Kong Gateway Plugins Compatibility

Uses: Kong Gateway

Related Documentation

Related Resources

Plugin Hub

See the following table for supported deployment topologies and Data Plane hosting options in Konnect per plugin:

Plugin	Self-managed	Konnect	Notes
ACL (`acl`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
ACME (`acme`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways`	Serverless Gateways: This plugin is not supported in serverless gateways because the TLS handshake does not occur at the Kong layer in this setup.
AI AWS Guardrails (`ai-aws-guardrails`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Azure Content Safety (`ai-azure-content-safety`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI GCP Model Armor (`ai-gcp-model-armor`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI LLM as Judge (`ai-llm-as-judge`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI MCP OAuth2 (`ai-mcp-oauth2`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI MCP Proxy (`ai-mcp-proxy`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Prompt Compressor (`ai-prompt-compressor`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Prompt Decorator (`ai-prompt-decorator`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Prompt Guard (`ai-prompt-guard`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Prompt Template (`ai-prompt-template`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Proxy (`ai-proxy`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Proxy Advanced (`ai-proxy-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI RAG Injector (`ai-rag-injector`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Rate Limiting Advanced (`ai-rate-limiting-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	In DB-less, hybrid mode, and Konnect, the `cluster` config strategy is not supported. Use `redis` instead. In Serverless gateways only the `local` config strategy is supported.
AI Request Transformer (`ai-request-transformer`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Response Transformer (`ai-response-transformer`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI PII Sanitizer (`ai-sanitizer`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Semantic Cache (`ai-semantic-cache`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Semantic Prompt Guard (`ai-semantic-prompt-guard`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AI Semantic Response Guard (`ai-semantic-response-guard`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
AppDynamics (`app-dynamics`)	`hybrid` `db-less` `traditional`	`hybrid`	Dedicated Cloud Gateways: This plugin is not supported in Dedicated or Serverless Cloud Gateways because it depends on a local agent, and there are no local nodes in Dedicated or Serverless Cloud Gateways.
AWS Lambda (`aws-lambda`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	Dedicated Cloud Gateways: If you use the IAM assumeRole functionality with this plugin, it must be configured differently than for hybrid deployments in Konnect.
Azure Functions (`azure-functions`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Basic Auth (`basic-auth`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Bot Detection (`bot-detection`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Canary Release (`canary`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	The Canary plugin is not designed for a Kubernetes-native framework, and shouldn’t be used with the Kong Ingress Controller. Instead, use the Gateway API to manage canary deploys.
Confluent (`confluent`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Confluent Consume (`confluent-consume`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Correlation ID (`correlation-id`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
CORS (`cors`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Datadog (`datadog`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Datakit (`datakit`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
DeGraphQL (`degraphql`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Exit Transformer (`exit-transformer`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
File Log (`file-log`)	`hybrid` `db-less` `traditional`	`hybrid`	Dedicated Cloud Gateways: This plugin is not supported in Dedicated or Serverless Cloud Gateways because it depends on a local agent, and there are no local nodes in Dedicated or Serverless Cloud Gateways.
Forward Proxy Advanced (`forward-proxy`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
GraphQL Proxy Caching Advanced (`graphql-proxy-cache-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	This plugin’s API doesn’t work in hybrid mode, as it targets data that only exists on data planes, and data planes can’t use Kong’s Admin API. In Serverless gateways only the `memory` config strategy is supported.
GraphQL Rate Limiting Advanced (`graphql-rate-limiting-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways`	In DB-less, hybrid mode, and Konnect, the `cluster` config strategy is not supported. Use `redis` instead.
gRPC-Gateway (`grpc-gateway`)	`hybrid` `db-less` `traditional`	`hybrid` `serverless`
gRPC-Web (`grpc-web`)	`hybrid` `db-less` `traditional`	`hybrid` `serverless`
Header Cert Authentication (`header-cert-auth`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways`
HMAC Auth (`hmac-auth`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
HTTP Log (`http-log`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Injection Protection (`injection-protection`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
IP Restriction (`ip-restriction`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
jq (`jq`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
JSON Threat Protection (`json-threat-protection`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
JWE Decrypt (`jwe-decrypt`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
JWT (`jwt`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
JWT Signer (`jwt-signer`)	`hybrid` `db-less` `traditional`	Not supported in Konnect.
Kafka Consume (`kafka-consume`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Kafka Log (`kafka-log`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Kafka Upstream (`kafka-upstream`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Key Auth (`key-auth`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	This setting determines the length of time a credential remains valid.
Key Authentication - Encrypted (`key-auth-enc`)	`hybrid` `db-less` `traditional`	Not supported in Konnect.	This plugin is not available in Konnect: Konnect automatically encrypts key authentication credentials at rest, so encryption via this plugin is not necessary. Use the regular Key Auth plugin instead. This setting determines the length of time a credential remains valid.
