Request Rule Validator: Enforce a consumer group naming convention - Policy

Enforce a consumer group naming conventionv1.3+

This Request Rule Validator policy requires every consumer group ID to start with team-a..

Kafka clients use a group ID in more than one request type, so the policy applies the same rule to all of them:

join_group: A consumer joins a group with the classic consumer group protocol.
consumer_group_heartbeat: A consumer joins a group and stays in it with the modern consumer group protocol.
offset_commit: A client commits offsets for a group. Clients can commit offsets without joining the group first.
offset_fetch: A client reads the committed offsets of a group.
txn_offset_commit: A transactional producer commits offsets for a group as part of a transaction.

When a group ID doesn’t match the rule, Event Gateway rejects the request with the Kafka POLICY_VIOLATION error code. If a single offset_fetch request carries more than one group, Event Gateway rejects only the groups that don’t match.

Set up the policy

curl -X POST https://{region}.api.konghq.com/v1/event-gateways/{eventGatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "group_naming_policy",
      "type": "request_rule_validator",
      "config": {
        "requests": [
          {
            "type": "join_group",
            "rules": [
              {
                "description": "Consumer group ID must start with \"team-a.\"",
                "rule": "{{context.group.id.startsWith(\"team-a.\")}}",
                "action": "reject"
              }
            ]
          },
          {
            "type": "consumer_group_heartbeat",
            "rules": [
              {
                "description": "Consumer group ID must start with \"team-a.\"",
                "rule": "{{context.group.id.startsWith(\"team-a.\")}}",
                "action": "reject"
              }
            ]
          },
          {
            "type": "offset_commit",
            "rules": [
              {
                "description": "Consumer group ID must start with \"team-a.\"",
                "rule": "{{context.group.id.startsWith(\"team-a.\")}}",
                "action": "reject"
              }
            ]
          },
          {
            "type": "offset_fetch",
            "rules": [
              {
                "description": "Consumer group ID must start with \"team-a.\"",
                "rule": "{{context.group.id.startsWith(\"team-a.\")}}",
                "action": "reject"
              }
            ]
          },
          {
            "type": "txn_offset_commit",
            "rules": [
              {
                "description": "Consumer group ID must start with \"team-a.\"",
                "rule": "{{context.group.id.startsWith(\"team-a.\")}}",
                "action": "reject"
              }
            ]
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
virtualClusterId: The id of the Virtual Cluster.
eventGatewayId: The id of the Event Gateway.
eventGatewayListenerId: The id of the Event Gateway Listener.

See the Konnect Event Gateway API reference to learn about region-specific URLs and personal access tokens.

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect-beta = {
      source  = "kong/konnect-beta"
    }
  }
}

provider "konnect-beta" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration:

resource "konnect_event_gateway_cluster_policy_request_rule_validator" "my_virtual_cluster_policy_request_rule_validator" {
  provider = konnect-beta
  type = "request_rule_validator"
  config = {
    requests = [
      {
        type = "join_group"
        rules = [
          {
            description = "Consumer group ID must start with \"team-a.\""
            rule = "{{context.group.id.startsWith(\"team-a.\")}}"
            action = "reject"
          }        ]
      }, 

      {
        type = "consumer_group_heartbeat"
        rules = [
          {
            description = "Consumer group ID must start with \"team-a.\""
            rule = "{{context.group.id.startsWith(\"team-a.\")}}"
            action = "reject"
          }        ]
      }, 

      {
        type = "offset_commit"
        rules = [
          {
            description = "Consumer group ID must start with \"team-a.\""
            rule = "{{context.group.id.startsWith(\"team-a.\")}}"
            action = "reject"
          }        ]
      }, 

      {
        type = "offset_fetch"
        rules = [
          {
            description = "Consumer group ID must start with \"team-a.\""
            rule = "{{context.group.id.startsWith(\"team-a.\")}}"
            action = "reject"
          }        ]
      }, 

      {
        type = "txn_offset_commit"
        rules = [
          {
            description = "Consumer group ID must start with \"team-a.\""
            rule = "{{context.group.id.startsWith(\"team-a.\")}}"
            action = "reject"
          }        ]
      }    ]
  }


  virtual_cluster_id = konnect_event_gateway_virtual_cluster.my_virtual_cluster.id

  gateway_id = konnect_event_gateway.my_event_gateway.id
}

Copied!

The following example creates a new request_rule_validator policy.

kongctl

event_gateway_policy.yaml

Copied!

event_gateways:
  - ref: eventGatewayName
    name: eventGatewayName
    virtual_clusters:
    - ref: virtualClusterName
      name: virtualClusterName
      cluster_policies:
      - ref: group_naming_policy
        type: request_rule_validator
        request_rule_validator:
          name: group_naming_policy
          config:
            requests:
            - type: join_group
              rules:
              - description: Consumer group ID must start with "team-a."
                rule: '{{context.group.id.startsWith("team-a.")}}'
                action: reject
            - type: consumer_group_heartbeat
              rules:
              - description: Consumer group ID must start with "team-a."
                rule: '{{context.group.id.startsWith("team-a.")}}'
                action: reject
            - type: offset_commit
              rules:
              - description: Consumer group ID must start with "team-a."
                rule: '{{context.group.id.startsWith("team-a.")}}'
                action: reject
            - type: offset_fetch
              rules:
              - description: Consumer group ID must start with "team-a."
                rule: '{{context.group.id.startsWith("team-a.")}}'
                action: reject
            - type: txn_offset_commit
              rules:
              - description: Consumer group ID must start with "team-a."
                rule: '{{context.group.id.startsWith("team-a.")}}'
                action: reject

Make sure to replace the following placeholders with your own values:

eventGatewayName: The name of your Event Gateway.
virtualClusterName: The name of the Virtual Cluster.

Request Rule Validator

Enforce a consumer group naming conventionv1.3+

Set up the policy

Help us make these docs great!

Still need help?