proxy_stream_error_log">proxy_stream_error_log</h3> <p>Path for tcp streams proxy port request error logs. The granularity of these logs is adjusted by the <code class="language-plaintext highlighter-rouge">log_level</code> property.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/error.log</code></p> <h3 id="admin_access_log">admin_access_log</h3> <p>Path for Admin API request access logs. If Hybrid Mode is enabled and the current node is set to be the Control Plane, then the connection requests from Data Planes are also written to this file with server name “kong_cluster_listener”.</p> <p>Set this value to <code class="language-plaintext highlighter-rouge">off</code> to disable logging Admin API requests.</p> <p>If this value is a relative path, it will be placed under the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/admin_access.log</code></p> <h3 id="admin_error_log">admin_error_log</h3> <p>Path for Admin API request error logs. The granularity of these logs is adjusted by the <code class="language-plaintext highlighter-rouge">log_level</code> property.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/error.log</code></p> <h3 id="status_access_log">status_access_log</h3> <p>Path for Status API request access logs. The default value of <code class="language-plaintext highlighter-rouge">off</code> implies that logging for this API is disabled by default.</p> <p>If this value is a relative path, it will be placed under the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="status_error_log">status_error_log</h3> <p>Path for Status API request error logs. The granularity of these logs is adjusted by the <code class="language-plaintext highlighter-rouge">log_level</code> property.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/status_error.log</code></p> <h3 class="badge enterprise" id="debug_access_log">debug_access_log</h3> <p>Path for Debug API request access logs. The default value of <code class="language-plaintext highlighter-rouge">off</code> implies that logging for this API is disabled by default.</p> <p>If this value is a relative path, it will be placed under the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="debug_error_log">debug_error_log</h3> <p>Path for Debug API request error logs. The granularity of these logs is adjusted by the <code class="language-plaintext highlighter-rouge">log_level</code> property.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/debug_error.log</code></p> <h3 id="vaults">vaults</h3> <p>Comma-separated list of vaults this node should load. By default, all the bundled vaults are enabled.</p> <p>The specified name(s) will be substituted as such in the Lua namespace: <code class="language-plaintext highlighter-rouge">kong.vaults.{name}.*</code>.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">bundled</code></p> <h3 id="opentelemetry_tracing">opentelemetry_tracing</h3> <p>Deprecated: use tracing_instrumentations instead</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="tracing_instrumentations">tracing_instrumentations</h3> <p>Comma-separated list of tracing instrumentations this node should load. By default, no instrumentations are enabled.</p> <p>Valid values to this setting are:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">off</code>: do not enable instrumentations.</li> <li> <code class="language-plaintext highlighter-rouge">request</code>: only enable request-level instrumentations.</li> <li> <code class="language-plaintext highlighter-rouge">all</code>: enable all the following instrumentations.</li> <li> <code class="language-plaintext highlighter-rouge">db_query</code>: trace database query.</li> <li> <code class="language-plaintext highlighter-rouge">dns_query</code>: trace DNS query.</li> <li> <code class="language-plaintext highlighter-rouge">router</code>: trace router execution, including router rebuilding.</li> <li> <code class="language-plaintext highlighter-rouge">http_client</code>: trace OpenResty HTTP client requests.</li> <li> <code class="language-plaintext highlighter-rouge">balancer</code>: trace balancer retries.</li> <li> <code class="language-plaintext highlighter-rouge">plugin_rewrite</code>: trace plugins iterator execution with rewrite phase.</li> <li> <code class="language-plaintext highlighter-rouge">plugin_access</code>: trace plugins iterator execution with access phase.</li> <li> <code class="language-plaintext highlighter-rouge">plugin_header_filter</code>: trace plugins iterator execution with header_filter phase.</li> </ul> <p><strong>Note:</strong> In the current implementation, tracing instrumentations are not enabled in stream mode.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="opentelemetry_tracing_sampling_rate">opentelemetry_tracing_sampling_rate</h3> <p>Deprecated: use tracing_sampling_rate instead</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">1.0</code></p> <h3 id="tracing_sampling_rate">tracing_sampling_rate</h3> <p>Tracing instrumentation sampling rate.</p> <p>Tracer samples a fixed percentage of all spans following the sampling rate.</p> <p>Example: <code class="language-plaintext highlighter-rouge">0.25</code>, this should account for 25% of all traces.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0.01</code></p> <h3 id="plugins">plugins</h3> <p>Comma-separated list of plugins this node should load. By default, only plugins bundled in official distributions are loaded via the <code class="language-plaintext highlighter-rouge">bundled</code> keyword.</p> <p>Loading a plugin does not enable it by default, but only instructs Kong to load its source code, and allows to configure the plugin via the various related Admin API endpoints.</p> <p>The specified name(s) will be substituted as such in the Lua namespace: <code class="language-plaintext highlighter-rouge">kong.plugins.{name}.*</code>.</p> <p>When the <code class="language-plaintext highlighter-rouge">off</code> keyword is specified as the only value, no plugins will be loaded.</p> <p><code class="language-plaintext highlighter-rouge">bundled</code> and plugin names can be mixed together, as the following examples suggest:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">plugins = bundled,custom-auth,custom-log</code> will include the bundled plugins plus two custom ones</li> <li> <code class="language-plaintext highlighter-rouge">plugins = custom-auth,custom-log</code> will <em>only</em> include the <code class="language-plaintext highlighter-rouge">custom-auth</code> and <code class="language-plaintext highlighter-rouge">custom-log</code> plugins.</li> <li> <code class="language-plaintext highlighter-rouge">plugins = off</code> will not include any plugins</li> </ul> <p><strong>Note:</strong> Kong will not start if some plugins were previously configured (i.e.</p> <p>have rows in the database) and are not specified in this list. Before disabling a plugin, ensure all instances of it are removed before restarting Kong.</p> <p><strong>Note:</strong> Limiting the amount of available plugins can improve P99 latency when experiencing LRU churning in the database cache (i.e. when the configured <code class="language-plaintext highlighter-rouge">mem_cache_size</code>) is full.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">bundled</code></p> <h3 id="pluginserver_names">pluginserver_names</h3> <p>Comma-separated list of names for pluginserver processes. The actual names are used for log messages and to relate the actual settings.</p> <p><strong>Default:</strong> none</p> <h3 id="pluginserver_xxx_socket">pluginserver_XXX_socket</h3> <p>Path to the unix socket used by the <xxx> pluginserver.</xxx></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge"><prefix>/<XXX>.socket</code></p> <h3 id="pluginserver_xxx_start_cmd">pluginserver_XXX_start_cmd</h3> <p>Full command (including any needed arguments) to start the <xxx> pluginserver</xxx></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">/usr/local/bin/<XXX></code></p> <h3 id="pluginserver_xxx_query_cmd">pluginserver_XXX_query_cmd</h3> <p>Full command to “query” the <xxx> pluginserver. Should produce a JSON with the dump info of all plugins it manages</xxx></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">/usr/local/bin/query_<XXX></code></p> <h3 id="port_maps">port_maps</h3> <p>With this configuration parameter, you can let the Kong to know about the port from which the packets are forwarded to it. This is fairly common when running Kong in a containerized or virtualized environment.</p> <p>For example, <code class="language-plaintext highlighter-rouge">port_maps=80:8000, 443:8443</code> instructs Kong that the port 80 is mapped to 8000 (and the port 443 to 8443), where 8000 and 8443 are the ports that Kong is listening to.</p> <p>This parameter helps Kong set a proper forwarded upstream HTTP request header or to get the proper forwarded port with the Kong PDK (in case other means determining it has failed). It changes routing by a destination port to route by a port from which packets are forwarded to Kong, and similarly it changes the default plugin log serializer to use the port according to this mapping instead of reporting the port Kong is listening to.</p> <p><strong>Default:</strong> none</p> <h3 id="anonymous_reports">anonymous_reports</h3> <p>Send anonymous usage data such as error stack traces to help improve Kong.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 id="proxy_server">proxy_server</h3> <p>Proxy server defined as a URL. Kong will only use this option if any component is explicitly configured to use proxy.</p> <p><strong>Default:</strong> none</p> <h3 id="proxy_server_ssl_verify">proxy_server_ssl_verify</h3> <p>Toggles server certificate verification if <code class="language-plaintext highlighter-rouge">proxy_server</code> is in HTTPS.</p> <p>See the <code class="language-plaintext highlighter-rouge">lua_ssl_trusted_certificate</code> setting to specify a certificate authority.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <hr> <h3 id="error_template_html">error_template_html</h3> <p>Path to the custom html error template to override the default html kong error template.</p> <p>The template is required to contain one single <code class="language-plaintext highlighter-rouge">%s</code> placeholder for the error message, as in the following example:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code><html> <body> <h1>My custom error template</h1> <p>%s.</p> </body> </html> </code></pre></div></div> <p>Default: none</p> <hr> <h3 id="error_template_json">error_template_json</h3> <p>Path to the custom json error template to override the default json kong error template.</p> <p>Similarly to <code class="language-plaintext highlighter-rouge">error_template_html</code>, the template is required to contain one single <code class="language-plaintext highlighter-rouge">%s</code> placeholder for the error message.</p> <p>Default: none</p> <hr> <h3 id="error_template_xml">error_template_xml</h3> <p>Path to the custom xml error template to override the default xml kong error template</p> <p>Similarly to <code class="language-plaintext highlighter-rouge">error_template_html</code>, the template is required to contain one single <code class="language-plaintext highlighter-rouge">%s</code> placeholder for the error message.</p> <p>Default: none</p> <hr> <h3 id="error_template_plain">error_template_plain</h3> <p>Path to the custom plain error template to override the default plain kong error template</p> <p>Similarly to <code class="language-plaintext highlighter-rouge">error_template_html</code>, the template is required to contain one single <code class="language-plaintext highlighter-rouge">%s</code> placeholder for the error message.</p> <p>Default: none</p> <hr> <h2 id="hybrid-mode-section">Hybrid Mode section</h2> <h3 id="role">role</h3> <p>Use this setting to enable Hybrid Mode, This allows running some Kong nodes in a control plane role with a database and have them deliver configuration updates to other nodes running to DB-less running in a Data Plane role.</p> <p>Valid values to this setting are:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">traditional</code>: do not use Hybrid Mode.</li> <li> <code class="language-plaintext highlighter-rouge">control_plane</code>: this node runs in a control plane role. It can use a database and will deliver configuration updates to data plane nodes.</li> <li> <code class="language-plaintext highlighter-rouge">data_plane</code>: this is a data plane node. It runs DB-less and receives configuration updates from a control plane node.</li> </ul> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">traditional</code></p> <h3 id="cluster_mtls">cluster_mtls</h3> <p>Sets the verification between nodes of the cluster.</p> <p>Valid values to this setting are:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">shared</code>: use a shared certificate/key pair specified with the <code class="language-plaintext highlighter-rouge">cluster_cert</code> and <code class="language-plaintext highlighter-rouge">cluster_cert_key</code> settings. Note that CP and DP nodes have to present the same certificate to establish mTLS connections.</li> <li> <code class="language-plaintext highlighter-rouge">pki</code>: use <code class="language-plaintext highlighter-rouge">cluster_ca_cert</code>, <code class="language-plaintext highlighter-rouge">cluster_server_name</code> and <code class="language-plaintext highlighter-rouge">cluster_cert</code> for verification. These are different certificates for each DP node, but issued by a cluster-wide common CA certificate: <code class="language-plaintext highlighter-rouge">cluster_ca_cert</code>.</li> <li> <code class="language-plaintext highlighter-rouge">pki_check_cn</code>: similar as <code class="language-plaintext highlighter-rouge">pki</code> but additionally checks for Common Name of data plane certificate specified in <code class="language-plaintext highlighter-rouge">cluster_allowed_common_names</code>.</li> </ul> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">shared</code></p> <h3 id="cluster_cert">cluster_cert</h3> <p>Cluster certificate to use when establishing secure communication between control and data plane nodes.</p> <p>You can use the <code class="language-plaintext highlighter-rouge">kong hybrid</code> command to generate the certificate/key pair.</p> <p>Under <code class="language-plaintext highlighter-rouge">shared</code> mode, it must be the same for all nodes. Under <code class="language-plaintext highlighter-rouge">pki</code> mode it should be a different certificate for each DP node.</p> <p>The certificate can be configured on this property with either of the following values:</p> <ul> <li>absolute path to the certificate</li> <li>certificate content</li> <li>base64 encoded certificate content</li> </ul> <p><strong>Default:</strong> none</p> <h3 id="cluster_cert_key">cluster_cert_key</h3> <p>Cluster certificate key to use when establishing secure communication between control and data plane nodes.</p> <p>You can use the <code class="language-plaintext highlighter-rouge">kong hybrid</code> command to generate the certificate/key pair.</p> <p>Under <code class="language-plaintext highlighter-rouge">shared</code> mode, it must be the same for all nodes. Under <code class="language-plaintext highlighter-rouge">pki</code> mode it should be a different certificate for each DP node.</p> <p>The certificate key can be configured on this property with any of the following values:</p> <ul> <li>absolute path to the certificate key</li> <li>certificate key content</li> <li>base64 encoded certificate key content</li> </ul> <p><strong>Default:</strong> none</p> <h3 id="cluster_ca_cert">cluster_ca_cert</h3> <p>The trusted CA certificate file in PEM format used for Control Plane to verify Data Plane’s certificate and Data Plane to verify Control Plane’s certificate.</p> <p>Required on data plane if <code class="language-plaintext highlighter-rouge">cluster_mtls</code> is set to <code class="language-plaintext highlighter-rouge">pki</code>.</p> <p>If Control Plane certificate is issued by a well known CA, user can set <code class="language-plaintext highlighter-rouge">lua_ssl_trusted_certificate=system</code> on Data Plane and leave this field empty.</p> <p>This field is ignored if <code class="language-plaintext highlighter-rouge">cluster_mtls</code> is set to <code class="language-plaintext highlighter-rouge">shared</code>.</p> <p>The certificate can be configured on this property with any of the following values:</p> <ul> <li>absolute path to the certificate</li> <li>certificate content</li> <li>base64 encoded certificate content</li> </ul> <p><strong>Default:</strong> none</p> <h3 id="cluster_allowed_common_names">cluster_allowed_common_names</h3> <p>The list of Common Names that are allowed to connect to control plane. Multiple entries may be supplied in a comma-separated string. When not set, Data Plane with same parent domain of Control Plane cert is allowed to connect.</p> <p>This field is ignored if <code class="language-plaintext highlighter-rouge">cluster_mtls</code> is not set to <code class="language-plaintext highlighter-rouge">pki_check_cn</code>.</p> <p><strong>Default:</strong> none</p> <hr> <h2 id="hybrid-mode-data-plane-section">Hybrid Mode Data Plane section</h2> <h3 id="cluster_server_name">cluster_server_name</h3> <p>The server name used in the SNI of the TLS connection from a DP node to a CP node.</p> <p>Must match the Common Name (CN) or Subject Alternative Name (SAN) found in the CP certificate.</p> <p>If <code class="language-plaintext highlighter-rouge">cluster_mtls</code> is set to <code class="language-plaintext highlighter-rouge">shared</code>, this setting is ignored and <code class="language-plaintext highlighter-rouge">kong_clustering</code> is used.</p> <p><strong>Default:</strong> none</p> <h3 id="cluster_control_plane">cluster_control_plane</h3> <p>To be used by data plane nodes only: address of the control plane node from which configuration updates will be fetched, in <code class="language-plaintext highlighter-rouge">host:port</code> format.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="cluster_telemetry_endpoint">cluster_telemetry_endpoint</h3> <p>To be used by data plane nodes only: telemetry address of the control plane node to which telemetry updates will be posted in <code class="language-plaintext highlighter-rouge">host:port</code> format.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="cluster_telemetry_server_name">cluster_telemetry_server_name</h3> <p>The SNI (Server Name Indication extension) to use for Vitals telemetry data.</p> <p><strong>Default:</strong> none</p> <hr> <h3 class="badge enterprise" id="cluster_dp_labels">cluster_dp_labels</h3> <p>Comma separated list of Labels for the data plane.</p> <p>Labels are key-value pairs that provide additional context information for each DP.</p> <p>Each label must be configured as a string in the format <code class="language-plaintext highlighter-rouge">key:value</code>.</p> <p>Labels are only compatible with hybrid mode deployments with Kong Konnect (SaaS), this configuration doesn’t work with self-hosted deployments.</p> <p>Keys and values follow the AIP standards: https://kong-aip.netlify.app/aip/129/</p> <p>Example: <code class="language-plaintext highlighter-rouge">deployment:mycloud,region:us-east-1</code></p> <p>Default: none</p> <hr> <h2 id="hybrid-mode-control-plane-section">Hybrid Mode Control Plane section</h2> <h3 id="cluster_listen">cluster_listen</h3> <p>Comma-separated list of addresses and ports on which the cluster control plane server should listen for data plane connections.</p> <p>The cluster communication port of the control plane must be accessible by all the data planes within the same cluster. This port is mTLS protected to ensure end-to-end security and integrity.</p> <p>This setting has no effect if <code class="language-plaintext highlighter-rouge">role</code> is not set to <code class="language-plaintext highlighter-rouge">control_plane</code>.</p> <p>Connection made to this endpoint are logged to the same location as Admin API access logs.</p> <p>See <code class="language-plaintext highlighter-rouge">admin_access_log</code> config description for more information.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0.0.0.0:8005</code></p> <h3 class="badge enterprise" id="cluster_telemetry_listen">cluster_telemetry_listen</h3> <p>Comma-separated list of addresses and ports on which the cluster control plane server should listen for data plane telemetry connections.</p> <p>The cluster communication port of the control plane must be accessible by all the data planes within the same cluster.</p> <p>This setting has no effect if <code class="language-plaintext highlighter-rouge">role</code> is not set to <code class="language-plaintext highlighter-rouge">control_plane</code>.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0.0.0.0:8006</code></p> <h3 id="cluster_data_plane_purge_delay">cluster_data_plane_purge_delay</h3> <p>How many seconds must pass from the time a DP node becomes offline to the time its entry gets removed from the database, as returned by the /clustering/data-planes Admin API endpoint.</p> <p>This is to prevent the cluster data plane table from growing indefinitely. The default is set to 14 days. That is, if CP haven’t heard from a DP for 14 days, its entry will be removed.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">1209600</code></p> <h3 id="cluster_ocsp">cluster_ocsp</h3> <p>Whether to check for revocation status of DP certificates using OCSP (Online Certificate Status Protocol).</p> <p>If enabled, the DP certificate should contain the “Certificate Authority Information Access” extension and the OCSP method with URI of which the OCSP responder can be reached from CP.</p> <p>OCSP checks are only performed on CP nodes, it has no effect on DP nodes.</p> <p>Valid values to this setting are:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">on</code>: OCSP revocation check is enabled and DP must pass the check in order to establish connection with CP.</li> <li> <code class="language-plaintext highlighter-rouge">off</code>: OCSP revocation check is disabled.</li> <li> <code class="language-plaintext highlighter-rouge">optional</code>: OCSP revocation check will be attempted, however, if the required extension is not found inside DP provided certificate or communication with the OCSP responder failed, then DP is still allowed through.</li> </ul> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="cluster_use_proxy">cluster_use_proxy</h3> <p>Whether to turn on HTTP CONNECT proxy support for hybrid mode connections. <code class="language-plaintext highlighter-rouge">proxy_server</code> will be used for Hybrid mode connections if this option is turned on.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="cluster_max_payload">cluster_max_payload</h3> <p>This sets the maximum payload size allowed to be sent across from CP to DP in Hybrid mode Default is 4Mb - 4 * 1024 * 1024 due to historical reasons</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">4194304</code></p> <hr> <h2 id="nginx-section">NGINX section</h2> <h3 id="proxy_listen">proxy_listen</h3> <p>Comma-separated list of addresses and ports on which the proxy server should listen for HTTP/HTTPS traffic.</p> <p>The proxy server is the public entry point of Kong, which proxies traffic from your consumers to your backend services. This value accepts IPv4, IPv6, and hostnames.</p> <p>Some suffixes can be specified for each pair:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">ssl</code> will require that all connections made through a particular address/port be made with TLS enabled.</li> <li> <code class="language-plaintext highlighter-rouge">http2</code> will allow for clients to open HTTP/2 connections to Kong’s proxy server.</li> <li> <code class="language-plaintext highlighter-rouge">proxy_protocol</code> will enable usage of the PROXY protocol for a given address/port.</li> <li> <code class="language-plaintext highlighter-rouge">deferred</code> instructs to use a deferred accept on Linux (the TCP_DEFER_ACCEPT socket option).</li> <li> <code class="language-plaintext highlighter-rouge">bind</code> instructs to make a separate bind() call for a given address:port pair.</li> <li> <code class="language-plaintext highlighter-rouge">reuseport</code> instructs to create an individual listening socket for each worker process allowing the Kernel to better distribute incoming connections between worker processes</li> <li> <code class="language-plaintext highlighter-rouge">backlog=N</code> sets the maximum length for the queue of pending TCP connections. This number should not be too small in order to prevent clients seeing “Connection refused” error connecting to a busy Kong instance. <strong>Note:</strong> on Linux, this value is limited by the setting of <code class="language-plaintext highlighter-rouge">net.core.somaxconn</code> Kernel parameter. In order for the larger <code class="language-plaintext highlighter-rouge">backlog</code> set here to take effect it is necessary to raise <code class="language-plaintext highlighter-rouge">net.core.somaxconn</code> at the same time to match or exceed the <code class="language-plaintext highlighter-rouge">backlog</code> number set.</li> <li> <code class="language-plaintext highlighter-rouge">ipv6only=on|off</code> whether an IPv6 socket listening on a wildcard address [::] will accept only IPv6 connections or both IPv6 and IPv4 connections</li> <li> <code class="language-plaintext highlighter-rouge">so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]</code> configures the <code class="language-plaintext highlighter-rouge">TCP keepalive</code> behavior for the listening socket. If this parameter is omitted then the operating system’s settings will be in effect for the socket. If it is set to the value <code class="language-plaintext highlighter-rouge">on</code>, the <code class="language-plaintext highlighter-rouge">SO_KEEPALIVE</code> option is turned on for the socket. If it is set to the value <code class="language-plaintext highlighter-rouge">off</code>, the <code class="language-plaintext highlighter-rouge">SO_KEEPALIVE</code> option is turned off for the socket. Some operating systems support setting of TCP keepalive parameters on a per-socket basis using the <code class="language-plaintext highlighter-rouge">TCP_KEEPIDLE</code>, <code class="language-plaintext highlighter-rouge">TCP_KEEPINTVL</code>, and <code class="language-plaintext highlighter-rouge">TCP_KEEPCNT</code> socket options.</li> </ul> <p>This value can be set to <code class="language-plaintext highlighter-rouge">off</code>, thus disabling the HTTP/HTTPS proxy port for this node.</p> <p>If stream_listen is also set to <code class="language-plaintext highlighter-rouge">off</code>, this enables ‘control-plane’ mode for this node (in which all traffic proxying capabilities are disabled). This node can then be used only to configure a cluster of Kong nodes connected to the same datastore.</p> <p>Example: <code class="language-plaintext highlighter-rouge">proxy_listen = 0.0.0.0:443 ssl, 0.0.0.0:444 http2 ssl</code></p> <p>See http://nginx.org/en/docs/http/ngx_http_core_module.html#listen for a description of the accepted formats for this and other <code class="language-plaintext highlighter-rouge">*_listen</code> values.</p> <p>See https://www.nginx.com/resources/admin-guide/proxy-protocol/ for more details about the <code class="language-plaintext highlighter-rouge">proxy_protocol</code> parameter.</p> <p>Not all <code class="language-plaintext highlighter-rouge">*_listen</code> values accept all formats specified in nginx’s documentation.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0.0.0.0:8000 reuseport backlog=16384, 0.0.0.0:8443 http2 ssl reuseport backlog=16384</code></p> <h3 id="proxy_url">proxy_url</h3> <p>Kong Proxy URL</p> <p>The lookup, or balancer, address for your Kong Proxy nodes.</p> <p>This value is commonly used in a microservices or service-mesh oriented architecture.</p> <p>Accepted format (parts in parentheses are optional):</p> <p><code class="language-plaintext highlighter-rouge"><scheme>://<IP / HOSTNAME>(:<PORT>(/<PATH>))</code></p> <p>Examples:</p> <ul> <li> <code class="language-plaintext highlighter-rouge"><scheme>://<IP>:<PORT></code> -> <code class="language-plaintext highlighter-rouge">proxy_url = http://127.0.0.1:8000</code> </li> <li> <code class="language-plaintext highlighter-rouge">SSL <scheme>://<HOSTNAME></code> -> <code class="language-plaintext highlighter-rouge">proxy_url = https://proxy.domain.tld</code> </li> <li> <code class="language-plaintext highlighter-rouge"><scheme>://<HOSTNAME>/<PATH></code> -> <code class="language-plaintext highlighter-rouge">proxy_url = http://dev-machine/dev-285</code> </li> </ul> <p>By default, Kong Manager, and Kong Portal will use the window request host and append the resolved listener port depending on the requested protocol.</p> <p><strong>Default:</strong> none</p> <h3 id="stream_listen">stream_listen</h3> <p>Comma-separated list of addresses and ports on which the stream mode should listen.</p> <p>This value accepts IPv4, IPv6, and hostnames.</p> <p>Some suffixes can be specified for each pair:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">ssl</code> will require that all connections made through a particular address/port be made with TLS enabled.</li> <li> <code class="language-plaintext highlighter-rouge">proxy_protocol</code> will enable usage of the PROXY protocol for a given address/port.</li> <li> <code class="language-plaintext highlighter-rouge">bind</code> instructs to make a separate bind() call for a given address:port pair.</li> <li> <code class="language-plaintext highlighter-rouge">reuseport</code> instructs to create an individual listening socket for each worker process allowing the Kernel to better distribute incoming connections between worker processes</li> <li> <code class="language-plaintext highlighter-rouge">backlog=N</code> sets the maximum length for the queue of pending TCP connections. This number should not be too small in order to prevent clients seeing “Connection refused” error connecting to a busy Kong instance. <strong>Note:</strong> on Linux, this value is limited by the setting of <code class="language-plaintext highlighter-rouge">net.core.somaxconn</code> Kernel parameter. In order for the larger <code class="language-plaintext highlighter-rouge">backlog</code> set here to take effect it is necessary to raise <code class="language-plaintext highlighter-rouge">net.core.somaxconn</code> at the same time to match or exceed the <code class="language-plaintext highlighter-rouge">backlog</code> number set.</li> <li> <code class="language-plaintext highlighter-rouge">ipv6only=on|off</code> whether an IPv6 socket listening on a wildcard address [::] will accept only IPv6 connections or both IPv6 and IPv4 connections</li> <li> <code class="language-plaintext highlighter-rouge">so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]</code> configures the <code class="language-plaintext highlighter-rouge">TCP keepalive</code> behavior for the listening socket. If this parameter is omitted then the operating system’s settings will be in effect for the socket. If it is set to the value <code class="language-plaintext highlighter-rouge">on</code>, the <code class="language-plaintext highlighter-rouge">SO_KEEPALIVE</code> option is turned on for the socket. If it is set to the value <code class="language-plaintext highlighter-rouge">off</code>, the <code class="language-plaintext highlighter-rouge">SO_KEEPALIVE</code> option is turned off for the socket. Some operating systems support setting of TCP keepalive parameters on a per-socket basis using the <code class="language-plaintext highlighter-rouge">TCP_KEEPIDLE</code>, <code class="language-plaintext highlighter-rouge">TCP_KEEPINTVL</code>, and <code class="language-plaintext highlighter-rouge">TCP_KEEPCNT</code> socket options.</li> </ul> <p>Examples:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>stream_listen = 127.0.0.1:7000 reuseport backlog=16384 stream_listen = 0.0.0.0:989 reuseport backlog=65536, 0.0.0.0:20 stream_listen = [::1]:1234 backlog=16384 </code></pre></div></div> <p>By default this value is set to <code class="language-plaintext highlighter-rouge">off</code>, thus disabling the stream proxy port for this node.</p> <p>See http://nginx.org/en/docs/stream/ngx_stream_core_module.html#listen for a description of the formats that Kong might accept in stream_listen.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="admin_api_uri">admin_api_uri</h3> <p>Hierarchical part of a URI which is composed optionally of a host, port, and path at which the Admin API accepts HTTP or HTTPS traffic. When this config is disabled, Kong Manager will use the window protocol + host and append the resolved admin_listen HTTP/HTTPS port.</p> <p><strong>Default:</strong> none</p> <h3 id="admin_listen">admin_listen</h3> <p>Comma-separated list of addresses and ports on which the Admin interface should listen.</p> <p>The Admin interface is the API allowing you to configure and manage Kong.</p> <p>Access to this interface should be <em>restricted</em> to Kong administrators <em>only</em>. This value accepts IPv4, IPv6, and hostnames.</p> <p>It is highly recommended to avoid exposing the Admin API to public interface(s), by using values such as 0.0.0.0:8001</p> <p>See https://docs.konghq.com/gateway/latest/production/running-kong/secure-admin-api/ for more information about how to secure your Admin API.</p> <p>Some suffixes can be specified for each pair:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">ssl</code> will require that all connections made through a particular address/port be made with TLS enabled.</li> <li> <code class="language-plaintext highlighter-rouge">http2</code> will allow for clients to open HTTP/2 connections to Kong’s proxy server.</li> <li> <code class="language-plaintext highlighter-rouge">proxy_protocol</code> will enable usage of the PROXY protocol for a given address/port.</li> <li> <code class="language-plaintext highlighter-rouge">deferred</code> instructs to use a deferred accept on Linux (the TCP_DEFER_ACCEPT socket option).</li> <li> <code class="language-plaintext highlighter-rouge">bind</code> instructs to make a separate bind() call for a given address:port pair.</li> <li> <code class="language-plaintext highlighter-rouge">reuseport</code> instructs to create an individual listening socket for each worker process allowing the Kernel to better distribute incoming connections between worker processes</li> <li> <code class="language-plaintext highlighter-rouge">backlog=N</code> sets the maximum length for the queue of pending TCP connections. This number should not be too small in order to prevent clients seeing “Connection refused” error connecting to a busy Kong instance. <strong>Note:</strong> on Linux, this value is limited by the setting of <code class="language-plaintext highlighter-rouge">net.core.somaxconn</code> Kernel parameter. In order for the larger <code class="language-plaintext highlighter-rouge">backlog</code> set here to take effect it is necessary to raise <code class="language-plaintext highlighter-rouge">net.core.somaxconn</code> at the same time to match or exceed the <code class="language-plaintext highlighter-rouge">backlog</code> number set.</li> <li> <code class="language-plaintext highlighter-rouge">ipv6only=on|off</code> whether an IPv6 socket listening on a wildcard address [::] will accept only IPv6 connections or both IPv6 and IPv4 connections</li> <li> <code class="language-plaintext highlighter-rouge">so_keepalive=on|off|[keepidle]:[keepintvl]:[keepcnt]</code> configures the <code class="language-plaintext highlighter-rouge">TCP keepalive</code> behavior for the listening socket. If this parameter is omitted then the operating system’s settings will be in effect for the socket. If it is set to the value <code class="language-plaintext highlighter-rouge">on</code>, the <code class="language-plaintext highlighter-rouge">SO_KEEPALIVE</code> option is turned on for the socket. If it is set to the value <code class="language-plaintext highlighter-rouge">off</code>, the <code class="language-plaintext highlighter-rouge">SO_KEEPALIVE</code> option is turned off for the socket. Some operating systems support setting of TCP keepalive parameters on a per-socket basis using the <code class="language-plaintext highlighter-rouge">TCP_KEEPIDLE</code>, <code class="language-plaintext highlighter-rouge">TCP_KEEPINTVL</code>, and <code class="language-plaintext highlighter-rouge">TCP_KEEPCNT</code> socket options.</li> </ul> <p>This value can be set to <code class="language-plaintext highlighter-rouge">off</code>, thus disabling the Admin interface for this node, enabling a ‘data-plane’ mode (without configuration capabilities) pulling its configuration changes from the database.</p> <p>Example: <code class="language-plaintext highlighter-rouge">admin_listen = 127.0.0.1:8444 http2 ssl</code></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">127.0.0.1:8001 reuseport backlog=16384, 127.0.0.1:8444 http2 ssl reuseport backlog=16384</code></p> <h3 id="status_listen">status_listen</h3> <p>Comma-separated list of addresses and ports on which the Status API should listen.</p> <p>The Status API is a read-only endpoint allowing monitoring tools to retrieve metrics, healthiness, and other non-sensitive information of the current Kong node.</p> <p>The following suffix can be specified for each pair:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">ssl</code> will require that all connections made through a particular address/port be made with TLS enabled.</li> <li> <code class="language-plaintext highlighter-rouge">http2</code> will allow for clients to open HTTP/2 connections to Kong’s Status API server.</li> </ul> <p>This value can be set to <code class="language-plaintext highlighter-rouge">off</code>, disabling the Status API for this node.</p> <p>Example: <code class="language-plaintext highlighter-rouge">status_listen = 0.0.0.0:8100 ssl http2</code></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="debug_listen">debug_listen</h3> <p>Comma-separated list of addresses and ports on which the Debug API should listen.</p> <p>The following suffix can be specified for each pair:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">ssl</code> will require that all connections made through a particular address/port be made with TLS enabled.</li> <li> <code class="language-plaintext highlighter-rouge">http2</code> will allow for clients to open HTTP/2 connections to Kong’s Debug API server.</li> </ul> <p>This value can be set to <code class="language-plaintext highlighter-rouge">off</code>, disabling the Debug API for this node.</p> <p>Example: <code class="language-plaintext highlighter-rouge">debug_listen = 0.0.0.0:8200 ssl http2</code></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="nginx_user">nginx_user</h3> <p>Defines user and group credentials used by worker processes. If group is omitted, a group whose name equals that of user is used.</p> <p>Example: <code class="language-plaintext highlighter-rouge">nginx_user = nginx www</code></p> <p><strong>Note</strong>: If the <code class="language-plaintext highlighter-rouge">kong</code> user and the <code class="language-plaintext highlighter-rouge">kong</code> group are not available, the default user and group credentials will be <code class="language-plaintext highlighter-rouge">nobody nobody</code>.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">kong kong</code></p> <h3 id="nginx_worker_processes">nginx_worker_processes</h3> <p>Determines the number of worker processes spawned by Nginx.</p> <p>See http://nginx.org/en/docs/ngx_core_module.html#worker_processes for detailed usage of the equivalent Nginx directive and a description of accepted values.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">auto</code></p> <h3 id="nginx_daemon">nginx_daemon</h3> <p>Determines whether Nginx will run as a daemon or as a foreground process. Mainly useful for development or when running Kong inside a Docker environment.</p> <p>See http://nginx.org/en/docs/ngx_core_module.html#daemon.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 id="mem_cache_size">mem_cache_size</h3> <p>Size of each of the two in-memory caches for database entities. The accepted units are <code class="language-plaintext highlighter-rouge">k</code> and <code class="language-plaintext highlighter-rouge">m</code>, with a minimum recommended value of a few MBs.</p> <p><strong>Note</strong>: As this option controls the size of two different cache entries, the total memory Kong uses to cache entities might be double this value.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">128m</code></p> <h3 id="ssl_cipher_suite">ssl_cipher_suite</h3> <p>Defines the TLS ciphers served by Nginx.</p> <p>Accepted values are <code class="language-plaintext highlighter-rouge">modern</code>, <code class="language-plaintext highlighter-rouge">intermediate</code>, <code class="language-plaintext highlighter-rouge">old</code>, <code class="language-plaintext highlighter-rouge">fips</code>, or <code class="language-plaintext highlighter-rouge">custom</code>.</p> <p>See https://wiki.mozilla.org/Security/Server_Side_TLS for detailed descriptions of each cipher suite. <code class="language-plaintext highlighter-rouge">fips</code> cipher suites are as described in https://wiki.openssl.org/index.php/FIPS_mode_and_TLS.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">intermediate</code></p> <h3 id="ssl_ciphers">ssl_ciphers</h3> <p>Defines a custom list of TLS ciphers to be served by Nginx. This list must conform to the pattern defined by <code class="language-plaintext highlighter-rouge">openssl ciphers</code>.</p> <p>This value is ignored if <code class="language-plaintext highlighter-rouge">ssl_cipher_suite</code> is not <code class="language-plaintext highlighter-rouge">custom</code>.</p> <p>If you use DHE ciphers, you must also configure the <code class="language-plaintext highlighter-rouge">ssl_dhparam</code> parameter.</p> <p><strong>Default:</strong> none</p> <h3 id="ssl_protocols">ssl_protocols</h3> <p>Enables the specified protocols for client-side connections. The set of supported protocol versions also depends on the version of OpenSSL Kong was built with. This value is ignored if <code class="language-plaintext highlighter-rouge">ssl_cipher_suite</code> is not <code class="language-plaintext highlighter-rouge">custom</code>.</p> <p>See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">TLSv1.1 TLSv1.2 TLSv1.3</code></p> <h3 id="ssl_prefer_server_ciphers">ssl_prefer_server_ciphers</h3> <p>Specifies that server ciphers should be preferred over client ciphers when using the SSLv3 and TLS protocols. This value is ignored if <code class="language-plaintext highlighter-rouge">ssl_cipher_suite</code> is not <code class="language-plaintext highlighter-rouge">custom</code>.</p> <p>See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 id="ssl_dhparam">ssl_dhparam</h3> <p>Defines DH parameters for DHE ciphers from the predefined groups: <code class="language-plaintext highlighter-rouge">ffdhe2048</code>, <code class="language-plaintext highlighter-rouge">ffdhe3072</code>, <code class="language-plaintext highlighter-rouge">ffdhe4096</code>, <code class="language-plaintext highlighter-rouge">ffdhe6144</code>, <code class="language-plaintext highlighter-rouge">ffdhe8192</code>, from the absolute path to a parameters file, or directly from the parameters content.</p> <p>This value is ignored if <code class="language-plaintext highlighter-rouge">ssl_cipher_suite</code> is <code class="language-plaintext highlighter-rouge">modern</code> or <code class="language-plaintext highlighter-rouge">intermediate</code>. The reason is that <code class="language-plaintext highlighter-rouge">modern</code> has no ciphers that needs this, and <code class="language-plaintext highlighter-rouge">intermediate</code> uses <code class="language-plaintext highlighter-rouge">ffdhe2048</code>.</p> <p>See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam</p> <p><strong>Default:</strong> none</p> <h3 id="ssl_session_tickets">ssl_session_tickets</h3> <p>Enables or disables session resumption through TLS session tickets. This has no impact when used with TLSv1.3.</p> <p>Kong enables this by default for performance reasons, but it has security implications: https://github.com/mozilla/server-side-tls/issues/135</p> <p>See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 id="ssl_session_timeout">ssl_session_timeout</h3> <p>Specifies a time during which a client may reuse the session parameters. See the rationale: https://github.com/mozilla/server-side-tls/issues/198</p> <p>See http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">1d</code></p> <h3 id="ssl_session_cache_size">ssl_session_cache_size</h3> <p>Sets the size of the caches that store session parameters</p> <p>See https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">10m</code></p> <h3 id="ssl_cert">ssl_cert</h3> <p>Comma-separated list of certificates for <code class="language-plaintext highlighter-rouge">proxy_listen</code> values with TLS enabled.</p> <p>If more than one certificates are specified, it can be used to provide alternate type of certificate (for example, ECC certificate) that will be served to clients that supports them. Note to properly serve using ECC certificates, it is recommended to also set <code class="language-plaintext highlighter-rouge">ssl_cipher_suite</code> to <code class="language-plaintext highlighter-rouge">modern</code> or <code class="language-plaintext highlighter-rouge">intermediate</code>.</p> <p>Unless this option is explicitly set, Kong will auto-generate a pair of default certificates (RSA + ECC) first time it starts up and use it for serving TLS requests.</p> <p>Certificates can be configured on this property with any of the following values:</p> <ul> <li>absolute path to the certificate</li> <li>certificate content</li> <li>base64 encoded certificate content</li> </ul> <p><strong>Default:</strong> none</p> <h3 id="ssl_cert_key">ssl_cert_key</h3> <p>Comma-separated list of keys for <code class="language-plaintext highlighter-rouge">proxy_listen</code> values with TLS enabled.</p> <p>If more than one certificate was specified for <code class="language-plaintext highlighter-rouge">ssl_cert</code>, then this option should contain the corresponding key for all certificates provided in the same order.</p> <p>Unless this option is explicitly set, Kong will auto-generate a pair of default private keys (RSA + ECC) first time it starts up and use it for serving TLS requests.</p> <p>Keys can be configured on this property with either of the following values:</p> <ul> <li>absolute path to the certificate key</li> <li>certificate key content</li> <li>base64 encoded certificate key content</li> </ul> <p><strong>Default:</strong> none</p> <h3 id="client_ssl">client_ssl</h3> <p>Determines if Nginx should attempt to send client-side TLS certificates and perform Mutual TLS Authentication with upstream service when proxying requests.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="client_ssl_cert">client_ssl_cert</h3> <p>If <code class="language-plaintext highlighter-rouge">client_ssl</code> is enabled, the client certificate for the <code class="language-plaintext highlighter-rouge">proxy_ssl_certificate</code> directive.</p> <p>This value can be overwritten dynamically with the <code class="language-plaintext highlighter-rouge">client_certificate</code> attribute of the <code class="language-plaintext highlighter-rouge">Service</code> object.</p> <p>The certificate can be configured on this property with any of the following values:</p> <ul> <li>absolute path to the certificate</li> <li>certificate content</li> <li>base64 encoded certificate content</li> </ul> <p><strong>Default:</strong> none</p> <h3 id="client_ssl_cert_key">client_ssl_cert_key</h3> <p>If <code class="language-plaintext highlighter-rouge">client_ssl</code> is enabled, the client TLS key for the <code class="language-plaintext highlighter-rouge">proxy_ssl_certificate_key</code> directive.</p> <p>This value can be overwritten dynamically with the <code class="language-plaintext highlighter-rouge">client_certificate</code> attribute of the <code class="language-plaintext highlighter-rouge">Service</code> object.</p> <p>The certificate key can be configured on this property with any of the following values:</p> <ul> <li>absolute path to the certificate key</li> <li>certificate key content</li> <li>base64 encoded certificate key content</li> </ul> <p><strong>Default:</strong> none</p> <h3 id="admin_ssl_cert">admin_ssl_cert</h3> <p>Comma-separated list of certificates for <code class="language-plaintext highlighter-rouge">admin_listen</code> values with TLS enabled.</p> <p>See docs for <code class="language-plaintext highlighter-rouge">ssl_cert</code> for detailed usage.</p> <p><strong>Default:</strong> none</p> <h3 id="admin_ssl_cert_key">admin_ssl_cert_key</h3> <p>Comma-separated list of keys for <code class="language-plaintext highlighter-rouge">admin_listen</code> values with TLS enabled.</p> <p>See docs for <code class="language-plaintext highlighter-rouge">ssl_cert_key</code> for detailed usage.</p> <p><strong>Default:</strong> none</p> <h3 id="status_ssl_cert">status_ssl_cert</h3> <p>Comma-separated list of certificates for <code class="language-plaintext highlighter-rouge">status_listen</code> values with TLS enabled.</p> <p>See docs for <code class="language-plaintext highlighter-rouge">ssl_cert</code> for detailed usage.</p> <p><strong>Default:</strong> none</p> <h3 id="status_ssl_cert_key">status_ssl_cert_key</h3> <p>Comma-separated list of keys for <code class="language-plaintext highlighter-rouge">status_listen</code> values with TLS enabled.</p> <p>See docs for <code class="language-plaintext highlighter-rouge">ssl_cert_key</code> for detailed usage.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="debug_ssl_cert">debug_ssl_cert</h3> <p>Comma-separated list of certificates for <code class="language-plaintext highlighter-rouge">debug_listen</code> values with TLS enabled.</p> <p>See docs for <code class="language-plaintext highlighter-rouge">ssl_cert</code> for detailed usage.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="debug_ssl_cert_key">debug_ssl_cert_key</h3> <p>Comma-separated list of keys for <code class="language-plaintext highlighter-rouge">debug_listen</code> values with TLS enabled.</p> <p>See docs for <code class="language-plaintext highlighter-rouge">ssl_cert_key</code> for detailed usage.</p> <p><strong>Default:</strong> none</p> <h3 id="headers">headers</h3> <p>Comma-separated list of headers Kong should inject in client responses.</p> <p>Accepted values are:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">Server</code>: Injects <code class="language-plaintext highlighter-rouge">Server: kong/x.y.z</code> on Kong-produced response (e.g. Admin API, rejected requests from auth plugin).</li> <li> <code class="language-plaintext highlighter-rouge">Via</code>: Injects <code class="language-plaintext highlighter-rouge">Via: kong/x.y.z</code> for successfully proxied requests.</li> <li> <code class="language-plaintext highlighter-rouge">X-Kong-Proxy-Latency</code>: Time taken (in milliseconds) by Kong to process a request and run all plugins before proxying the request upstream.</li> <li> <code class="language-plaintext highlighter-rouge">X-Kong-Response-Latency</code>: time taken (in millisecond) by Kong to produce a response in case of e.g. plugin short-circuiting the request, or in in case of an error.</li> <li> <code class="language-plaintext highlighter-rouge">X-Kong-Upstream-Latency</code>: Time taken (in milliseconds) by the upstream service to send response headers.</li> <li> <code class="language-plaintext highlighter-rouge">X-Kong-Admin-Latency</code>: Time taken (in milliseconds) by Kong to process an Admin API request.</li> <li> <code class="language-plaintext highlighter-rouge">X-Kong-Upstream-Status</code>: The HTTP status code returned by the upstream service. This is particularly useful for clients to distinguish upstream statuses if the response is rewritten by a plugin.</li> <li> <code class="language-plaintext highlighter-rouge">server_tokens</code>: Same as specifying both <code class="language-plaintext highlighter-rouge">Server</code> and <code class="language-plaintext highlighter-rouge">Via</code>.</li> <li> <code class="language-plaintext highlighter-rouge">latency_tokens</code>: Same as specifying <code class="language-plaintext highlighter-rouge">X-Kong-Proxy-Latency</code>, <code class="language-plaintext highlighter-rouge">X-Kong-Response-Latency</code>, <code class="language-plaintext highlighter-rouge">X-Kong-Admin-Latency</code> and <code class="language-plaintext highlighter-rouge">X-Kong-Upstream-Latency</code> </li> </ul> <p>In addition to those, this value can be set to <code class="language-plaintext highlighter-rouge">off</code>, which prevents Kong from injecting any of the above headers. Note that this does not prevent plugins from injecting headers of their own.</p> <p>Example: <code class="language-plaintext highlighter-rouge">headers = via, latency_tokens</code></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">server_tokens, latency_tokens</code></p> <h3 id="trusted_ips">trusted_ips</h3> <p>Defines trusted IP addresses blocks that are known to send correct <code class="language-plaintext highlighter-rouge">X-Forwarded-*</code> headers.</p> <p>Requests from trusted IPs make Kong forward their <code class="language-plaintext highlighter-rouge">X-Forwarded-*</code> headers upstream.</p> <p>Non-trusted requests make Kong insert its own <code class="language-plaintext highlighter-rouge">X-Forwarded-*</code> headers.</p> <p>This property also sets the <code class="language-plaintext highlighter-rouge">set_real_ip_from</code> directive(s) in the Nginx configuration. It accepts the same type of values (CIDR blocks) but as a comma-separated list.</p> <p>To trust <em>all</em> /!\ IPs, set this value to <code class="language-plaintext highlighter-rouge">0.0.0.0/0,::/0</code>.</p> <p>If the special value <code class="language-plaintext highlighter-rouge">unix:</code> is specified, all UNIX-domain sockets will be trusted.</p> <p>See http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from for examples of accepted values.</p> <p><strong>Default:</strong> none</p> <h3 id="real_ip_header">real_ip_header</h3> <p>Defines the request header field whose value will be used to replace the client address.</p> <p>This value sets the <code class="language-plaintext highlighter-rouge">ngx_http_realip_module</code> directive of the same name in the Nginx configuration.</p> <p>If this value receives <code class="language-plaintext highlighter-rouge">proxy_protocol</code>:</p> <ul> <li>at least one of the <code class="language-plaintext highlighter-rouge">proxy_listen</code> entries must have the <code class="language-plaintext highlighter-rouge">proxy_protocol</code> flag enabled.</li> <li>the <code class="language-plaintext highlighter-rouge">proxy_protocol</code> parameter will be appended to the <code class="language-plaintext highlighter-rouge">listen</code> directive of the Nginx template.</li> </ul> <p>See http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header for a description of this directive.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">X-Real-IP</code></p> <h3 id="real_ip_recursive">real_ip_recursive</h3> <p>This value sets the <code class="language-plaintext highlighter-rouge">ngx_http_realip_module</code> directive of the same name in the Nginx configuration.</p> <p>See http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive for a description of this directive.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="error_default_type">error_default_type</h3> <p>Default MIME type to use when the request <code class="language-plaintext highlighter-rouge">Accept</code> header is missing and Nginx is returning an error for the request.</p> <p>Accepted values are <code class="language-plaintext highlighter-rouge">text/plain</code>, <code class="language-plaintext highlighter-rouge">text/html</code>, <code class="language-plaintext highlighter-rouge">application/json</code>, and <code class="language-plaintext highlighter-rouge">application/xml</code>.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">text/plain</code></p> <h3 id="upstream_keepalive_pool_size">upstream_keepalive_pool_size</h3> <p>Sets the default size of the upstream keepalive connection pools.</p> <p>Upstream keepalive connection pools are segmented by the <code class="language-plaintext highlighter-rouge">dst ip/dst port/SNI</code> attributes of a connection.</p> <p>A value of <code class="language-plaintext highlighter-rouge">0</code> will disable upstream keepalive connections by default, forcing each upstream request to open a new connection.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">60</code></p> <h3 id="upstream_keepalive_max_requests">upstream_keepalive_max_requests</h3> <p>Sets the default maximum number of requests than can be proxied upstream through one keepalive connection.</p> <p>After the maximum number of requests is reached, the connection will be closed.</p> <p>A value of <code class="language-plaintext highlighter-rouge">0</code> will disable this behavior, and a keepalive connection can be used to proxy an indefinite number of requests.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">100</code></p> <h3 id="upstream_keepalive_idle_timeout">upstream_keepalive_idle_timeout</h3> <p>Sets the default timeout (in seconds) for which an upstream keepalive connection should be kept open. When the timeout is reached while the connection has not been reused, it will be closed.</p> <p>A value of <code class="language-plaintext highlighter-rouge">0</code> will disable this behavior, and an idle keepalive connection may be kept open indefinitely.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">60</code></p> <h3 id="allow_debug_header">allow_debug_header</h3> <p>Enable the <code class="language-plaintext highlighter-rouge">Kong-Debug</code> header function.</p> <p>If it is <code class="language-plaintext highlighter-rouge">on</code>, kong will add <code class="language-plaintext highlighter-rouge">Kong-Route-Id</code> <code class="language-plaintext highlighter-rouge">Kong-Route-Name</code> <code class="language-plaintext highlighter-rouge">Kong-Service-Id</code> <code class="language-plaintext highlighter-rouge">Kong-Service-Name</code> debug headers to response when the client request header <code class="language-plaintext highlighter-rouge">Kong-Debug: 1</code> is present.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <hr> <h2 id="nginx-injected-directives-section">NGINX Injected Directives section</h2> <p>Nginx directives can be dynamically injected in the runtime nginx.conf file without requiring a custom Nginx configuration template.</p> <p>All configuration properties respecting the naming scheme <code class="language-plaintext highlighter-rouge">nginx_<namespace>_<directive></code> will result in <code class="language-plaintext highlighter-rouge"><directive></code> being injected in the Nginx configuration block corresponding to the property’s <code class="language-plaintext highlighter-rouge"><namespace></code>.</p> <p>Example: <code class="language-plaintext highlighter-rouge">nginx_proxy_large_client_header_buffers = 8 24k</code></p> <p>Will inject the following directive in Kong’s proxy <code class="language-plaintext highlighter-rouge">server {}</code> block:</p> <p><code class="language-plaintext highlighter-rouge">large_client_header_buffers 8 24k;</code></p> <p>The following namespaces are supported:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">nginx_main_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s configuration <code class="language-plaintext highlighter-rouge">main</code> context.</li> <li> <code class="language-plaintext highlighter-rouge">nginx_events_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s <code class="language-plaintext highlighter-rouge">events {}</code> block.</li> <li> <code class="language-plaintext highlighter-rouge">nginx_http_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s <code class="language-plaintext highlighter-rouge">http {}</code> block.</li> <li> <code class="language-plaintext highlighter-rouge">nginx_proxy_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s proxy <code class="language-plaintext highlighter-rouge">server {}</code> block.</li> <li> <code class="language-plaintext highlighter-rouge">nginx_upstream_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s proxy <code class="language-plaintext highlighter-rouge">upstream {}</code> block.</li> <li> <code class="language-plaintext highlighter-rouge">nginx_admin_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s Admin API <code class="language-plaintext highlighter-rouge">server {}</code> block.</li> <li> <code class="language-plaintext highlighter-rouge">nginx_status_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s Status API <code class="language-plaintext highlighter-rouge">server {}</code> block (only effective if <code class="language-plaintext highlighter-rouge">status_listen</code> is enabled).</li> <li> <code class="language-plaintext highlighter-rouge">nginx_debug_<directive></code> <span class="badge enterprise"></span>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s Debug API <code class="language-plaintext highlighter-rouge">server {}</code> block (only effective if <code class="language-plaintext highlighter-rouge">debug_listen</code> is enabled).</li> <li> <code class="language-plaintext highlighter-rouge">nginx_stream_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s stream module <code class="language-plaintext highlighter-rouge">stream {}</code> block (only effective if <code class="language-plaintext highlighter-rouge">stream_listen</code> is enabled).</li> <li> <code class="language-plaintext highlighter-rouge">nginx_sproxy_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s stream module <code class="language-plaintext highlighter-rouge">server {}</code> block (only effective if <code class="language-plaintext highlighter-rouge">stream_listen</code> is enabled).</li> <li> <code class="language-plaintext highlighter-rouge">nginx_supstream_<directive></code>: Injects <code class="language-plaintext highlighter-rouge"><directive></code> in Kong’s stream module <code class="language-plaintext highlighter-rouge">upstream {}</code> block.</li> </ul> <p>As with other configuration properties, Nginx directives can be injected via environment variables when capitalized and prefixed with <code class="language-plaintext highlighter-rouge">KONG_</code>.</p> <p>Example: <code class="language-plaintext highlighter-rouge">KONG_NGINX_HTTP_SSL_PROTOCOLS</code> -> <code class="language-plaintext highlighter-rouge">nginx_http_ssl_protocols</code></p> <p>Will inject the following directive in Kong’s <code class="language-plaintext highlighter-rouge">http {}</code> block:</p> <p><code class="language-plaintext highlighter-rouge">ssl_protocols <value>;</code></p> <p>If different sets of protocols are desired between the proxy and Admin API server, you may specify <code class="language-plaintext highlighter-rouge">nginx_proxy_ssl_protocols</code> and/or <code class="language-plaintext highlighter-rouge">nginx_admin_ssl_protocols</code>, both of which taking precedence over the <code class="language-plaintext highlighter-rouge">http {}</code> block.</p> <h3 id="nginx_main_worker_rlimit_nofile">nginx_main_worker_rlimit_nofile</h3> <p>Changes the limit on the maximum number of open files for worker processes.</p> <p>The special and default value of <code class="language-plaintext highlighter-rouge">auto</code> sets this value to <code class="language-plaintext highlighter-rouge">ulimit -n</code> with the upper bound limited to 16384 as a measure to protect against excess memory use, and the lower bound of 1024 as a good default.</p> <p>See http://nginx.org/en/docs/ngx_core_module.html#worker_rlimit_nofile</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">auto</code></p> <h3 id="nginx_events_worker_connections">nginx_events_worker_connections</h3> <p>Sets the maximum number of simultaneous connections that can be opened by a worker process.</p> <p>The special and default value of <code class="language-plaintext highlighter-rouge">auto</code> sets this value to <code class="language-plaintext highlighter-rouge">ulimit -n</code> with the upper bound limited to 16384 as a measure to protect against excess memory use, and the lower bound of 1024 as a good default.</p> <p>See http://nginx.org/en/docs/ngx_core_module.html#worker_connections</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">auto</code></p> <h3 id="nginx_http_client_header_buffer_size">nginx_http_client_header_buffer_size</h3> <p>Sets buffer size for reading the client request headers.</p> <p>See http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">1k</code></p> <h3 id="nginx_http_large_client_header_buffers">nginx_http_large_client_header_buffers</h3> <p>Sets the maximum number and size of buffers used for reading large clients requests headers.</p> <p>See http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">4 8k</code></p> <h3 id="nginx_http_client_max_body_size">nginx_http_client_max_body_size</h3> <p>Defines the maximum request body size allowed by requests proxied by Kong, specified in the Content-Length request header. If a request exceeds this limit, Kong will respond with a 413 (Request Entity Too Large). Setting this value to 0 disables checking the request body size.</p> <p>See http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0</code></p> <h3 id="nginx_admin_client_max_body_size">nginx_admin_client_max_body_size</h3> <p>Defines the maximum request body size for Admin API.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">10m</code></p> <h3 id="nginx_http_charset">nginx_http_charset</h3> <p>Adds the specified charset to the “Content-Type” response header field. If this charset is different from the charset specified in the source_charset directive, a conversion is performed.</p> <p>The parameter <code class="language-plaintext highlighter-rouge">off</code> cancels the addition of charset to the “Content-Type” response header field.</p> <p>See http://nginx.org/en/docs/http/ngx_http_charset_module.html#charset</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">UTF-8</code></p> <h3 id="nginx_http_client_body_buffer_size">nginx_http_client_body_buffer_size</h3> <p>Defines the buffer size for reading the request body. If the client request body is larger than this value, the body will be buffered to disk. Note that when the body is buffered to disk, Kong plugins that access or manipulate the request body may not work, so it is advisable to set this value as high as possible (e.g., set it as high as <code class="language-plaintext highlighter-rouge">client_max_body_size</code> to force request bodies to be kept in memory). Do note that high-concurrency environments will require significant memory allocations to process many concurrent large request bodies.</p> <p>See http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">8k</code></p> <h3 id="nginx_admin_client_body_buffer_size">nginx_admin_client_body_buffer_size</h3> <p>Defines the buffer size for reading the request body on Admin API.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">10m</code></p> <h3 id="nginx_http_lua_regex_match_limit">nginx_http_lua_regex_match_limit</h3> <p>Global <code class="language-plaintext highlighter-rouge">MATCH_LIMIT</code> for PCRE regex matching. The default of <code class="language-plaintext highlighter-rouge">100000</code> should ensure at worst any regex Kong executes could finish within roughly 2 seconds.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">100000</code></p> <h3 id="nginx_http_lua_regex_cache_max_entries">nginx_http_lua_regex_cache_max_entries</h3> <p>Specifies the maximum number of entries allowed in the worker process level compiled regex cache.</p> <p>It is recommended to set it to at least (number of regex paths * 2) to avoid high CPU usages.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">8192</code></p> <hr> <h2 id="datastore-section">Datastore section</h2> <p>Kong can run with a database to store coordinated data between Kong nodes in a cluster, or without a database, where each node stores its information independently in memory.</p> <p>When using a database, Kong will store data for all its entities (such as Routes, Services, Consumers, and Plugins) in a database, and all Kong nodes belonging to the same cluster must connect themselves to the same database.</p> <p>When not using a database, Kong is said to be in “DB-less mode”: it will keep its entities in memory, and each node needs to have this data entered via a declarative configuration file, which can be specified through the <code class="language-plaintext highlighter-rouge">declarative_config</code> property, or via the Admin API using the <code class="language-plaintext highlighter-rouge">/config</code> endpoint.</p> <p>When using Postgres as the backend storage, you can optionally enable Kong to serve read queries from a separate database instance.</p> <p>When the number of proxies is large, this can greatly reduce the load on the main Postgres instance and achieve better scalability. It may also reduce the latency jitter if the Kong proxy node’s latency to the main Postgres instance is high.</p> <p>The read-only Postgres instance only serves read queries and write queries still goes to the main connection. The read-only Postgres instance can be eventually consistent while replicating changes from the main instance.</p> <p>At least the <code class="language-plaintext highlighter-rouge">pg_ro_host</code> config is needed to enable this feature.</p> <p>By default, all other database config for the read-only connection are inherited from the corresponding main connection config described above but may be optionally overwritten explicitly using the <code class="language-plaintext highlighter-rouge">pg_ro_*</code> config below.</p> <h3 id="database">database</h3> <p>Determines the database (or no database) for this node. Accepted values are <code class="language-plaintext highlighter-rouge">postgres</code> and <code class="language-plaintext highlighter-rouge">off</code>.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">postgres</code></p> <h3 id="postgres-settings">Postgres settings</h3> <table> <thead> <tr> <th>name</th> <th>description</th> <th>default</th> </tr> </thead> <tbody> <tr> <td><strong>pg_host</strong></td> <td>Host of the Postgres server.</td> <td><code class="language-plaintext highlighter-rouge">127.0.0.1</code></td> </tr> <tr> <td><strong>pg_port</strong></td> <td>Port of the Postgres server.</td> <td><code class="language-plaintext highlighter-rouge">5432</code></td> </tr> <tr> <td><strong>pg_timeout</strong></td> <td>Defines the timeout (in ms), for connecting, reading and writing.</td> <td><code class="language-plaintext highlighter-rouge">5000</code></td> </tr> <tr> <td><strong>pg_user</strong></td> <td>Postgres user.</td> <td><code class="language-plaintext highlighter-rouge">kong</code></td> </tr> <tr> <td><strong>pg_password</strong></td> <td>Postgres user’s password.</td> <td>none</td> </tr> <tr> <td><strong>pg_database</strong></td> <td>The database name to connect to.</td> <td><code class="language-plaintext highlighter-rouge">kong</code></td> </tr> <tr> <td><strong>pg_schema</strong></td> <td>The database schema to use. If unspecified, Kong will respect the <code class="language-plaintext highlighter-rouge">search_path</code> value of your PostgreSQL instance.</td> <td>none</td> </tr> <tr> <td><strong>pg_ssl</strong></td> <td>Toggles client-server TLS connections between Kong and PostgreSQL. Because PostgreSQL uses the same port for TLS and non-TLS, this is only a hint. If the server does not support TLS, the established connection will be a plain one.</td> <td><code class="language-plaintext highlighter-rouge">off</code></td> </tr> <tr> <td><strong>pg_ssl_version</strong></td> <td>When using SSL between Kong and PostgreSQL, the version of TLS to use. Accepted values are <code class="language-plaintext highlighter-rouge">tlsv1_1</code>, <code class="language-plaintext highlighter-rouge">tlsv1_2</code>, <code class="language-plaintext highlighter-rouge">tlsv1_3</code>, or <code class="language-plaintext highlighter-rouge">any</code>. When <code class="language-plaintext highlighter-rouge">any</code> is set, the client negotiates the highest version with the server, which can’t be lower than <code class="language-plaintext highlighter-rouge">tlsv1_1</code>.</td> <td><code class="language-plaintext highlighter-rouge">tlsv1_2</code></td> </tr> <tr> <td><strong>pg_ssl_required</strong></td> <td>When <code class="language-plaintext highlighter-rouge">pg_ssl</code> is on this determines if TLS must be used between Kong and PostgreSQL. It aborts the connection if the server does not support SSL connections.</td> <td><code class="language-plaintext highlighter-rouge">off</code></td> </tr> <tr> <td><strong>pg_ssl_verify</strong></td> <td>Toggles server certificate verification if <code class="language-plaintext highlighter-rouge">pg_ssl</code> is enabled. See the <code class="language-plaintext highlighter-rouge">lua_ssl_trusted_certificate</code> setting to specify a certificate authority.</td> <td><code class="language-plaintext highlighter-rouge">off</code></td> </tr> <tr> <td><strong>pg_ssl_cert</strong></td> <td>The absolute path to the PEM encoded client TLS certificate for the PostgreSQL connection. Mutual TLS authentication against PostgreSQL is only enabled if this value is set.</td> <td>none</td> </tr> <tr> <td><strong>pg_ssl_cert_key</strong></td> <td>If <code class="language-plaintext highlighter-rouge">pg_ssl_cert</code> is set, the absolute path to the PEM encoded client TLS private key for the PostgreSQL connection.</td> <td>none</td> </tr> <tr> <td><strong>pg_max_concurrent_queries</strong></td> <td>Sets the maximum number of concurrent queries that can be executing at any given time. This limit is enforced per worker process; the total number of concurrent queries for this node will be will be: <code class="language-plaintext highlighter-rouge">pg_max_concurrent_queries * nginx_worker_processes</code>. The default value of 0 removes this concurrency limitation.</td> <td><code class="language-plaintext highlighter-rouge">0</code></td> </tr> <tr> <td><strong>pg_semaphore_timeout</strong></td> <td>Defines the timeout (in ms) after which PostgreSQL query semaphore resource acquisition attempts will fail. Such failures will generally result in the associated proxy or Admin API request failing with an HTTP 500 status code. Detailed discussion of this behavior is available in the online documentation.</td> <td><code class="language-plaintext highlighter-rouge">60000</code></td> </tr> <tr> <td><strong>pg_keepalive_timeout</strong></td> <td>Specify the maximal idle timeout (in ms) for the postgres connections in the pool. If this value is set to 0 then the timeout interval is unlimited. If not specified this value will be same as <code class="language-plaintext highlighter-rouge">lua_socket_keepalive_timeout</code> </td> <td>none</td> </tr> <tr> <td><strong>pg_pool_size</strong></td> <td>Specifies the size limit (in terms of connection count) for the Postgres server. Note that this connection pool is intended per Nginx worker rather than per Kong instance. If not specified, the default value is the same as <code class="language-plaintext highlighter-rouge">lua_socket_pool_size</code> </td> <td>none</td> </tr> <tr> <td><strong>pg_backlog</strong></td> <td>If specified, this value will limit the total number of open connections to the Postgres server to <code class="language-plaintext highlighter-rouge">pg_pool_size</code>. If the connection pool is full, subsequent connect operations will be inserted in a queue with size equal to this option’s value. If the number of queued connect operations reaches <code class="language-plaintext highlighter-rouge">pg_backlog</code>, exceeding connections will fail. If not specified, then number of open connections to the Postgres server is not limited.</td> <td>none</td> </tr> <tr> <td><strong>pg_ro_host</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_host</code>, but for the read-only connection. <strong>Note:</strong> Refer to the documentation section above for detailed usage.</td> <td>none</td> </tr> <tr> <td><strong>pg_ro_port</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_port</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_port></code></td> </tr> <tr> <td><strong>pg_ro_timeout</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_timeout</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_timeout></code></td> </tr> <tr> <td><strong>pg_ro_user</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_user</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_user></code></td> </tr> <tr> <td><strong>pg_ro_password</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_password</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_password></code></td> </tr> <tr> <td><strong>pg_ro_database</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_database</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_database></code></td> </tr> <tr> <td><strong>pg_ro_schema</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_schema</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_schema></code></td> </tr> <tr> <td><strong>pg_ro_ssl</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_ssl</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_ssl></code></td> </tr> <tr> <td><strong>pg_ro_ssl_required</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_ssl_required</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_ssl_required></code></td> </tr> <tr> <td><strong>pg_ro_ssl_verify</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_ssl_verify</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_ssl_verify></code></td> </tr> <tr> <td><strong>pg_ro_ssl_version</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_ssl_version</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_ssl_version></code></td> </tr> <tr> <td><strong>pg_ro_max_concurrent_queries</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_max_concurrent_queries</code>, but for the read-only connection. Note: read-only concurrency is not shared with the main (read-write) connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_max_concurrent_queries></code></td> </tr> <tr> <td><strong>pg_ro_semaphore_timeout</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_semaphore_timeout</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_semaphore_timeout></code></td> </tr> <tr> <td><strong>pg_ro_keepalive_timeout</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_keepalive_timeout</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_keepalive_timeout></code></td> </tr> <tr> <td><strong>pg_ro_pool_size</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_pool_size</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_pool_size></code></td> </tr> <tr> <td><strong>pg_ro_backlog</strong></td> <td>Same as <code class="language-plaintext highlighter-rouge">pg_backlog</code>, but for the read-only connection.</td> <td><code class="language-plaintext highlighter-rouge"><pg_backlog></code></td> </tr> </tbody> </table> <h3 id="cassandra-settings">Cassandra settings</h3> <blockquote class="warning no-icon"> <p><strong>Deprecation warning:</strong> Cassandra as a backend database for Kong Gateway is deprecated. Support for Cassandra will be removed in a future release. <br> Our target for Cassandra removal is the Kong Gateway 3.4 release. Starting with the Kong Gateway 3.0 release, some new features might not be supported with Cassandra.</p> </blockquote> <table> <thead> <tr> <th>name</th> <th>description</th> <th>default</th> </tr> </thead> <tbody> <tr> <td><strong>cassandra_contact_points</strong></td> <td>A comma-separated list of contact points to your cluster. You may specify IP addresses or hostnames. Note that the port component of SRV records will be ignored in favor of <code class="language-plaintext highlighter-rouge">cassandra_port</code>. When connecting to a multi-DC cluster, ensure that contact points from the local datacenter are specified first in this list.</td> <td><code class="language-plaintext highlighter-rouge">127.0.0.1</code></td> </tr> <tr> <td><strong>cassandra_port</strong></td> <td>The port on which your nodes are listening on. All your nodes and contact points must listen on the same port. Will be created if it doesn’t exist.</td> <td><code class="language-plaintext highlighter-rouge">9042</code></td> </tr> <tr> <td><strong>cassandra_keyspace</strong></td> <td>The keyspace to use in your cluster.</td> <td><code class="language-plaintext highlighter-rouge">kong</code></td> </tr> <tr> <td><strong>cassandra_write_consistency</strong></td> <td>Consistency setting to use when writing to the Cassandra cluster.</td> <td><code class="language-plaintext highlighter-rouge">ONE</code></td> </tr> <tr> <td><strong>cassandra_read_consistency</strong></td> <td>Consistency setting to use when reading from the Cassandra cluster.</td> <td><code class="language-plaintext highlighter-rouge">ONE</code></td> </tr> <tr> <td><strong>cassandra_timeout</strong></td> <td>Defines the timeout (in ms) for reading and writing.</td> <td><code class="language-plaintext highlighter-rouge">5000</code></td> </tr> <tr> <td><strong>cassandra_ssl</strong></td> <td>Toggles client-to-node TLS connections between Kong and Cassandra.</td> <td><code class="language-plaintext highlighter-rouge">off</code></td> </tr> <tr> <td><strong>cassandra_ssl_verify</strong></td> <td>Toggles server certificate verification if <code class="language-plaintext highlighter-rouge">cassandra_ssl</code> is enabled. See the <code class="language-plaintext highlighter-rouge">lua_ssl_trusted_certificate</code> setting to specify a certificate authority.</td> <td><code class="language-plaintext highlighter-rouge">off</code></td> </tr> <tr> <td><strong>cassandra_username</strong></td> <td>Username when using the <code class="language-plaintext highlighter-rouge">PasswordAuthenticator</code> scheme.</td> <td><code class="language-plaintext highlighter-rouge">kong</code></td> </tr> <tr> <td><strong>cassandra_password</strong></td> <td>Password when using the <code class="language-plaintext highlighter-rouge">PasswordAuthenticator</code> scheme.</td> <td>none</td> </tr> <tr> <td><strong>cassandra_lb_policy</strong></td> <td>Load balancing policy to use when distributing queries across your Cassandra cluster. Accepted values are: <code class="language-plaintext highlighter-rouge">RoundRobin</code>, <code class="language-plaintext highlighter-rouge">RequestRoundRobin</code>, <code class="language-plaintext highlighter-rouge">DCAwareRoundRobin</code>, and <code class="language-plaintext highlighter-rouge">RequestDCAwareRoundRobin</code>. Policies prefixed with “Request” make efficient use of established connections throughout the same request. Prefer “DCAware” policies if and only if you are using a multi-datacenter cluster.</td> <td><code class="language-plaintext highlighter-rouge">RequestRoundRobin</code></td> </tr> <tr> <td><strong>cassandra_local_datacenter</strong></td> <td>When using the <code class="language-plaintext highlighter-rouge">DCAwareRoundRobin</code> or <code class="language-plaintext highlighter-rouge">RequestDCAwareRoundRobin</code> load balancing policy, you must specify the name of the local (closest) datacenter for this Kong node.</td> <td>none</td> </tr> <tr> <td><strong>cassandra_refresh_frequency</strong></td> <td>Frequency (in seconds) at which the cluster topology will be checked for new or decommissioned nodes. A value of <code class="language-plaintext highlighter-rouge">0</code> will disable this check, and the cluster topology will never be refreshed.</td> <td><code class="language-plaintext highlighter-rouge">60</code></td> </tr> <tr> <td><strong>cassandra_repl_strategy</strong></td> <td>When migrating for the first time, Kong will use this setting to create your keyspace. Accepted values are <code class="language-plaintext highlighter-rouge">SimpleStrategy</code> and <code class="language-plaintext highlighter-rouge">NetworkTopologyStrategy</code>.</td> <td><code class="language-plaintext highlighter-rouge">SimpleStrategy</code></td> </tr> <tr> <td><strong>cassandra_repl_factor</strong></td> <td>When migrating for the first time, Kong will create the keyspace with this replication factor when using the <code class="language-plaintext highlighter-rouge">SimpleStrategy</code>.</td> <td><code class="language-plaintext highlighter-rouge">1</code></td> </tr> <tr> <td><strong>cassandra_data_centers</strong></td> <td>When migrating for the first time, will use this setting when using the <code class="language-plaintext highlighter-rouge">NetworkTopologyStrategy</code>. The format is a comma-separated list made of <code class="language-plaintext highlighter-rouge"><dc_name>:<repl_factor></code>.</td> <td><code class="language-plaintext highlighter-rouge">dc1:2,dc2:3</code></td> </tr> <tr> <td><strong>cassandra_schema_consensus_timeout</strong></td> <td>Defines the timeout (in ms) for the waiting period to reach a schema consensus between your Cassandra nodes. This value is only used during migrations.</td> <td><code class="language-plaintext highlighter-rouge">10000</code></td> </tr> </tbody> </table> <h3 id="declarative_config">declarative_config</h3> <p>The path to the declarative configuration file which holds the specification of all entities (Routes, Services, Consumers, etc.) to be used when the <code class="language-plaintext highlighter-rouge">database</code> is set to <code class="language-plaintext highlighter-rouge">off</code>.</p> <p>Entities are stored in Kong’s in-memory cache, so you must ensure that enough memory is allocated to it via the <code class="language-plaintext highlighter-rouge">mem_cache_size</code> property. You must also ensure that items in the cache never expire, which means that <code class="language-plaintext highlighter-rouge">db_cache_ttl</code> should preserve its default value of 0.</p> <p>If the Hybrid mode <code class="language-plaintext highlighter-rouge">role</code> is set to <code class="language-plaintext highlighter-rouge">data_plane</code> and there’s no configuration cache file, this configuration is used before connecting to the Control Plane node as a user-controlled fallback.</p> <p><strong>Default:</strong> none</p> <h3 id="declarative_config_string">declarative_config_string</h3> <p>The declarative configuration as a string</p> <p><strong>Default:</strong> none</p> <h3 id="declarative_config_encryption_mode">declarative_config_encryption_mode</h3> <p>Set encryption of the declarative config mapped file on filesystem.</p> <p><code class="language-plaintext highlighter-rouge">aes-256-gcm</code> = Use AES-256-GCM to encrypt <code class="language-plaintext highlighter-rouge">chacha20-poly1305</code> = Use chacha20-poly1305 to encrypt <code class="language-plaintext highlighter-rouge">off</code> = does not encrypt</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="lmdb_environment_path">lmdb_environment_path</h3> <p>Directory where the LMDB database files used by DB-less and Hybrid mode to store Kong configurations reside.</p> <p>This path is relative under the Kong <code class="language-plaintext highlighter-rouge">prefix</code>.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">dbless.lmdb</code></p> <h3 id="lmdb_map_size">lmdb_map_size</h3> <p>Maximum size of the LMDB memory map, used to store the DB-less and Hybird mode configurations. Default is 128m.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">128m</code></p> <hr> <h2 id="datastore-cache-section">Datastore Cache section</h2> <p>In order to avoid unnecessary communication with the datastore, Kong caches entities (such as APIs, Consumers, Credentials…) for a configurable period of time. It also handles invalidations if such an entity is updated.</p> <p>This section allows for configuring the behavior of Kong regarding the caching of such configuration entities.</p> <h3 id="db_update_frequency">db_update_frequency</h3> <p>Frequency (in seconds) at which to check for updated entities with the datastore.</p> <p>When a node creates, updates, or deletes an entity via the Admin API, other nodes need to wait for the next poll (configured by this value) to eventually purge the old cached entity and start using the new one.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">5</code></p> <h3 id="db_update_propagation">db_update_propagation</h3> <p>Time (in seconds) taken for an entity in the datastore to be propagated to replica nodes of another datacenter.</p> <p>When in a distributed environment such as a multi-datacenter Cassandra cluster, this value should be the maximum number of seconds taken by Cassandra to propagate a row to other datacenters.</p> <p>When set, this property will increase the time taken by Kong to propagate the change of an entity.</p> <p>Single-datacenter setups or PostgreSQL servers should suffer no such delays, and this value can be safely set to 0.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0</code></p> <h3 id="db_cache_ttl">db_cache_ttl</h3> <p>Time-to-live (in seconds) of an entity from the datastore when cached by this node.</p> <p>Database misses (no entity) are also cached according to this setting if you do not configure <code class="language-plaintext highlighter-rouge">db_cache_neg_ttl</code>.</p> <p>If set to 0 (default), such cached entities or misses never expire.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0</code></p> <h3 id="db_cache_neg_ttl">db_cache_neg_ttl</h3> <p>Time-to-live (in seconds) of a datastore miss (no entity).</p> <p>If not specified (default), <code class="language-plaintext highlighter-rouge">db_cache_ttl</code> value will be used instead.</p> <p>If set to 0, misses will never expire.</p> <p><strong>Default:</strong> none</p> <h3 id="db_resurrect_ttl">db_resurrect_ttl</h3> <p>Time (in seconds) for which stale entities from the datastore should be resurrected for when they cannot be refreshed (e.g., the datastore is unreachable). When this TTL expires, a new attempt to refresh the stale entities will be made.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">30</code></p> <h3 id="db_cache_warmup_entities">db_cache_warmup_entities</h3> <p>Entities to be pre-loaded from the datastore into the in-memory cache at Kong start-up.</p> <p>This speeds up the first access of endpoints that use the given entities.</p> <p>When the <code class="language-plaintext highlighter-rouge">services</code> entity is configured for warmup, the DNS entries for values in its <code class="language-plaintext highlighter-rouge">host</code> attribute are pre-resolved asynchronously as well.</p> <p>Cache size set in <code class="language-plaintext highlighter-rouge">mem_cache_size</code> should be set to a value large enough to hold all instances of the specified entities.</p> <p>If the size is insufficient, Kong will log a warning.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">services</code></p> <hr> <h2 id="dns-resolver-section">DNS Resolver section</h2> <p>By default, the DNS resolver will use the standard configuration files <code class="language-plaintext highlighter-rouge">/etc/hosts</code> and <code class="language-plaintext highlighter-rouge">/etc/resolv.conf</code>. The settings in the latter file will be overridden by the environment variables <code class="language-plaintext highlighter-rouge">LOCALDOMAIN</code> and <code class="language-plaintext highlighter-rouge">RES_OPTIONS</code> if they have been set.</p> <p>Kong will resolve hostnames as either <code class="language-plaintext highlighter-rouge">SRV</code> or <code class="language-plaintext highlighter-rouge">A</code> records (in that order, and <code class="language-plaintext highlighter-rouge">CNAME</code> records will be dereferenced in the process).</p> <p>In case a name was resolved as an <code class="language-plaintext highlighter-rouge">SRV</code> record it will also override any given port number by the <code class="language-plaintext highlighter-rouge">port</code> field contents received from the DNS server.</p> <p>The DNS options <code class="language-plaintext highlighter-rouge">SEARCH</code> and <code class="language-plaintext highlighter-rouge">NDOTS</code> (from the <code class="language-plaintext highlighter-rouge">/etc/resolv.conf</code> file) will be used to expand short names to fully qualified ones. So it will first try the entire <code class="language-plaintext highlighter-rouge">SEARCH</code> list for the <code class="language-plaintext highlighter-rouge">SRV</code> type, if that fails it will try the <code class="language-plaintext highlighter-rouge">SEARCH</code> list for <code class="language-plaintext highlighter-rouge">A</code>, etc.</p> <p>For the duration of the <code class="language-plaintext highlighter-rouge">ttl</code>, the internal DNS resolver will loadbalance each request it gets over the entries in the DNS record. For <code class="language-plaintext highlighter-rouge">SRV</code> records the <code class="language-plaintext highlighter-rouge">weight</code> fields will be honored, but it will only use the lowest <code class="language-plaintext highlighter-rouge">priority</code> field entries in the record.</p> <h3 id="dns_resolver">dns_resolver</h3> <p>Comma separated list of nameservers, each entry in <code class="language-plaintext highlighter-rouge">ip[:port]</code> format to be used by Kong. If not specified the nameservers in the local <code class="language-plaintext highlighter-rouge">resolv.conf</code> file will be used.</p> <p>Port defaults to 53 if omitted. Accepts both IPv4 and IPv6 addresses.</p> <p><strong>Default:</strong> none</p> <h3 id="dns_hostsfile">dns_hostsfile</h3> <p>The hosts file to use. This file is read once and its content is static in memory.</p> <p>To read the file again after modifying it, Kong must be reloaded.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">/etc/hosts</code></p> <h3 id="dns_order">dns_order</h3> <p>The order in which to resolve different record types. The <code class="language-plaintext highlighter-rouge">LAST</code> type means the type of the last successful lookup (for the specified name). The format is a (case insensitive) comma separated list.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">LAST,SRV,A,CNAME</code></p> <h3 id="dns_valid_ttl">dns_valid_ttl</h3> <p>By default, DNS records are cached using the TTL value of a response. If this property receives a value (in seconds), it will override the TTL for all records.</p> <p><strong>Default:</strong> none</p> <h3 id="dns_stale_ttl">dns_stale_ttl</h3> <p>Defines, in seconds, how long a record will remain in cache past its TTL. This value will be used while the new DNS record is fetched in the background.</p> <p>Stale data will be used from expiry of a record until either the refresh query completes, or the <code class="language-plaintext highlighter-rouge">dns_stale_ttl</code> number of seconds have passed.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">4</code></p> <h3 id="dns_cache_size">dns_cache_size</h3> <p>Defines the maximum allowed number of DNS records stored in memory cache.</p> <p>Least recently used DNS records are discarded from cache if it is full. Both errors and data are cached, therefore a single name query can easily take up 10-15 slots.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">10000</code></p> <h3 id="dns_not_found_ttl">dns_not_found_ttl</h3> <p>TTL in seconds for empty DNS responses and “(3) name error” responses.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">30</code></p> <h3 id="dns_error_ttl">dns_error_ttl</h3> <p>TTL in seconds for error responses.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">1</code></p> <h3 id="dns_no_sync">dns_no_sync</h3> <p>If enabled, then upon a cache-miss every request will trigger its own dns query.</p> <p>When disabled multiple requests for the same name/type will be synchronised to a single query.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <hr> <h2 id="vaults-section">Vaults section</h2> <p>A secret is any sensitive piece of information required for API gateway operations. Secrets may be part of the core Kong Gateway configuration, used in plugins, or part of the configuration associated with APIs serviced by the gateway.</p> <p>Some of the most common types of secrets used by Kong Gateway include:</p> <ul> <li>Data store usernames and passwords, used with PostgreSQL and Redis</li> <li>Private X.509 certificates</li> <li>API keys</li> </ul> <p>Sensitive plugin configuration fields are generally used for authentication, hashing, signing, or encryption. Kong Gateway lets you store certain values in a vault. Here are the vault specific configuration options.</p> <hr> <h3 id="vault_env_prefix">vault_env_prefix</h3> <p>Defines the environment variable vault’s default prefix. For example if you have all your secrets stored in environment variables prefixed with <code class="language-plaintext highlighter-rouge">SECRETS_</code>, it can be configured here so that it isn’t necessary to repeat them in Vault references.</p> <p>Default: none</p> <hr> <h3 class="badge enterprise" id="vault_aws_region">vault_aws_region</h3> <p>The AWS region your vault is located in.</p> <p>Default: none</p> <hr> <h3 class="badge enterprise" id="vault_gcp_project_id">vault_gcp_project_id</h3> <p>The project ID from your Google API Console.</p> <p>Default: none</p> <hr> <h3 class="badge enterprise" id="vault_hcv_protocol">vault_hcv_protocol</h3> <p>The protocol to connect with. Accepts one of <code class="language-plaintext highlighter-rouge">http</code> or <code class="language-plaintext highlighter-rouge">https</code>.</p> <p>Default: <code class="language-plaintext highlighter-rouge">http</code></p> <hr> <h3 class="badge enterprise" id="vault_hcv_host">vault_hcv_host</h3> <p>The hostname of your HashiCorp vault.</p> <p>Default: <code class="language-plaintext highlighter-rouge">127.0.0.1</code></p> <hr> <h3 class="badge enterprise" id="vault_hcv_port">vault_hcv_port</h3> <p>The port number of your HashiCorp vault.</p> <p>Default: <code class="language-plaintext highlighter-rouge">8200</code></p> <hr> <h3 class="badge enterprise" id="vault_hcv_namespace">vault_hcv_namespace</h3> <p>Namespace for the HashiCorp Vault. Vault Enterprise requires a namespace to successfully connect to it.</p> <p>Default: none</p> <hr> <h3 class="badge enterprise" id="vault_hcv_mount">vault_hcv_mount</h3> <p>The mount point.</p> <p>Default: <code class="language-plaintext highlighter-rouge">secret</code></p> <hr> <h3 class="badge enterprise" id="vault_hcv_kv">vault_hcv_kv</h3> <p>The secrets engine version. Accepts <code class="language-plaintext highlighter-rouge">v1</code> or <code class="language-plaintext highlighter-rouge">v2</code>.</p> <p>Default: <code class="language-plaintext highlighter-rouge">v1</code></p> <hr> <h3 class="badge enterprise" id="vault_hcv_token">vault_hcv_token</h3> <p>A token string.</p> <p>Default: none</p> <hr> <h3 class="badge enterprise" id="vault_hcv_auth_method">vault_hcv_auth_method</h3> <p>Defines the authentication mechanism when connecting to the HashiCorp Vault service.</p> <p>Accepted values are: <code class="language-plaintext highlighter-rouge">token</code>, or <code class="language-plaintext highlighter-rouge">kubernetes</code>.</p> <p>Default: <code class="language-plaintext highlighter-rouge">token</code></p> <hr> <h3 class="badge enterprise" id="vault_hcv_kube_role">vault_hcv_kube_role</h3> <p>Defines the HashiCorp Vault role for the Kubernetes service account of the running pod. <code class="language-plaintext highlighter-rouge">vault_hcv_auth_method</code> must be set to <code class="language-plaintext highlighter-rouge">kubernetes</code> for this to activate.</p> <p>Default: none</p> <hr> <h3 class="badge enterprise" id="vault_hcv_kube_api_token_file">vault_hcv_kube_api_token_file</h3> <p>Defines where the Kubernetes service account token should be read from the pod’s filesystem, if using a non-standard container platform setup.</p> <p>Default: none</p> <hr> <h2 id="tuning--behavior-section">Tuning & Behavior section</h2> <h3 id="worker_consistency">worker_consistency</h3> <p>Defines whether this node should rebuild its state synchronously or asynchronously (the balancers and the router are rebuilt on updates that affects them, e.g., updates to Routes, Services or Upstreams, via the Admin API or loading a declarative configuration file). (This option is deprecated and will be removed in future releases. The new default is <code class="language-plaintext highlighter-rouge">eventual</code>.)</p> <p>Accepted values are:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">strict</code>: the router will be rebuilt synchronously, causing incoming requests to be delayed until the rebuild is finished. (This option is deprecated and will be removed in future releases. The new default is <code class="language-plaintext highlighter-rouge">eventual</code>)</li> <li> <code class="language-plaintext highlighter-rouge">eventual</code>: the router will be rebuilt asynchronously via a recurring background job running every second inside of each worker.</li> </ul> <p>Note that <code class="language-plaintext highlighter-rouge">strict</code> ensures that all workers of a given node will always proxy requests with an identical router, but that increased long tail latency can be observed if frequent Routes and Services updates are expected.</p> <p>Using <code class="language-plaintext highlighter-rouge">eventual</code> will help preventing long tail latency issues in such cases, but may cause workers to route requests differently for a short period of time after Routes and Services updates.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">eventual</code></p> <h3 id="worker_state_update_frequency">worker_state_update_frequency</h3> <p>Defines, in seconds, how often the worker state changes are checked with a background job. When a change is detected, a new router or balancer will be built, as needed. Raising this value will decrease the load on database servers and result in less jitter in proxy latency, but it might take more time to propagate changes to each individual worker.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">5</code></p> <h3 id="router_flavor">router_flavor</h3> <p>Selects the router implementation to use when performing request routing. Incremental router rebuild is available when the flavor is set to either <code class="language-plaintext highlighter-rouge">expressions</code> or <code class="language-plaintext highlighter-rouge">traditional_compatible</code> which could significantly shorten rebuild time for large number of routes.</p> <p>Accepted values are:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">traditional_compatible</code>: the DSL based expression router engine will be used under the hood. However the router config interface will be the same as <code class="language-plaintext highlighter-rouge">traditional</code> and expressions are automatically generated at router build time. The <code class="language-plaintext highlighter-rouge">expression</code> field on the <code class="language-plaintext highlighter-rouge">Route</code> object is not visible.</li> <li> <code class="language-plaintext highlighter-rouge">expressions</code>: the DSL based expression router engine will be used under the hood. Traditional router config interface is not visible and you must write Router Expression manually and provide them in the <code class="language-plaintext highlighter-rouge">expression</code> field on the <code class="language-plaintext highlighter-rouge">Route</code> object.</li> <li> <code class="language-plaintext highlighter-rouge">traditional</code>: the pre-3.0 Router engine will be used. Config interface will be the same as pre-3.0 Kong and the <code class="language-plaintext highlighter-rouge">expression</code> field on the <code class="language-plaintext highlighter-rouge">Route</code> object is not visible.</li> </ul> <p>Deprecation warning: In Kong 3.0, <code class="language-plaintext highlighter-rouge">traditional</code> mode should be avoided and only be used in case <code class="language-plaintext highlighter-rouge">traditional_compatible</code> did not work as expected.</p> <p>This flavor of router will be removed in the next major release of Kong.</p> <h2 id="default-traditional_compatible"> <strong>Default:</strong> <code class="language-plaintext highlighter-rouge">traditional_compatible</code> </h2> <h3 id="lua_max_req_headers">lua_max_req_headers</h3> <p>Maximum number of request headers to parse by default.</p> <p>This argument can be set to an integer between 1 and 1000.</p> <p>When proxying the Kong sends all the request headers and this setting does not have any effect. It is used to limit Kong and its plugins from reading too many request headers.</p> <p>Default: <code class="language-plaintext highlighter-rouge">100</code></p> <hr> <h3 id="lua_max_resp_headers">lua_max_resp_headers</h3> <p>Maximum number of response headers to parse by default.</p> <p>This argument can be set to an integer between 1 and 1000.</p> <p>When proxying, Kong returns all the response headers and this setting does not have any effect. It is used to limit Kong and its plugins from reading too many response headers.</p> <p>Default: <code class="language-plaintext highlighter-rouge">100</code></p> <hr> <h3 id="lua_max_uri_args">lua_max_uri_args</h3> <p>Maximum number of request uri arguments to parse by default.</p> <p>This argument can be set to an integer between 1 and 1000.</p> <p>When proxying, Kong sends all the request query arguments and this setting does not have any effect.</p> <p>It is used to limit Kong and its plugins from reading too many query arguments.</p> <p>Default: <code class="language-plaintext highlighter-rouge">100</code></p> <hr> <h3 id="lua_max_post_args">lua_max_post_args</h3> <p>Maximum number of request post arguments to parse by default.</p> <p>This argument can be set to an integer between 1 and 1000.</p> <p>When proxying, Kong sends all the request post arguments and this setting does not have any effect.</p> <p>It is used to limit Kong and its plugins from reading too many post arguments.</p> <p>Default: <code class="language-plaintext highlighter-rouge">100</code></p> <hr> <h2 id="miscellaneous-section">Miscellaneous section</h2> <p>Additional settings inherited from lua-nginx-module allowing for more flexibility and advanced usage.</p> <p>See the lua-nginx-module documentation for more information: https://github.com/openresty/lua-nginx-module</p> <h3 id="lua_ssl_trusted_certificate">lua_ssl_trusted_certificate</h3> <p>Comma-separated list of certificate authorities for Lua cosockets in PEM format.</p> <p>The special value <code class="language-plaintext highlighter-rouge">system</code> attempts to search for the “usual default” provided by each distro, according to an arbitrary heuristic. In the current implementation, The following pathnames will be tested in order, and the first one found will be used:</p> <ul> <li>/etc/ssl/certs/ca-certificates.crt (Debian/Ubuntu/Gentoo)</li> <li>/etc/pki/tls/certs/ca-bundle.crt (Fedora/RHEL 6)</li> <li>/etc/ssl/ca-bundle.pem (OpenSUSE)</li> <li>/etc/pki/tls/cacert.pem (OpenELEC)</li> <li>/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem (CentOS/RHEL 7)</li> <li>/etc/ssl/cert.pem (OpenBSD, Alpine)</li> </ul> <p><code class="language-plaintext highlighter-rouge">system</code> can be used by itself or in conjunction with other CA filepaths.</p> <p>When <code class="language-plaintext highlighter-rouge">pg_ssl_verify</code> or <code class="language-plaintext highlighter-rouge">cassandra_ssl_verify</code> are enabled, these certificate authority files will be used for verifying Kong’s database connections.</p> <p>Certificates can be configured on this property with any of the following values:</p> <ul> <li><code class="language-plaintext highlighter-rouge">system</code></li> <li>absolute path to the certificate</li> <li>certificate content</li> <li>base64 encoded certificate content</li> </ul> <p>See https://github.com/openresty/lua-nginx-module#lua_ssl_trusted_certificate</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">system</code></p> <h3 id="lua_ssl_verify_depth">lua_ssl_verify_depth</h3> <p>Sets the verification depth in the server certificates chain used by Lua cosockets, set by <code class="language-plaintext highlighter-rouge">lua_ssl_trusted_certificate</code>.</p> <p>This includes the certificates configured for Kong’s database connections.</p> <p>If the maximum depth is reached before reaching the end of the chain, verification will fail. This helps mitigate certificate based DoS attacks.</p> <p>See https://github.com/openresty/lua-nginx-module#lua_ssl_verify_depth</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">1</code></p> <h3 id="lua_ssl_protocols">lua_ssl_protocols</h3> <p>Defines the TLS versions supported when handshaking with OpenResty’s TCP cosocket APIs.</p> <p>This affects connections made by Lua code, such as connections to the database Kong uses, or when sending logs using a logging plugin. It does <em>not</em> affect connections made to the upstream Service or from downstream clients.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">TLSv1.1 TLSv1.2 TLSv1.3</code></p> <h3 id="lua_package_path">lua_package_path</h3> <p>Sets the Lua module search path (LUA_PATH). Useful when developing or using custom plugins not stored in the default search path.</p> <p>See https://github.com/openresty/lua-nginx-module#lua_package_path</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">./?.lua;./?/init.lua;</code></p> <h3 id="lua_package_cpath">lua_package_cpath</h3> <p>Sets the Lua C module search path (LUA_CPATH).</p> <p>See https://github.com/openresty/lua-nginx-module#lua_package_cpath</p> <p><strong>Default:</strong> none</p> <h3 id="lua_socket_pool_size">lua_socket_pool_size</h3> <p>Specifies the size limit for every cosocket connection pool associated with every remote server.</p> <p>See https://github.com/openresty/lua-nginx-module#lua_socket_pool_size</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">30</code></p> <h3 class="badge enterprise" id="enforce_rbac">enforce_rbac</h3> <p>Specifies whether Admin API RBAC is enforced.</p> <p>Accepts one of <code class="language-plaintext highlighter-rouge">entity</code>, <code class="language-plaintext highlighter-rouge">both</code>, <code class="language-plaintext highlighter-rouge">on</code>, or <code class="language-plaintext highlighter-rouge">off</code>.</p> <ul> <li> <code class="language-plaintext highlighter-rouge">on</code>: only endpoint-level authorization is enforced.</li> <li> <code class="language-plaintext highlighter-rouge">entity</code>: entity-level authorization applies.</li> <li> <code class="language-plaintext highlighter-rouge">both</code>: enables both endpoint and entity-level authorization.</li> <li> <code class="language-plaintext highlighter-rouge">off</code>: disables both endpoint and entity-level authorization.</li> </ul> <p>When enabled, Kong will deny requests to the Admin API when a nonexistent or invalid RBAC authorization token is passed, or the RBAC user with which the token is associated does not have permissions to access/modify the requested resource.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="rbac_auth_header">rbac_auth_header</h3> <p>Defines the name of the HTTP request header from which the Admin API will attempt to authenticate the RBAC user.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">Kong-Admin-Token</code></p> <h3 class="badge enterprise" id="event_hooks_enabled">event_hooks_enabled</h3> <p>When enabled, event hook entities represent a relationship between an event (source and event) and an action (handler). Similar to web hooks, event hooks can be used to communicate Kong Gateway service events. When a particular event happens on a service, the event hook calls a URL with information about that event. Event hook configurations differ depending on the handler. The events that are triggered send associated data.</p> <p>See: https://docs.konghq.com/gateway/latest/admin-api/event-hooks/reference/</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 id="fips">fips</h3> <p>Turn on FIPS mode; this mode is only available on a FIPS build.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <hr> <h2 id="kong-manager-section">Kong Manager section</h2> <p>The Admin GUI for Kong Enterprise.</p> <h3 class="badge free" id="admin_gui_listen">admin_gui_listen</h3> <p>Kong Manager Listeners</p> <p>Comma-separated list of addresses and ports on which Kong will expose Kong Manager. This web application lets you configure and manage Kong, and therefore should be kept secured.</p> <p>Suffixes can be specified for each pair, similarly to the <code class="language-plaintext highlighter-rouge">admin_listen</code> directive.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0.0.0.0:8002, 0.0.0.0:8445 ssl</code></p> <h3 class="badge free" id="admin_gui_url">admin_gui_url</h3> <p>Kong Manager URL</p> <p>The lookup, or balancer, address for Kong Manager.</p> <p>Accepted format (items in parentheses are optional):</p> <p><code class="language-plaintext highlighter-rouge"><scheme>://<IP / HOSTNAME>(:<PORT>)</code></p> <p>Examples:</p> <ul> <li><code class="language-plaintext highlighter-rouge">http://127.0.0.1:8003</code></li> <li><code class="language-plaintext highlighter-rouge">https://kong-admin.test</code></li> <li><code class="language-plaintext highlighter-rouge">http://dev-machine</code></li> </ul> <p>By default, Kong Manager will use the window request host and append the resolved listener port depending on the requested protocol.</p> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_path">admin_gui_path</h3> <p>Kong Manager base path</p> <p>This configuration parameter allows the user to customize the path prefix where Kong Manager is served. When updating this parameter, it’s recommended to update the path in <code class="language-plaintext highlighter-rouge">admin_gui_url</code> as well.</p> <p>Accepted format:</p> <ul> <li>Path must start with a <code class="language-plaintext highlighter-rouge">/</code> </li> <li>Path must not end with a <code class="language-plaintext highlighter-rouge">/</code> (except for the <code class="language-plaintext highlighter-rouge">/</code>)</li> <li>Path can only contain letters, digits, hyphens (<code class="language-plaintext highlighter-rouge">-</code>),</li> </ul> <p>underscores (<code class="language-plaintext highlighter-rouge">_</code>), and slashes (<code class="language-plaintext highlighter-rouge">/</code>)</p> <ul> <li>Path must not contain continuous slashes (e.g., <code class="language-plaintext highlighter-rouge">//</code> and <code class="language-plaintext highlighter-rouge">///</code>)</li> </ul> <p>Examples:</p> <ul> <li><code class="language-plaintext highlighter-rouge">/</code></li> <li><code class="language-plaintext highlighter-rouge">/manager</code></li> <li><code class="language-plaintext highlighter-rouge">/kong-manager</code></li> <li><code class="language-plaintext highlighter-rouge">/kong/manager</code></li> </ul> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">/</code></p> <h3 class="badge free" id="admin_gui_ssl_cert">admin_gui_ssl_cert</h3> <p>The SSL certificate for <code class="language-plaintext highlighter-rouge">admin_gui_listen</code> values with SSL enabled.</p> <p>Values:</p> <ul> <li>absolute path to the certificate</li> <li>certificate content</li> <li>base64 encoded certificate content</li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_ssl_cert_key">admin_gui_ssl_cert_key</h3> <p>The SSL key for <code class="language-plaintext highlighter-rouge">admin_gui_listen</code> values with SSL enabled.</p> <p>Values:</p> <ul> <li>absolute path to the certificate key</li> <li>certificate key content</li> <li>base64 encoded certificate key content</li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_flags">admin_gui_flags</h3> <p>Alters the layout Admin GUI (JSON) The only supported value is <code class="language-plaintext highlighter-rouge">{ "IMMUNITY_ENABLED": true }</code> to enable Kong Immunity in the Admin GUI.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">{}</code></p> <h3 class="badge free" id="admin_gui_access_log">admin_gui_access_log</h3> <p>Kong Manager Access Logs</p> <p>Here you can set an absolute or relative path for Kong Manager access logs. When the path is relative, logs are placed in the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p>Setting this value to <code class="language-plaintext highlighter-rouge">off</code> disables access logs for Kong Manager.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/admin_gui_access.log</code></p> <h3 class="badge free" id="admin_gui_error_log">admin_gui_error_log</h3> <p>Kong Manager Error Logs</p> <p>Here you can set an absolute or relative path for Kong Manager access logs. When the path is relative, logs are placed in the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p>Setting this value to <code class="language-plaintext highlighter-rouge">off</code> disables error logs for Kong Manager.</p> <p>Granularity can be adjusted through the <code class="language-plaintext highlighter-rouge">log_level</code> directive.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/admin_gui_error.log</code></p> <h3 class="badge enterprise" id="admin_gui_auth">admin_gui_auth</h3> <p>Kong Manager Authentication Plugin Name</p> <p>Secures access to Kong Manager by specifying an authentication plugin to use.</p> <p>Supported Plugins:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">basic-auth</code>: Basic Authentication plugin</li> <li> <code class="language-plaintext highlighter-rouge">ldap-auth-advanced</code>: LDAP Authentication plugin</li> <li> <code class="language-plaintext highlighter-rouge">openid-connect</code>: OpenID Connect Authentication plugin</li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="admin_gui_auth_conf">admin_gui_auth_conf</h3> <p>Kong Manager Authentication Plugin Config (JSON)</p> <p>Specifies the configuration for the authentication plugin specified in <code class="language-plaintext highlighter-rouge">admin_gui_auth</code>.</p> <p>For information about Plugin Configuration consult the associated plugin documentation.</p> <p>Example for <code class="language-plaintext highlighter-rouge">basic-auth</code>:</p> <p><code class="language-plaintext highlighter-rouge">admin_gui_auth_conf = { "hide_credentials": true }</code></p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="admin_gui_auth_password_complexity">admin_gui_auth_password_complexity</h3> <p>Kong Manager Authentication Password Complexity (JSON)</p> <p>When <code class="language-plaintext highlighter-rouge">admin_gui_auth = basic-auth</code>, this property defines the rules required for Kong Manager passwords. Choose from preset rules or write your own.</p> <p>Example using preset rules:</p> <p><code class="language-plaintext highlighter-rouge">admin_gui_auth_password_complexity = { "kong-preset": "min_8" }</code></p> <p>All values for kong-preset require the password to contain characters from at least three of the following categories:</p> <ol> <li> <p>Uppercase characters (A through Z)</p> </li> <li> <p>Lowercase characters (a through z)</p> </li> <li> <p>Base-10 digits (0 through 9)</p> </li> <li> <p>Special characters (for example, &, $, #, %)</p> </li> </ol> <p>Supported preset rules:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">min_8</code>: minimum length of 8</li> <li> <code class="language-plaintext highlighter-rouge">min_12</code>: minimum length of 12</li> <li> <code class="language-plaintext highlighter-rouge">min_20</code>: minimum length of 20</li> </ul> <p>To write your own rules, see https://manpages.debian.org/jessie/passwdqc/passwdqc.conf.5.en.html.</p> <p>NOTE: Only keywords “min”, “max” and “passphrase” are supported.</p> <p>Example:</p> <p><code class="language-plaintext highlighter-rouge">admin_gui_auth_password_complexity = { "min": "disabled,24,11,9,8" }</code></p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="admin_gui_session_conf">admin_gui_session_conf</h3> <p>Kong Manager Session Config (JSON)</p> <p>Specifies the configuration for the Session plugin as used by Kong Manager.</p> <p>For information about plugin configuration, consult the Kong Session plugin documentation.</p> <p>Example:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>admin_gui_session_conf = { "cookie_name": "kookie", \ "secret": "changeme" } </code></pre></div></div> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="admin_gui_auth_header">admin_gui_auth_header</h3> <p>Defines the name of the HTTP request header from which the Admin API will attempt to identify the Kong Admin user.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">Kong-Admin-User</code></p> <h3 class="badge enterprise" id="admin_gui_auth_login_attempts">admin_gui_auth_login_attempts</h3> <p>Number of times a user can attempt to login to Kong Manager. 0 means infinite attempts allowed.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0</code></p> <h3 class="badge free" id="admin_gui_header_txt">admin_gui_header_txt</h3> <p>Kong Manager Header Text Sets text for Kong Manager Header Banner. Header Banner is not shown if this config is empty.</p> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_header_bg_color">admin_gui_header_bg_color</h3> <p>Kong Manager Header Background Color Sets background color for Kong Manager Header Banner Accepts css color keyword, #-hexadecimal or rgb format. Invalid values are ignored by Manager.</p> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_header_txt_color">admin_gui_header_txt_color</h3> <p>Kong Manager Header Text Color Sets text color for Kong Manager Header Banner.</p> <p>Accepts css color keyword, #-hexadecimal or rgb format. Invalid values are ignored by Kong Manager.</p> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_footer_txt">admin_gui_footer_txt</h3> <p>Kong Manager Footer Text Sets text for Kong Manager Footer Banner. Footer Banner is not shown if this config is empty</p> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_footer_bg_color">admin_gui_footer_bg_color</h3> <p>Kong Manager Footer Background Color Sets background color for Kong Manager Footer Banner.</p> <p>Accepts css color keyword, #-hexadecimal or rgb format. Invalid values are ignored by Manager.</p> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_footer_txt_color">admin_gui_footer_txt_color</h3> <p>Kong Manager Footer Text Color Sets text color for Kong Manager Footer Banner.</p> <p>Accepts css color keyword, #-hexadecimal or rgb format. Invalid values are ignored by Kong Manager.</p> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_login_banner_title">admin_gui_login_banner_title</h3> <p>Kong Manager Login Banner Title Text Sets title text for Kong Manager Login Banner.</p> <p>Login Banner is not shown if both <code class="language-plaintext highlighter-rouge">admin_gui_login_banner_title</code> and <code class="language-plaintext highlighter-rouge">admin_gui_login_banner_body</code> are empty.</p> <p><strong>Default:</strong> none</p> <h3 class="badge free" id="admin_gui_login_banner_body">admin_gui_login_banner_body</h3> <p>Kong Manager Login Banner Body Text Sets body text for Kong Manager Login Banner.</p> <p>Login Banner is not shown if both <code class="language-plaintext highlighter-rouge">admin_gui_login_banner_title</code> and <code class="language-plaintext highlighter-rouge">admin_gui_login_banner_body</code> are empty.</p> <p><strong>Default:</strong> none</p> <hr> <h2 id="vitals-section">Vitals section</h2> <h3 class="badge enterprise" id="vitals">vitals</h3> <p>When enabled, Kong will store and report metrics about its performance.</p> <p>When running Kong in a multi-node setup, <code class="language-plaintext highlighter-rouge">vitals</code> entails two separate meanings depending on the node.</p> <p>On a Proxy-only node, <code class="language-plaintext highlighter-rouge">vitals</code> determines whether to collect data for Vitals.</p> <p>On an Admin-only node, <code class="language-plaintext highlighter-rouge">vitals</code> determines whether to display Vitals metrics and visualizations on the dashboard.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 class="badge enterprise" id="vitals_strategy">vitals_strategy</h3> <p>Determines whether to use the Kong database or a separate storage engine for Vitals metrics.</p> <p>Accepted values are <code class="language-plaintext highlighter-rouge">database</code>, <code class="language-plaintext highlighter-rouge">prometheus</code>, or <code class="language-plaintext highlighter-rouge">influxdb</code>.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">database</code></p> <h3 class="badge enterprise" id="vitals_tsdb_address">vitals_tsdb_address</h3> <p>Defines the host and port of the TSDB server to which Vitals data is written and read.</p> <p>This value is only applied when the <code class="language-plaintext highlighter-rouge">vitals_strategy</code> option is set to <code class="language-plaintext highlighter-rouge">prometheus</code> or <code class="language-plaintext highlighter-rouge">influxdb</code>. This value accepts IPv4, IPv6, and hostname values.</p> <p>If the <code class="language-plaintext highlighter-rouge">vitals_strategy</code> is set to <code class="language-plaintext highlighter-rouge">prometheus</code>, this value determines the address of the Prometheus server from which Vitals data will be read. For <code class="language-plaintext highlighter-rouge">influxdb</code> strategies, this value controls both the read and write source for Vitals data.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="vitals_tsdb_user">vitals_tsdb_user</h3> <p>Influxdb user</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="vitals_tsdb_password">vitals_tsdb_password</h3> <p>Influxdb password</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="vitals_statsd_address">vitals_statsd_address</h3> <p>Defines the host and port (and an optional protocol) of the StatsD server to which Kong should write Vitals metrics. This value is only applied when the <code class="language-plaintext highlighter-rouge">vitals_strategy</code> is set to <code class="language-plaintext highlighter-rouge">prometheus</code>. This value accepts IPv4, IPv6, and, hostnames. Additionally, the suffix <code class="language-plaintext highlighter-rouge">tcp</code> can be specified; doing so will result in Kong sending StatsD metrics via TCP instead of the UDP (default).</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="vitals_statsd_prefix">vitals_statsd_prefix</h3> <p>Defines the prefix value attached to all Vitals StatsD events. This prefix is useful when writing metrics to a multi-tenant StatsD exporter or server.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">kong</code></p> <h3 class="badge enterprise" id="vitals_statsd_udp_packet_size">vitals_statsd_udp_packet_size</h3> <p>Defines the maximum buffer size in which Vitals statsd metrics will be held and sent in batches.</p> <p>This value is defined in bytes.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">1024</code></p> <h3 class="badge enterprise" id="vitals_prometheus_scrape_interval">vitals_prometheus_scrape_interval</h3> <p>Defines the scrape_interval query parameter sent to the Prometheus server when reading Vitals data.</p> <p>This should be same as the scrape interval (in seconds) of the Prometheus server.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">5</code></p> <hr> <h2 id="konnect-section">Konnect section</h2> <h3 id="konnect_mode">konnect_mode</h3> <p>When enabled, the dataplane is connected to Konnect</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <hr> <h2 id="analytics-for-konnect-section">Analytics For Konnect section</h2> <h3 id="analytics_flush_interval">analytics_flush_interval</h3> <p>Determine the frequency of flushing local data to Konnect in seconds.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">1</code></p> <h3 id="analytics_buffer_size_limit">analytics_buffer_size_limit</h3> <p>Max number of messages can be buffered locally before dropping data in case there is no network connection to Konnect.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">100000</code></p> <hr> <h2 id="developer-portal-section">Developer Portal section</h2> <h3 class="badge enterprise" id="portal">portal</h3> <p>Developer Portal Switch</p> <p>When enabled:</p> <p>Kong will expose the Dev Portal interface and read-only APIs on the <code class="language-plaintext highlighter-rouge">portal_gui_listen</code> address, and endpoints on the Admin API to manage assets.</p> <p>When enabled along with <code class="language-plaintext highlighter-rouge">portal_auth</code>:</p> <p>Kong will expose management endpoints for developer accounts on the Admin API and the Dev Portal API.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="portal_gui_listen">portal_gui_listen</h3> <p>Developer Portal GUI Listeners</p> <p>Comma-separated list of addresses on which Kong will expose the Developer Portal GUI. Suffixes can be specified for each pair, similarly to the <code class="language-plaintext highlighter-rouge">admin_listen</code> directive.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0.0.0.0:8003, 0.0.0.0:8446 ssl</code></p> <h3 class="badge enterprise" id="portal_gui_protocol">portal_gui_protocol</h3> <p>Developer Portal GUI protocol</p> <p>The protocol used in conjunction with <code class="language-plaintext highlighter-rouge">portal_gui_host</code> to construct the lookup, or balancer address for your Kong Proxy nodes.</p> <p>Examples: <code class="language-plaintext highlighter-rouge">http</code>,<code class="language-plaintext highlighter-rouge">https</code></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">http</code></p> <h3 class="badge enterprise" id="portal_gui_host">portal_gui_host</h3> <p>Developer Portal GUI host</p> <p>The host used in conjunction with <code class="language-plaintext highlighter-rouge">portal_gui_protocol</code> to construct the lookup, or balancer address for your Kong Proxy nodes.</p> <p>Examples:</p> <ul> <li> <code class="language-plaintext highlighter-rouge"><IP>:<PORT></code> -> <code class="language-plaintext highlighter-rouge">portal_gui_host = 127.0.0.1:8003</code> </li> <li> <code class="language-plaintext highlighter-rouge"><HOSTNAME></code> -> <code class="language-plaintext highlighter-rouge">portal_gui_host = portal_api.domain.tld</code> </li> </ul> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">127.0.0.1:8003</code></p> <h3 class="badge enterprise" id="portal_cors_origins">portal_cors_origins</h3> <p>Developer Portal CORS Origins</p> <p>A comma separated list of allowed domains for <code class="language-plaintext highlighter-rouge">Access-Control-Allow-Origin</code> header. This can be used to resolve CORS issues in custom networking environments.</p> <p>Examples:</p> <ul> <li>list of domains: <code class="language-plaintext highlighter-rouge">portal_cors_origins = http://localhost:8003, https://localhost:8004</code> </li> <li>single domain: <code class="language-plaintext highlighter-rouge">portal_cors_origins = http://localhost:8003</code> </li> <li>all domains: <code class="language-plaintext highlighter-rouge">portal_cors_origins = *</code> </li> </ul> <p>NOTE: In most cases, the Developer Portal is able to derive valid CORS origins by using <code class="language-plaintext highlighter-rouge">portal_gui_protocol</code>, <code class="language-plaintext highlighter-rouge">portal_gui_host</code>, and if applicable, <code class="language-plaintext highlighter-rouge">portal_gui_use_subdomains</code>. In these cases, <code class="language-plaintext highlighter-rouge">portal_cors_origins</code> is not needed and can remain unset.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_gui_use_subdomains">portal_gui_use_subdomains</h3> <p>Developer Portal GUI subdomain toggle</p> <p>By default Kong Portal uses the first namespace in the request path to determine workspace. By turning <code class="language-plaintext highlighter-rouge">portal_gui_subdomains</code> on, Kong Portal will expect workspace to be included in the request url as a subdomain.</p> <p>Example (off): - <code class="language-plaintext highlighter-rouge"><scheme>://<HOSTNAME>/<WORKSPACE>/<PATH></code> -> <code class="language-plaintext highlighter-rouge">http://kong-portal.com/example-workspace/index</code></p> <p>Example (on): - <code class="language-plaintext highlighter-rouge"><scheme>://<WORKSPACE>.<HOSTNAME></code> -> <code class="language-plaintext highlighter-rouge">http://example-workspace.kong-portal.com/index</code></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="portal_gui_ssl_cert">portal_gui_ssl_cert</h3> <p>Developer Portal GUI SSL Certificate</p> <p>The SSL certificate for <code class="language-plaintext highlighter-rouge">portal_gui_listen</code> values with SSL enabled.</p> <p>Values:</p> <ul> <li>absolute path to the certificate</li> <li>certificate content</li> <li>base64 encoded certificate content</li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_gui_ssl_cert_key">portal_gui_ssl_cert_key</h3> <p>Developer Portal GUI SSL Certificate Key</p> <p>The SSL key for <code class="language-plaintext highlighter-rouge">portal_gui_listen</code> values with SSL enabled.</p> <p>Values:</p> <ul> <li>absolute path to the certificate key</li> <li>certificate key content</li> <li>base64 encoded certificate key content</li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_gui_access_log">portal_gui_access_log</h3> <p>Developer Portal GUI Access Log location</p> <p>Here you can set an absolute or relative path for your Portal GUI access logs.</p> <p>Setting this value to <code class="language-plaintext highlighter-rouge">off</code> will disable logging Portal GUI access logs.</p> <p>When using relative pathing, logs will be placed under the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/portal_gui_access.log</code></p> <h3 class="badge enterprise" id="portal_gui_error_log">portal_gui_error_log</h3> <p>Developer Portal GUI Error Log location</p> <p>Here you can set an absolute or relative path for your Portal GUI error logs.</p> <p>Setting this value to <code class="language-plaintext highlighter-rouge">off</code> will disable logging Portal GUI error logs.</p> <p>When using relative pathing, logs will be placed under the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p>Granularity can be adjusted through the <code class="language-plaintext highlighter-rouge">log_level</code> directive.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/portal_gui_error.log</code></p> <h3 class="badge enterprise" id="portal_api_listen">portal_api_listen</h3> <p>Developer Portal API Listeners</p> <p>Comma-separated list of addresses on which Kong will expose the Developer Portal API. Suffixes can be specified for each pair, similarly to the <code class="language-plaintext highlighter-rouge">admin_listen</code> directive.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0.0.0.0:8004, 0.0.0.0:8447 ssl</code></p> <h3 class="badge enterprise" id="portal_api_url">portal_api_url</h3> <p>Developer Portal API URL</p> <p>The lookup, or balancer, address for your Developer Portal nodes.</p> <p>This value is commonly used in a microservices or service-mesh oriented architecture.</p> <p><code class="language-plaintext highlighter-rouge">portal_api_url</code> is the address on which your Kong Dev Portal API is accessible by Kong. You should only set this value if your Kong Dev Portal API lives on a different node than your Kong Proxy.</p> <p>Accepted format (parts in parenthesis are optional):</p> <p><code class="language-plaintext highlighter-rouge"><scheme>://<IP / HOSTNAME>(:<PORT>(/<PATH>))</code></p> <p>Examples:</p> <ul> <li> <code class="language-plaintext highlighter-rouge"><scheme>://<IP>:<PORT></code> -> <code class="language-plaintext highlighter-rouge">portal_api_url = http://127.0.0.1:8003</code> </li> <li> <code class="language-plaintext highlighter-rouge">SSL <scheme>://<HOSTNAME></code> -> <code class="language-plaintext highlighter-rouge">portal_api_url = https://portal_api.domain.tld</code> </li> <li> <code class="language-plaintext highlighter-rouge"><scheme>://<HOSTNAME>/<PATH></code> -> <code class="language-plaintext highlighter-rouge">portal_api_url = http://dev-machine/dev-285</code> </li> </ul> <p>By default this value points to the local interface:</p> <ul> <li><code class="language-plaintext highlighter-rouge">http://0.0.0.0:8004</code></li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_api_ssl_cert">portal_api_ssl_cert</h3> <p>Developer Portal API SSL Certificate</p> <p>The SSL certificate for <code class="language-plaintext highlighter-rouge">portal_api_listen</code> values with SSL enabled.</p> <p>Values:</p> <ul> <li>absolute path to the certificate</li> <li>certificate content</li> <li>base64 encoded certificate content</li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_api_ssl_cert_key">portal_api_ssl_cert_key</h3> <p>Developer Portal API SSL Certificate Key</p> <p>The SSL key for <code class="language-plaintext highlighter-rouge">portal_api_listen</code> values with SSL enabled.</p> <p>Values:</p> <ul> <li>absolute path to the certificate key</li> <li>certificate key content</li> <li>base64 encoded certificate key content</li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_api_access_log">portal_api_access_log</h3> <p>Developer Portal API Access Log location</p> <p>Here you can set an absolute or relative path for your Portal API access logs.</p> <p>Setting this value to <code class="language-plaintext highlighter-rouge">off</code> will disable logging Portal API access logs.</p> <p>When using relative pathing, logs will be placed under the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/portal_api_access.log</code></p> <h3 class="badge enterprise" id="portal_api_error_log">portal_api_error_log</h3> <p>Developer Portal API Error Log location</p> <p>Here you can set an absolute or relative path for your Portal API error logs.</p> <p>Setting this value to <code class="language-plaintext highlighter-rouge">off</code> will disable logging Portal API error logs.</p> <p>When using relative pathing, logs will be placed under the <code class="language-plaintext highlighter-rouge">prefix</code> location.</p> <p>Granularity can be adjusted through the <code class="language-plaintext highlighter-rouge">log_level</code> directive.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">logs/portal_api_error.log</code></p> <h3 class="badge enterprise" id="portal_is_legacy">portal_is_legacy</h3> <p>Developer Portal legacy support</p> <p>Setting this value to <code class="language-plaintext highlighter-rouge">on</code> will cause all new portals to render using the legacy rendering system by default.</p> <p>Setting this value to <code class="language-plaintext highlighter-rouge">off</code> will cause all new portals to render using the current rendering system.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="portal_app_auth">portal_app_auth</h3> <p>Developer Portal application registration auth provider and strategy. Must be set to enable application_registration plugin Currently accepts kong-oauth2 or external-oauth2</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">kong-oauth2</code></p> <hr> <h2 id="default-developer-portal-authentication-section">Default Developer Portal Authentication section</h2> <p>Referenced on workspace creation to set Dev Portal authentication defaults in the database for that particular workspace.</p> <h3 class="badge enterprise" id="portal_auth">portal_auth</h3> <p>Developer Portal Authentication Plugin Name</p> <p>Specifies the authentication plugin to apply to your Developer Portal. Developers will use the specified form of authentication to request access, register, and login to your Developer Portal.</p> <p>Supported Plugins:</p> <ul> <li>Basic Authentication: <code class="language-plaintext highlighter-rouge">portal_auth = basic-auth</code> </li> <li>OIDC Authentication: <code class="language-plaintext highlighter-rouge">portal_auth = openid-connect</code> </li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_auth_password_complexity">portal_auth_password_complexity</h3> <p>Kong Portal Authentication Password Complexity (JSON)</p> <p>When portal_auth = basic-auth, this property defines the rules required for Kong Portal passwords. Choose from preset rules or write your own.</p> <p>Example using preset rules:</p> <p><code class="language-plaintext highlighter-rouge">portal_auth_password_complexity = { "kong-preset": "min_8" }</code></p> <p>All values for kong-preset require the password to contain characters from at least three of the following categories:</p> <ol> <li> <p>Uppercase characters (A through Z)</p> </li> <li> <p>Lowercase characters (a through z)</p> </li> <li> <p>Base-10 digits (0 through 9)</p> </li> <li> <p>Special characters (for example, &, $, #, %)</p> </li> </ol> <p>Supported preset rules:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">min_8</code>: minimum length of 8</li> <li> <code class="language-plaintext highlighter-rouge">min_12</code>: minimum length of 12</li> <li> <code class="language-plaintext highlighter-rouge">min_20</code>: minimum length of 20</li> </ul> <p>To write your own rules, see https://manpages.debian.org/jessie/passwdqc/passwdqc.conf.5.en.html.</p> <p>NOTE: Only keywords “min”, “max” and “passphrase” are supported.</p> <p>Example:</p> <p><code class="language-plaintext highlighter-rouge">portal_auth_password_complexity = { "min": "disabled,24,11,9,8" }</code></p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_auth_conf">portal_auth_conf</h3> <p>Developer Portal Authentication Plugin Config (JSON)</p> <p>Specifies the plugin configuration object in JSON format to be applied to your Developer Portal authentication.</p> <p>For information about Plugin Configuration consult the associated plugin documentation.</p> <p>Example for <code class="language-plaintext highlighter-rouge">basic-auth</code>:</p> <p><code class="language-plaintext highlighter-rouge">portal_auth_conf = { "hide_credentials": true }</code></p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_auth_login_attempts">portal_auth_login_attempts</h3> <p>Number of times a user can attempt to login to the Dev Portal before password must be reset.</p> <p>0 (default) means infinite attempts allowed.</p> <p>Note: Any value greater than 0 will only affect Dev Portals secured with basic-auth.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0</code></p> <h3 class="badge enterprise" id="portal_session_conf">portal_session_conf</h3> <p>Portal Session Config (JSON)</p> <p>Specifies the configuration for the Session plugin as used by Kong Portal.</p> <p>For information about Plugin Configuration consult the Kong Session Plugin documentation.</p> <p>Example:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>portal_session_conf = { "cookie_name": "portal_session", \ "secret": "changeme", \ "storage": "kong" } </code></pre></div></div> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_auto_approve">portal_auto_approve</h3> <p>Developer Portal Auto Approve Access</p> <p>When set to <code class="language-plaintext highlighter-rouge">on</code>, a developer will automatically be marked as “approved” after completing registration. Access can still be revoked through Kong Manager or the Admin API.</p> <p>When set to <code class="language-plaintext highlighter-rouge">off</code>, a Kong admin will have to manually approve the Developer using Kong Manager or the Admin API.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="portal_token_exp">portal_token_exp</h3> <p>Duration in seconds for the expiration of the Dev Portal reset password token. Default is <code class="language-plaintext highlighter-rouge">21600</code> (six hours).</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">21600</code></p> <h3 class="badge enterprise" id="portal_email_verification">portal_email_verification</h3> <p>Portal Developer Email Verification.</p> <p>When enabled Developers will receive an email upon registration to verify their account. Developers will not be able to use the Developer Portal until they verify their account, even if auto-approve is enabled.</p> <p>Note: SMTP must be turned on in order to use this feature.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <hr> <h2 id="default-portal-smtp-configuration-section">Default Portal Smtp Configuration section</h2> <p>Referenced on workspace creation to set SMTP defaults in the database for that particular workspace.</p> <h3 class="badge enterprise" id="portal_invite_email">portal_invite_email</h3> <p>When enabled, Kong admins can invite developers to a Dev Portal by using the Invite button in Kong Manager.</p> <p>The email looks like the following:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Subject: Invite to access Dev Portal <WORKSPACE_NAME> Hello Developer! You have been invited to create a Dev Portal account at %s. Please visit `<DEV_PORTAL_URL/register>` to create your account. </code></pre></div></div> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 class="badge enterprise" id="portal_access_request_email">portal_access_request_email</h3> <p>When enabled, Kong admins specified by <code class="language-plaintext highlighter-rouge">smtp_admin_emails</code> will receive an email when a developer requests access to a Dev Portal.</p> <p>When disabled, Kong admins will have to manually check the Kong Manager to view any requests.</p> <p>The email looks like the following:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Subject: Request to access Dev Portal <WORKSPACE NAME> Hello Admin! <DEVELOPER NAME> has requested Dev Portal access for <WORKSPACE_NAME>. Please visit <KONG_MANAGER_URL/developers/requested> to review this request. </code></pre></div></div> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 class="badge enterprise" id="portal_approved_email">portal_approved_email</h3> <p>When enabled, developers will receive an email when access to a Dev Portal has been approved.</p> <p>When disabled, developers will receive no indication that they have beenapproved. It is suggested to only disable this feature if <code class="language-plaintext highlighter-rouge">portal_auto_approve</code> is enabled.</p> <p>The email looks like the following:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Subject: Dev Portal access approved Hello Developer! You have been approved to access <WORKSPACE_NAME>. Please visit <DEV PORTAL URL/login> to login. </code></pre></div></div> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 class="badge enterprise" id="portal_reset_email">portal_reset_email</h3> <p>When enabled, developers will be able to use the Reset Password flow on a Dev Portal and will receive an email with password reset instructions.</p> <p>When disabled, developers will <em>not</em> be able to reset their account passwords. Kong Admins will have to manually create new credentials for the Developer in the Kong Manager.</p> <p>The email looks like the following:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Subject: Password Reset Instructions for Dev Portal <WORKSPACE_NAME>. Hello Developer, Please click the link below to reset your Dev Portal password. <DEV_PORTAL_URL/reset?token=12345> This link will expire in <portal_reset_token_exp> If you didn't make this request, keep your account secure by clicking the link above to change your password. </code></pre></div></div> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 class="badge enterprise" id="portal_reset_success_email">portal_reset_success_email</h3> <p>When enabled, developers will receive an email after successfully resetting their Dev Portal account password.</p> <p>When disabled, developers will still be able to reset their account passwords, but will not receive a confirmation email.</p> <p>The email looks like the following:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Subject: Dev Portal password change success Hello Developer, We are emailing you to let you know that your Dev Portal password at <DEV_PORTAL_URL> has been changed. Click the link below to sign in with your new credentials. <DEV_PORTAL_URL> </code></pre></div></div> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 class="badge enterprise" id="portal_application_status_email">portal_application_status_email</h3> <p>When enabled, developers will receive an email when the status changes for their appliciation service requests.</p> <p>When disabled, developers will still be able to view the status in their developer portal application page.</p> <p>The email looks like the following:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Subject: Dev Portal application request <REQUEST_STATUS> (<DEV_PORTAL_URL>) Hello Developer, We are emailing you to let you know that your request for application access from the Developer Portal account at <DEV_PORTAL_URL> is <REQUEST_STATUS>. Application: <APPLICATION_NAME> Service: <SERVICE_NAME> You will receive another email when your access has been approved. </code></pre></div></div> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="portal_application_request_email">portal_application_request_email</h3> <p>When enabled, Kong admins specified by <code class="language-plaintext highlighter-rouge">smtp_admin_emails</code> will receive an email when a developer requests access to service through an application.</p> <p>When disabled, Kong admins will have to manually check the Kong Manager to view any requests.</p> <p>By default, <code class="language-plaintext highlighter-rouge">smtp_admin_emails</code> will be the recipients.</p> <p>This can be overridden by <code class="language-plaintext highlighter-rouge">portal_smtp_admin_emails</code>, which can be set dynamically per workspace through the Admin API.</p> <p>The email looks like the following:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Subject: Request to access Dev Portal (<DEV_PORTAL_URL>) service from <DEVELOPER_EMAIL> Hello Admin, <DEVELOPER NAME> (<DEVELOPER_EMAIL>) has requested application access for <DEV_PORTAL_URL>. Requested workspace: <WORKSPACE_NAME> Requested application: <APPLICATION_NAME> Requested service: <SERVICE_NAME> Please visit <KONG_MANAGER_URL/WORKSPACE_NAME/applications/APPLICATION_ID#requested> to review this request. </code></pre></div></div> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="portal_emails_from">portal_emails_from</h3> <p>The name and email address for the <code class="language-plaintext highlighter-rouge">From</code> header included in all Dev Portal emails.</p> <p>Example: <code class="language-plaintext highlighter-rouge">portal_emails_from = Your Name <example@example.com></code></p> <p>Note: Some SMTP servers will not use this value, but instead insert the email and name associated with the account.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_emails_reply_to">portal_emails_reply_to</h3> <p>Email address for the <code class="language-plaintext highlighter-rouge">Reply-To</code> header for portal emails</p> <p>Example: <code class="language-plaintext highlighter-rouge">portal_emails_reply_to = example@example.com</code></p> <p>Note: Some SMTP servers will not use this value, but instead insert the email associated with the account.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="portal_smtp_admin_emails">portal_smtp_admin_emails</h3> <p>Comma separated list of admin emails to receive portal notifications. Can be dynamically set per workspace through the Admin API.</p> <p>If not set, <code class="language-plaintext highlighter-rouge">smtp_admin_emails</code> will be used.</p> <p>Example <code class="language-plaintext highlighter-rouge">admin1@example.com, admin2@example.com</code></p> <p><strong>Default:</strong> none</p> <hr> <h2 id="admin-smtp-configuration-section">Admin Smtp Configuration section</h2> <h3 class="badge enterprise" id="admin_emails_from">admin_emails_from</h3> <p>The email address for the <code class="language-plaintext highlighter-rouge">From</code> header for admin emails.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">""</code></p> <h3 class="badge enterprise" id="admin_emails_reply_to">admin_emails_reply_to</h3> <p>Email address for the <code class="language-plaintext highlighter-rouge">Reply-To</code> header for admin emails.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="admin_invitation_expiry">admin_invitation_expiry</h3> <p>Expiration time for the admin invitation link (in seconds). 0 means no expiration.</p> <p>Example, 72 hours: <code class="language-plaintext highlighter-rouge">72 * 60 * 60 = 259200</code></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">259200</code></p> <hr> <h2 id="general-smtp-configuration-section">General Smtp Configuration section</h2> <h3 class="badge enterprise" id="smtp_mock">smtp_mock</h3> <p>This flag will mock the sending of emails. This can be used for testing before the SMTP client is fully configured.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">on</code></p> <h3 class="badge enterprise" id="smtp_host">smtp_host</h3> <p>The hostname of the SMTP server to connect to.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">localhost</code></p> <h3 class="badge enterprise" id="smtp_port">smtp_port</h3> <p>The port number on the SMTP server to connect to.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">25</code></p> <h3 class="badge enterprise" id="smtp_starttls">smtp_starttls</h3> <p>When set to <code class="language-plaintext highlighter-rouge">on</code>, STARTTLS is used to encrypt communication with the SMTP server. This is normally used in conjunction with port 587.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="smtp_username">smtp_username</h3> <p>Username used for authentication with SMTP server</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="smtp_password">smtp_password</h3> <p>Password used for authentication with SMTP server</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="smtp_ssl">smtp_ssl</h3> <p>When set to <code class="language-plaintext highlighter-rouge">on</code>, SMTPS is used to encrypt communication with the SMTP server. This is normally used in conjunction with port 465.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="smtp_auth_type">smtp_auth_type</h3> <p>The method used to authenticate with the SMTP server Valid options are <code class="language-plaintext highlighter-rouge">plain</code>, <code class="language-plaintext highlighter-rouge">login</code>, or <code class="language-plaintext highlighter-rouge">nil</code></p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="smtp_domain">smtp_domain</h3> <p>The domain used in the <code class="language-plaintext highlighter-rouge">EHLO</code> connection and part of the <code class="language-plaintext highlighter-rouge">Message-ID</code> header</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">localhost.localdomain</code></p> <h3 class="badge enterprise" id="smtp_timeout_connect">smtp_timeout_connect</h3> <p>The timeout (in milliseconds) for connecting to the SMTP server.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">60000</code></p> <h3 class="badge enterprise" id="smtp_timeout_send">smtp_timeout_send</h3> <p>The timeout (in milliseconds) for sending data to the SMTP server.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">60000</code></p> <h3 class="badge enterprise" id="smtp_timeout_read">smtp_timeout_read</h3> <p>The timeout (in milliseconds) for reading data from the SMTP server.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">60000</code></p> <h3 class="badge enterprise" id="smtp_admin_emails">smtp_admin_emails</h3> <p>Comma separated list of admin emails to receive notifications.</p> <p>Example <code class="language-plaintext highlighter-rouge">admin1@example.com, admin2@example.com</code></p> <p><strong>Default:</strong> none</p> <hr> <h2 id="data--admin-audit-section">Data & Admin Audit section</h2> <p>When enabled, Kong will store detailed audit data regarding Admin API and database access. In most cases, updates to the database are associated with Admin API requests. As such, database object audit log data is tied to a given HTTP via a unique identifier, providing built-in association of Admin API and database traffic.</p> <h3 id="audit_log">audit_log</h3> <p>When enabled, Kong will log information about Admin API access and database row insertions, updates, and deletes.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 id="audit_log_ignore_methods">audit_log_ignore_methods</h3> <p>Comma-separated list of HTTP methods that will not generate audit log entries. By default, all HTTP requests will be logged.</p> <p><strong>Default:</strong> none</p> <h3 id="audit_log_ignore_paths">audit_log_ignore_paths</h3> <p>Comma-separated list of request paths that will not generate audit log entries. By default, all HTTP requests will be logged.</p> <p><strong>Default:</strong> none</p> <h3 id="audit_log_ignore_tables">audit_log_ignore_tables</h3> <p>Comma-separated list of database tables that will not generate audit log entries. By default, updates to all database tables will be logged (the term “updates” refers to the creation, update, or deletion of a row).</p> <p><strong>Default:</strong> none</p> <h3 id="audit_log_payload_exclude">audit_log_payload_exclude</h3> <p>Comma-separated list of keys that will be filtered out of the payload. Keys that were filtered will be recorded in the audit log.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">token, secret, password</code></p> <h3 id="audit_log_record_ttl">audit_log_record_ttl</h3> <p>Length, in seconds, of the TTL for audit log records. Records in the database older than their TTL are automatically purged.</p> <p>Example, 30 days: <code class="language-plaintext highlighter-rouge">30 * 24 * 60 * 60 = 2592000</code></p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">2592000</code></p> <h3 id="audit_log_signing_key">audit_log_signing_key</h3> <p>Defines the path to a private RSA signing key that can be used to insert a signature of audit records, adjacent to the record. The corresponding public key should be stored offline, and can be used the validate audit entries in the future. If this value is undefined, no signature will be generated.</p> <p><strong>Default:</strong> none</p> <hr> <h2 id="granular-tracing-section">Granular Tracing section</h2> <blockquote class="warning"> <p><strong>Deprecation warning</strong>: Granular tracing is deprecated. This means the feature will eventually be removed.</p> </blockquote> <p>Our target for Granular tracing removal is the Kong Gateway 4.0 release.</p> <p>Granular tracing offers a mechanism to expose metrics and detailed debug data about the lifecycle of Kong in a human- or machine-consumable format.</p> <h3 class="badge enterprise" id="tracing">tracing</h3> <p>When enabled, Kong will generate granular debug data about various portions of the request lifecycle, such as DB or DNS queries, plugin execution, core handler timing, etc.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="tracing_write_strategy">tracing_write_strategy</h3> <p>Defines how Kong will write tracing data at the conclusion of the request. The default option, <code class="language-plaintext highlighter-rouge">file</code>, writes a human-readable depiction of tracing data to a configurable location on the node’s file system. Other strategies write tracing data as a JSON document to the configured endpoint. Valid entries for this option are <code class="language-plaintext highlighter-rouge">file</code>, <code class="language-plaintext highlighter-rouge">file_raw</code>, <code class="language-plaintext highlighter-rouge">http</code>, <code class="language-plaintext highlighter-rouge">tcp</code>, <code class="language-plaintext highlighter-rouge">tls</code>, and <code class="language-plaintext highlighter-rouge">udp</code>.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">file</code></p> <h3 class="badge enterprise" id="tracing_write_endpoint">tracing_write_endpoint</h3> <p>Defines the endpoint to which tracing data will be written.</p> <ul> <li>For the <code class="language-plaintext highlighter-rouge">file</code> and <code class="language-plaintext highlighter-rouge">file_raw</code> tracing write strategies, this value must be a valid location on the node’s file system to which Kong must have write access.</li> <li>For the <code class="language-plaintext highlighter-rouge">tcp</code>, <code class="language-plaintext highlighter-rouge">tls</code>, and <code class="language-plaintext highlighter-rouge">udp</code> strategies, this value is defined as a string in the form of: <code class="language-plaintext highlighter-rouge"><HOST>:<PORT></code> </li> <li>For the <code class="language-plaintext highlighter-rouge">http</code> strategy, this value is defined in the form of: <code class="language-plaintext highlighter-rouge"><scheme>://<IP / HOSTNAME>(:<PORT>(/<PATH>))</code> </li> </ul> <p>Traces sent via HTTP are delivered via POST method with an <code class="language-plaintext highlighter-rouge">application/json</code> Content-Type.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="tracing_time_threshold">tracing_time_threshold</h3> <p>The minimum time, in microseconds, over which a trace must execute in order to write the trace data to the configured endpoint. This configuration can be used to lower the noise present in trace data by removing trace objects that are not interesting from a timing perspective. The default value of <code class="language-plaintext highlighter-rouge">0</code> removes this limitation, causing traces of any duration to be written.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">0</code></p> <h3 class="badge enterprise" id="tracing_types">tracing_types</h3> <p>Defines the types of traces that are written.</p> <p>Trace types not defined in this list are ignored, regardless of their lifetime. The default special value of <code class="language-plaintext highlighter-rouge">all</code> results in all trace types being written, regardless of type.</p> <p>The following trace types are included:</p> <ul> <li> <code class="language-plaintext highlighter-rouge">query</code>: trace the database query</li> <li> <code class="language-plaintext highlighter-rouge">legacy_query</code>: (deprecated) trace the database query with legacy DAO</li> <li> <code class="language-plaintext highlighter-rouge">router</code>: trace Kong routing the request; internal routing time</li> <li> <code class="language-plaintext highlighter-rouge">balancer</code>: trace the execution of the overall balancer phase</li> <li> <code class="language-plaintext highlighter-rouge">balancer.getPeer</code>: trace Kong selecting an upstream peer from the ring-balancer</li> <li> <code class="language-plaintext highlighter-rouge">balancer.toip</code>: trace balancer to resolve peer’s host to IP</li> <li> <code class="language-plaintext highlighter-rouge">connect.toip</code>: trace cosocket to resolve target’s host to IP</li> <li> <code class="language-plaintext highlighter-rouge">access.before</code>: trace the preprocessing of access phase, like parameter parsing, route matching, and balance preparation</li> <li> <code class="language-plaintext highlighter-rouge">access.after</code>: trace the postprocess of access phase, like balancer execution and internal variable assigning</li> <li> <code class="language-plaintext highlighter-rouge">cassandra_iterate</code>: trace Cassandra driver to paginate over results</li> <li> <code class="language-plaintext highlighter-rouge">plugin</code>: trace plugins phase handlers</li> </ul> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">all</code></p> <h3 class="badge enterprise" id="tracing_debug_header">tracing_debug_header</h3> <p>Defines the name of the HTTP request header that must be present in order to generate traces within a request. Setting this value provides a mechanism to selectively generate request traces at the client’s request. Note that the value of the header does not matter, only that the header is present in the request. When this value is not set and tracing is enabled, Kong will generate trace data for all requests flowing through the proxy and Admin API. Note that data from certificate handling phases is not logged when this setting is enabled.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="generate_trace_details">generate_trace_details</h3> <p>When enabled, Kong will write context- specific details into traces. Trace details offer more data about the context of the trace. This can significantly increase the size of trace reports. Note also that trace details may contain potentially sensitive information, such as raw SQL queries; care should be taken to store traces properly when this option is enabled.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <hr> <h2 id="route-collision-detectionprevention-section">Route Collision Detection/Prevention section</h2> <h3 class="badge enterprise" id="route_validation_strategy">route_validation_strategy</h3> <p>The strategy used to validate routes when creating or updating them.</p> <p>Different strategies are available to tune how to enforce splitting traffic of workspaces.</p> <ul> <li> <code class="language-plaintext highlighter-rouge">smart</code> is the default option and uses the algorithm described in https://docs.konghq.com/gateway/latest/kong-enterprise/workspaces/</li> <li> <code class="language-plaintext highlighter-rouge">off</code> disables any check</li> <li> <code class="language-plaintext highlighter-rouge">path</code> enforces routes to comply with the pattern described in config enforce_route_path_pattern</li> </ul> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">smart</code></p> <h3 class="badge enterprise" id="enforce_route_path_pattern">enforce_route_path_pattern</h3> <p>Specifies the Lua pattern which will be enforced on the <code class="language-plaintext highlighter-rouge">paths</code> attribute of a Route object. You can also add a placeholder for the workspace in the pattern, which will be rendered during runtime based on the workspace to which the <code class="language-plaintext highlighter-rouge">route</code> belongs.</p> <p>This setting is only relevant if <code class="language-plaintext highlighter-rouge">route_validation_strategy</code> is set to <code class="language-plaintext highlighter-rouge">path</code>.</p> <p>Example For Pattern <code class="language-plaintext highlighter-rouge">/$(workspace)/v%d/.*</code> valid paths are:</p> <ol> <li> <p><code class="language-plaintext highlighter-rouge">/group1/v1/</code> if route belongs to workspace <code class="language-plaintext highlighter-rouge">group1</code>.</p> </li> <li> <p><code class="language-plaintext highlighter-rouge">/group2/v1/some_path</code> if route belongs to workspace <code class="language-plaintext highlighter-rouge">group2</code>.</p> </li> </ol> <p><strong>Default:</strong> none</p> <hr> <h2 id="database-encryption--keyring-management-section">Database Encryption & Keyring Management section</h2> <p>When enabled, Kong will transparently encrypt sensitive fields, such as Consumer credentials, TLS private keys, and RBAC user tokens, among others. A full list of encrypted fields is available from the Kong Enterprise documentation site.</p> <p>Encrypted data is transparently decrypted before being displayed to the Admin API or made available to plugins or core routing logic.</p> <p>While this feature is GA, do note that we currently do not provide normal semantic versioning compatibility guarantees on the keyring feature’s APIs in that Kong may make a breaking change to the feature in a minor version. Also note that mis-management of keyring data may result in irrecoverable data loss.</p> <h3 class="badge enterprise" id="keyring_enabled">keyring_enabled</h3> <p>When enabled, Kong will encrypt sensitive field values before writing them to the database, and subsuquently decrypt them when retrieving data for the Admin API, Developer Portal, or proxy business logic. Symmetric encryption keys are managed based on the strategy defined below.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="keyring_strategy">keyring_strategy</h3> <p>Defines the strategy implementation by which Kong nodes will manage symmetric encryption keys. Please see the Kong Enterprise documentation for a detailed description of each strategies. Acceptable values for this option are ‘cluster’ and ‘vault’.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">cluster</code></p> <h3 class="badge enterprise" id="keyring_public_key">keyring_public_key</h3> <p>Defines the public key of an RSA keypair.</p> <p>This keypair is used for symmetric keyring import/export, e.g., for disaster recovery and optional bootstrapping.</p> <p>Values:</p> <ul> <li>absolute path to the public key</li> <li>public key content</li> <li>base64 encoded public key content</li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="keyring_private_key">keyring_private_key</h3> <p>Defines the private key of an RSA keypair.</p> <p>This keypair is used for symmetric keyring import/export, e.g., for disaster recovery and optional bootstrapping.</p> <p>Values:</p> <ul> <li>absolute path to the private key</li> <li>private key content</li> <li>base64 encoded private key content</li> </ul> <p><strong>Default:</strong> none</p> <h3 id="keyring_recovery_public_key">keyring_recovery_public_key</h3> <p>Defines the public key to optionally encrypt all keyring materials and backup in the database.</p> <p>Values:</p> <ul> <li>absolute path to the public key</li> <li>public key content</li> <li>base64 encoded public key content</li> </ul> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="keyring_blob_path">keyring_blob_path</h3> <p>Defines the filesystem path at which Kong will backup the initial keyring material.</p> <p>This option is useful largely for development purposes.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="keyring_vault_host">keyring_vault_host</h3> <p>Defines the Vault host at which Kong will fetch the encryption material. This value should be defined in the format:</p> <p><code class="language-plaintext highlighter-rouge"><scheme>://<IP / HOSTNAME>:<PORT></code></p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="keyring_vault_mount">keyring_vault_mount</h3> <p>Defines the name of the Vault v2 KV secrets engine at which symmetric keys are found.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="keyring_vault_path">keyring_vault_path</h3> <p>Defines the names of the Vault v2 KV path at which symmetric keys are found.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="keyring_vault_auth_method">keyring_vault_auth_method</h3> <p>Defines the authentication mechanism when connecting to the HashiCorp Vault service.</p> <p>Accepted values are: <code class="language-plaintext highlighter-rouge">token</code>, or <code class="language-plaintext highlighter-rouge">kubernetes</code>:</p> <ul> <li> <p><code class="language-plaintext highlighter-rouge">token</code>: Uses the static token defined in the <code class="language-plaintext highlighter-rouge">keyring_vault_token</code> configuration property.</p> </li> <li> <p><code class="language-plaintext highlighter-rouge">kubernetes</code>: Uses the Kubernetes authentication mechanism, with the running pod’s mapped service account, to assume the HashiCorp Vault role name that is defined in the <code class="language-plaintext highlighter-rouge">keyring_vault_kube_role</code> configuration property.</p> </li> </ul> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">token</code></p> <h3 class="badge enterprise" id="keyring_vault_token">keyring_vault_token</h3> <p>Defines the token value used to communicate with the v2 KV Vault HTTP(S) API.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="keyring_vault_kube_role">keyring_vault_kube_role</h3> <p>Defines the HashiCorp Vault role that will be assumed using the Kubernetes service account of the running pod.</p> <p><code class="language-plaintext highlighter-rouge">keyring_vault_auth_method</code> must be set to <code class="language-plaintext highlighter-rouge">kubernetes</code> for this to activate.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">default</code></p> <h3 class="badge enterprise" id="keyring_vault_kube_api_token_file">keyring_vault_kube_api_token_file</h3> <p>Defines where the Kubernetes service account token should be read from the pod’s filesystem, if using a non-standard container platform setup.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">/run/secrets/kubernetes.io/serviceaccount/token</code></p> <h3 id="untrusted_lua">untrusted_lua</h3> <p>Controls loading of Lua functions from admin-supplied sources such as the Admin API. LuaJIT bytecode loading is always disabled.</p> <p><strong>Warning:</strong> LuaJIT is not designed as a secure runtime for running malicious code, therefore you should properly protect your Admin API endpoint even with sandboxing enabled. The sandbox only provides protection against trivial attackers or unintentional modification of the Kong global environment.</p> <p>Accepted values are: <code class="language-plaintext highlighter-rouge">off</code>, <code class="language-plaintext highlighter-rouge">sandbox</code>, or <code class="language-plaintext highlighter-rouge">on</code>:</p> <ul> <li> <p><code class="language-plaintext highlighter-rouge">off</code>: Disallow loading of any arbitrary Lua functions. The <code class="language-plaintext highlighter-rouge">off</code> option disables any functionality that runs arbitrary Lua code, including the Serverless Functions plugins and any transformation plugin that allows custom Lua functions.</p> </li> <li> <p><code class="language-plaintext highlighter-rouge">sandbox</code>: Allow loading of Lua functions, but use a sandbox when executing them. The sandboxed function has restricted access to the global environment and only has access to standard Lua functions that will generally not cause harm to the Kong Gateway node.</p> </li> <li> <p><code class="language-plaintext highlighter-rouge">on</code>: Functions have unrestricted access to the global environment and can load any Lua modules. This is similar to the behavior in Kong Gateway prior to 2.3.0.</p> </li> </ul> <p>The default <code class="language-plaintext highlighter-rouge">sandbox</code> environment does not allow importing other modules or libraries, or executing anything at the OS level (for example, file read/write). The global environment is also not accessible.</p> <p>Examples of <code class="language-plaintext highlighter-rouge">untrusted_lua = sandbox</code> behavior:</p> <ul> <li>You can’t access or change global values such as <code class="language-plaintext highlighter-rouge">kong.configuration.pg_password</code> * You can run harmless lua: <code class="language-plaintext highlighter-rouge">local foo = 1 + 1</code>. However, OS level functions are not allowed, like: <code class="language-plaintext highlighter-rouge">os.execute('rm -rf /*')</code>.</li> </ul> <p>For a full allowed/disallowed list, see: https://github.com/kikito/sandbox.lua/blob/master/sandbox.lua</p> <p>To customize the sandbox environment, use the <code class="language-plaintext highlighter-rouge">untrusted_lua_sandbox_requires</code> and <code class="language-plaintext highlighter-rouge">untrusted_lua_sandbox_environment</code> parameters below.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">sandbox</code></p> <h3 id="untrusted_lua_sandbox_requires">untrusted_lua_sandbox_requires</h3> <p>Comma-separated list of modules allowed to be loaded with <code class="language-plaintext highlighter-rouge">require</code> inside the sandboxed environment. Ignored if <code class="language-plaintext highlighter-rouge">untrusted_lua</code> is not <code class="language-plaintext highlighter-rouge">sandbox</code>.</p> <p>For example, say you have configured the Serverless pre-function plugin and it contains the following <code class="language-plaintext highlighter-rouge">requires</code>:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>local template = require "resty.template" local split = require "kong.tools.utils".split </code></pre></div></div> <p>To run the plugin, add the modules to the allowed list:</p> <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>untrusted_lua_sandbox_requires = resty.template, kong.tools.utils </code></pre></div></div> <p><strong>Warning:</strong> Allowing certain modules may create opportunities to escape the sandbox. For example, allowing <code class="language-plaintext highlighter-rouge">os</code> or <code class="language-plaintext highlighter-rouge">luaposix</code> may be unsafe.</p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="untrusted_lua_sandbox_environment">untrusted_lua_sandbox_environment</h3> <p>Comma-separated list of global Lua variables that should be made available inside the sandboxed environment. Ignored if <code class="language-plaintext highlighter-rouge">untrusted_lua</code> is not <code class="language-plaintext highlighter-rouge">sandbox</code>.</p> <p><strong>Warning</strong>: Certain variables, when made available, may create opportunities to escape the sandbox.</p> <p><strong>Default:</strong> none</p> <h3 id="openresty_path">openresty_path</h3> <p>Path to the OpenResty installation that Kong will use. When this is empty (the default), Kong determines the OpenResty installation by searching for a system-installed OpenResty and falling back to searching $PATH for the nginx binary.</p> <p>Setting this attribute disables the search behavior and explicitly instructs Kong which OpenResty installation to use.</p> <p><strong>Default:</strong> none</p> <hr> <h3 class="badge enterprise" id="node_id">node_id</h3> <p>Node ID for the Kong node. Every Kong node in a Kong cluster must have a unique and valid UUID. When empty, node ID is automatically generated.</p> <p>Default: none</p> <hr> <h3 class="badge enterprise" id="cluster_fallback_config_import">cluster_fallback_config_import</h3> <p>Enable fallback configuration imports</p> <p>This should only be enabled for data plane</p> <p>Default: <code class="language-plaintext highlighter-rouge">off</code></p> <hr> <h3 class="badge enterprise" id="cluster_fallback_config_import-1">cluster_fallback_config_import</h3> <p>Enable fallback configuration imports</p> <p>This should only be enabled for data plane</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="cluster_fallback_config_storage">cluster_fallback_config_storage</h3> <p>Storage definition used by <code class="language-plaintext highlighter-rouge">cluster_fallback_config_import</code> and <code class="language-plaintext highlighter-rouge">cluster_fallback_config_export</code></p> <p>Currently supported storage type: S3-like storages and GCP storage service.</p> <p>To use S3 with a bucket named b and place all configs to with a key prefix named p, set it to: s3://b/p To use GCP for the same bucket and prefix, set it to: gcs://b/p</p> <p>The credentials (and endpoint URL for S3-like) for S3 are passing with environment variables: <code class="language-plaintext highlighter-rouge">AWS_ACCESS_KEY_ID</code> and <code class="language-plaintext highlighter-rouge">AWS_SECRET_ACCESS_KEY</code> and <code class="language-plaintext highlighter-rouge">AWS_CONFIG_STORAGE_ENDPOINT</code> (extension), where <code class="language-plaintext highlighter-rouge">AWS_CONFIG_STORAGE_ENDPOINT</code> is the endpoint that hosts S3-like storage.</p> <p>The credentials for GCP is provided via the environment variable <code class="language-plaintext highlighter-rouge">GCP_SERVICE_ACCOUNT</code></p> <p><strong>Default:</strong> none</p> <h3 class="badge enterprise" id="cluster_fallback_config_export">cluster_fallback_config_export</h3> <p>Enable fallback configuration exports.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">off</code></p> <h3 class="badge enterprise" id="cluster_fallback_config_export_delay">cluster_fallback_config_export_delay</h3> <p>The fallback configuration export interval.</p> <p>If it’s set to 60 and configuration A is exported and there’re new configurations B, C and D in the next 60 seconds, it will wait until 60 seconds passed and export D, skipping B and C.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">60</code></p> <h3 id="max_queued_batches">max_queued_batches</h3> <p>Maximum number of batches to keep on an internal plugin queue before dropping old batches. This is meant as a global, last-resort control to prevent queues from consuming infinite memory. When batches are being dropped, an error message “exceeded max_queued_batches (%d), dropping oldest” will be logged. The error message will also include a string that identifies the plugin causing the problem. Queues are used by the http-log, statsd, opentelemetry and datadog plugins.</p> <p><strong>Default:</strong> <code class="language-plaintext highlighter-rouge">100</code></p> </div> </div> </div> <div id="scroll-to-top-button"> <i class="fas fa-chevron-up"></i> </div> <div class="feedback-widget-container"> <input id="feedback-widget-checkbox" type="checkbox"> <label for="feedback-widget-checkbox"> <img src="/assets/images/icons/feedback-widget.svg" alt="Feedback widget"> </label> <div class="feedback-container"> <div class="feedback-thankyou"> Thank you for your feedback. </div> <div class="feedback-comment"> <textarea id="feedback-comment-text" rows="3" placeholder="Please let us know what we can improve on this page..."></textarea> <div class="feedback-comment-buttons"> <button id="feedback-comment-button-back">Back</button> <button id="feedback-comment-button-submit" class="button-primary">Submit</button> </div> </div> <div class="feedback-options"> <div class="feedback-options-title">Was this page useful?</div> <div class="feedback-options-buttons"> <i data-feedback-result="yes" class="feedback-options-button far fa-thumbs-up"></i> <i data-feedback-result="no" class="feedback-options-button far fa-thumbs-down"></i> </div> </div> </div> </div> </div> <div id="image-modal" data-image-expand-disabled=""> <div class="image-modal-backdrop"></div> <div class="image-container"> <img src="" alt=""> <i class="fa fa-times"></i> </div> </div> <div class="modal closed" id="modal" role="dialog" aria-hidden="true" aria-labelledby="title" aria-describedby="description"> <div class="konnect-cta-card"> <div class="title"> Too much on your plate? <a href="#" class="cta-card-close modal-close" id="modal-close"> <img src="/assets/images/icons/documentation/close.svg" alt="close cta icon"> </a> </div> <div class="description"> More features, less infrastructure with Kong Konnect. 1M requests per month for free. </div> <a href="https://konghq.com/products/kong-konnect/register?utm_medium=referral&utm_source=docs&utm_campaign=gateway-konnect&utm_campaign=right-nav-card&utm_content=gateway" class="button" target="_blank" rel="noopener nofollow noreferrer "> Try it for Free </a> </div> </div> <div id="modal-open" class="modal-open"></div> <div class="modal-overlay closed" id="modal-overlay"></div> <footer class="marketing-footer--light-gray"> <section> <ul class="newsletter"> <li class="logo-wrapper"> <div class="logo"> <img src="/assets/images/logos/konglogo-light-theme-primary.svg" alt="Kong"> </div> <div class="footer-title">Powering the API world</div> <p> Increase developer productivity, security, and performance at scale with the unified platform for API management, service mesh, and ingress controller. </p> <div class="footer-form-container"> <form id="subscribe-form" method="POST" action="/assets/javascripts/subscribe.js"> <input required id="subscribe-input" type="email" name="email" placeholder="Email" aria-required="true" aria-invalid="false"> <input id="footer-form-button" type="submit" form="subscribe-form" value="Subscribe"> </form> <div id="form-response"></div> </div> </li> <li class="footer-columns"> <ul class="footer-columns-product-list"> <li> <nav> <div class="footer-category">Products</div> <ul> <li> <a href="https://konghq.com/products/kong-konnect" target="_blank" rel="noopener nofollow noreferrer ">Kong Konnect</a> </li> <li> <a href="https://konghq.com/products/kong-enterprise" target="_blank" rel="noopener nofollow noreferrer ">Kong Gateway Enterprise</a> </li> <li> <a href="https://konghq.com/products/kong-gateway" target="_blank" rel="noopener nofollow noreferrer ">Kong Gateway</a> </li> <li> <a href="https://konghq.com/products/kong-mesh" target="_blank" rel="noopener nofollow noreferrer ">Kong Mesh</a> </li> <li> <a href="https://konghq.com/products/kong-ingress-controller" target="_blank" rel="noopener nofollow noreferrer ">Kong Ingress Controller</a> </li> <li> <a href="https://insomnia.rest/" target="_blank" rel="noopener nofollow noreferrer noopener nofollow noreferrer">Kong Insomnia</a> </li> <li> <a href="https://konghq.com/product-updates" target="_blank" rel="noopener nofollow noreferrer ">Product Updates</a> </li> <li> <a href="https://konghq.com/contact-sales" target="_blank" rel="noopener nofollow noreferrer ">Get Started</a> </li> </ul> </nav> </li> <li> <nav> <div class="footer-category">Documentation</div> <ul> <li> <a href="/konnect/">Kong Konnect Docs</a> </li> <li> <a href="/gateway/latest/">Kong Gateway Docs</a> </li> <li> <a href="/gateway/latest/kong-enterprise/">Kong Gateway Enterprise Docs</a> </li> <li> <a href="/mesh/latest/">Kong Mesh Docs</a> </li> <li> <a href="https://docs.insomnia.rest/" target="_blank" rel="noopener nofollow noreferrer noopener nofollow noreferrer">Kong Insomnia Docs</a> </li> <li> <a href="/hub/">Kong Konnect Plugin Hub</a> </li> </ul> </nav> </li> <li> <nav> <div class="footer-category">Open Source</div> <ul> <li> <a href="https://konghq.com/install/#kong-community" target="_blank" rel="noopener nofollow noreferrer ">Kong Gateway</a> </li> <li> <a href="https://kuma.io/" target="_blank" rel="noopener nofollow noreferrer noopener nofollow noreferrer">Kuma</a> </li> <li> <a href="https://insomnia.rest/" target="_blank" rel="noopener nofollow noreferrer noopener nofollow noreferrer">Insomnia</a> </li> <li> <a href="https://konghq.com/community" target="_blank" rel="noopener nofollow noreferrer ">Kong Community</a> </li> </ul> </nav> </li> <li> <nav> <div class="footer-category">Company</div> <ul> <li> <a href="https://konghq.com/company/about-us" target="_blank" rel="noopener nofollow noreferrer ">About Kong</a> </li> <li> <a href="https://konghq.com/customers" target="_blank" rel="noopener nofollow noreferrer ">Customers</a> </li> <li> <a href="https://konghq.com/company/careers" target="_blank" rel="noopener nofollow noreferrer ">Careers</a> </li> <li> <a href="https://konghq.com/press-room" target="_blank" rel="noopener nofollow noreferrer ">Press</a> </li> <li> <a href="https://konghq.com/events" target="_blank" rel="noopener nofollow noreferrer ">Events</a> </li> <li> <a href="https://konghq.com/company/contact-us" target="_blank" rel="noopener nofollow noreferrer ">Contact</a> </li> </ul> </nav> </li> </ul> </li> </ul> </section> <section class="legal"> <div class="container d-flex"> <div class="social"> <div class="social-link"> <a href="https://www.facebook.com/konghq/" title="Facebook" target="_blank" rel="noopener nofollow noreferrer "><i aria-label="Facebook" class="fa fa-facebook-official" aria-hidden="true"></i></a> </div> <div class="social-link"> <a href="https://twitter.com/thekonginc" title="Twitter" target="_blank" rel="noopener nofollow noreferrer "><i aria-label="Twitter" class="fa fa-twitter" aria-hidden="true"></i></a> </div> <div class="social-link"> <a href="https://www.meetup.com/topics/kong/all/" title="Meetup" target="_blank" rel="noopener nofollow noreferrer "><i aria-label="Meetup" class="fa fa-meetup" aria-hidden="true"></i></a> </div> <div class="social-link"> <a href="https://linkedin.com/company/278819" title="LinkedIn" target="_blank" rel="noopener nofollow noreferrer "><i aria-label="GitHub" class="fa fa-linkedin" aria-hidden="true"></i></a> </div> <div class="social-link"> <a href="https://github.com/kong/kong" target="_blank" class="btn-gh" title="GitHub" rel="noopener nofollow noreferrer "> <i class="fa fa-github" aria-hidden="true" aria-label="GitHub"></i> </a> </div> </div> <ul> <li> <span class="mashape-footer-content"> <a href="https://konghq.com/legal/terms-of-use" target="_blank" rel="noopener nofollow noreferrer ">Terms</a><b>•</b> <a href="https://konghq.com/legal/privacy-policy" target="_blank" rel="noopener nofollow noreferrer ">Privacy</a><b>•</b> <a href="https://konghq.com/compliance" target="_blank" rel="noopener nofollow noreferrer ">Trust and Compliance</a> </span> </li> </ul> <div> <span>© Kong Inc. 2025 </span> </div> </div> </section> </footer> <script> var anchorForId = function (id) { var anchor = document.createElement("a"); anchor.className = "header-link"; anchor.href = "#" + id; anchor.innerHTML = "<i class=\"fa fa-link\"></i>"; anchor.title = `${id} Permalink`; return anchor; }; document.onreadystatechange = function () { if (this.readyState === "complete") { var className = ".show-anchor-links h1, .show-anchor-links h2, .show-anchor-links h3, " + ".show-anchor-links h4, .show-anchor-links h5, .show-anchor-links h6"; var headers = document.querySelectorAll(className); for (var i = 0; i < headers.length; i++) { var header = headers[i]; if (typeof header.id !== "undefined" && header.id !== "") { header.prepend(anchorForId(header.id)); } } } }; </script> <script> !function(){var i="analytics",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error("Segment snippet included twice.");else{analytics.invoked=!0;analytics.methods=["trackSubmit","trackClick","trackLink","trackForm","pageview","identify","reset","group","track","ready","alias","debug","page","screen","once","off","on","addSourceMiddleware","addIntegrationMiddleware","setAnonymousId","addDestinationMiddleware","register"];analytics.factory=function(e){return function(){if(window[i].initialized)return window[i][e].apply(window[i],arguments);var n=Array.prototype.slice.call(arguments);if(["track","screen","alias","group","page","identify"].indexOf(e)>-1){var c=document.querySelector("link[rel='canonical']");n.push({__t:"bpc",c:c&&c.getAttribute("href")||void 0,p:location.pathname,u:location.href,s:location.search,t:document.title,r:document.referrer})}n.unshift(e);analytics.push(n);return analytics}};for(var n=0;n<analytics.methods.length;n++){var key=analytics.methods[n];analytics[key]=analytics.factory(key)}analytics.load=function(key,n){var t=document.createElement("script");t.type="text/javascript";t.async=!0;t.setAttribute("data-global-segment-analytics-key",i);t.src="https://cdn.segment.com/analytics.js/v1/" + key + "/analytics.min.js";var r=document.getElementsByTagName("script")[0];r.parentNode.insertBefore(t,r);analytics._loadOptions=n};analytics._writeKey="X7EZTdbdUKQ8M6x42SHHPWiEhjsfs1EQ";;analytics.SNIPPET_VERSION="5.2.0"; analytics.load("X7EZTdbdUKQ8M6x42SHHPWiEhjsfs1EQ"); analytics.page(); }}(); </script> <div id="fb-root"></div> <script id="github-bjs" src="https://buttons.github.io/buttons.js" async defer></script> <script type="text/javascript"> var _vwo_code = (function() { var account_id = 125292, settings_tolerance = 2000, library_tolerance = 2500, use_existing_jquery = true, // DO NOT EDIT BELOW THIS LINE f = false, d = document; return { use_existing_jquery: function() { return use_existing_jquery; }, library_tolerance: function() { return library_tolerance; }, finish: function() { if (!f) { f = true; var a = d.getElementById('_vis_opt_path_hides'); if (a) a.parentNode.removeChild(a); } }, finished: function() { return f; }, load: function(a) { var b = d.createElement('script'); b.src = a; b.type = 'text/javascript'; b.innerText; b.onerror = function() { _vwo_code.finish(); }; d.getElementsByTagName('head')[0].appendChild(b); }, init: function() { settings_timer = setTimeout( '_vwo_code.finish()', settings_tolerance ); this.load( '//dev.visualwebsiteoptimizer.com/j.php?a=' + account_id + '&u=' + encodeURIComponent(d.URL) + '&r=' + Math.random() ); var a = d.createElement('style'), b = '', h = d.getElementsByTagName('head')[0]; a.setAttribute('id', '_vis_opt_path_hides'); a.setAttribute('type', 'text/css'); if (a.styleSheet) a.styleSheet.cssText = b; else a.appendChild(d.createTextNode(b)); h.appendChild(a); return settings_timer; } }; })(); _vwo_settings_timer = _vwo_code.init(); </script> <script src="https://cdn.jsdelivr.net/npm/@docsearch/js@3"></script> <script type="text/javascript"> docsearch({ appId: '05Y6TLHNFZ', apiKey: '80483bfe28d9fd036a11a6f6a06454f8', indexName: 'konghq', container: '#getkong-algolia-search-input', disableUserPersonalization: true, placeholder: 'Search the docs...', // Override selected event to allow for local environment navigation transformItems(items) { return items.map((item) => { var modifiedUrl = window.location.protocol + '//' + window.location.host + item.url.split('docs.konghq.com')[1]; return { ...item, url: modifiedUrl }; }); }, translations: { button: { buttonText: 'Search the docs..', buttonAriaLabel: 'Search the docs...' } }, resultsFooterComponent({ state }) { var facetParameters = {}; facetParameters = {"version[0]":"3.3.x","product[0]":"Kong Gateway"}; var queryParams = new URLSearchParams(facetParameters); queryParams.set('query', state.query); return { // The HTML `tag` type: 'a', ref: undefined, constructor: undefined, key: state.query, // Its props props: { href: `/search/?${queryParams.toString()}`, target: '_blank', // Raw text rendered in the HTML element children: 'See more >' }, __v: null, }; }, searchParameters: { optionalFilters: ['product:deck<score=1>', 'product:Plugin Hub<score=2>', 'product:Kong Gateway<score=3>'], facetFilters: [ 'version:3.3.x'] } }); </script> <script> (function() { if (typeof window === 'undefined') return; if (typeof window.signals !== 'undefined') return; var script = document.createElement('script'); script.src = 'https://cdn.cr-relay.com/v1/site/993c7a0d-caec-465c-be46-2d3a78ab60c5/signals.js'; script.async = true; window.signals = Object.assign( [], ['page', 'identify', 'form'].reduce(function (acc, method){ acc[method] = function () { signals.push([method, arguments]); return signals; }; return acc; }, {}) ); document.head.appendChild(script); })(); </script> </div> </body> </html>

CINXE.COM

Configuration Reference for Kong Gateway - v3.3.x | Kong Docs