LDAP Authentication (`ldap-auth`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
LDAP Authentication Advanced (`ldap-auth-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Loggly (`loggly`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Mocking (`mocking`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Mutual TLS Authentication (`mtls-auth`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways`	Serverless Gateways: This plugin is not supported in serverless gateways because the TLS handshake does not occur at the Kong layer in this setup.
OAS Validation (`oas-validation`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
OAuth 2.0 Authentication (`oauth2`)	`traditional`	Not supported in Konnect.	This plugin can’t be used in Konnect, hybrid, or DB-less modes. It needs to generate and delete tokens, and commit those changes to a database on the same node.
OAuth 2.0 Introspection (`oauth2-introspection`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
OPA (`opa`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
OpenID Connect (`openid-connect`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	In Serverless gateways, only the `cookie` config session storage is supported.
OpenTelemetry (`opentelemetry`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Post-Function (`post-function`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Pre-Function (`pre-function`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Prometheus (`prometheus`)	`hybrid` `db-less` `traditional`	`hybrid`	Dedicated and Serverless Cloud Gateways: This plugin is not supported in Dedicated or Serverless Cloud Gateways because it depends on the Admin API and the Status API, which aren’t accessible in that setup.
Proxy Cache (`proxy-cache`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Proxy Caching Advanced (`proxy-cache-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	In Serverless gateways only the `memory` config strategy is supported.
Rate Limiting (`rate-limiting`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	In Konnect, DB-less, and hybrid modes, the `cluster` config policy is not supported. For DB-less mode, use one of `redis` or `local`; for Konnect and hybrid mode, use `redis`, or `local` for data planes only. In Serverless gateways only the `local` config policy is supported.
Rate Limiting Advanced (`rate-limiting-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	In Konnect, DB-less, and hybrid modes, the `cluster` config strategy is not supported. For DB-less mode, use one of `redis` or `local`; for Konnect and hybrid mode, use `redis`, or `local` for data planes only. In Serverless gateways only the `local` config strategy is supported.
Redirect (`redirect`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Request Callout (`request-callout`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Request Size Limiting (`request-size-limiting`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Request Termination (`request-termination`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Request Transformer (`request-transformer`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Request Transformer Advanced (`request-transformer-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Request Validator (`request-validator`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Response Rate Limiting (`response-ratelimiting`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	In Konnect, DB-less, and hybrid modes, the `cluster` config policy is not supported. For DB-less mode, use one of `redis` or `local`; for Konnect and hybrid mode, use `redis`, or `local` for data planes only. In Serverless gateways only the `local` config policy is supported.
Response Transformer (`response-transformer`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Response Transformer Advanced (`response-transformer-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Route By Header (`route-by-header`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Route Transformer Advanced (`route-transformer-advanced`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
SAML (`saml`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	In Serverless gateways only the `cookie` config session storage is supported.
Service Protection (`service-protection`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	This plugin doesn’t support cluster policies. If you want to use this plugin in hybrid mode or in Konnect, use Redis for storage.
Session (`session`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Solace Consume (`solace-consume`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Solace Log (`solace-log`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Solace Upstream (`solace-upstream`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Standard Webhooks (`standard-webhooks`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
StatsD (`statsd`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Syslog (`syslog`)	`hybrid` `db-less` `traditional`	`hybrid`	Dedicated and Serverless Cloud Gateways: This plugin is not supported in Dedicated or Serverless Cloud Gateways because it depends on a local agent, and there are no local nodes in Dedicated or Serverless Cloud Gateways.
TCP Log (`tcp-log`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
TLS Handshake Modifier (`tls-handshake-modifier`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways`	Serverless Gateways: This plugin is not supported in serverless gateways because the TLS handshake does not occur at the Kong layer in this setup.
TLS Metadata Headers (`tls-metadata-headers`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways`	Serverless Gateways: This plugin is not supported in serverless gateways because the TLS handshake does not occur at the Kong layer in this setup.
UDP Log (`udp-log`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Upstream OAuth (`upstream-oauth`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`	In Serverless gateways only the `memory` cache strategy is supported.
Upstream Timeout (`upstream-timeout`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Vault Authentication (`vault-auth`)	`hybrid` `db-less` `traditional`	Not supported in Konnect.
WebSocket Size Limit (`websocket-size-limit`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
WebSocket Validator (`websocket-validator`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
XML Threat Protection (`xml-threat-protection`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`
Zipkin (`zipkin`)	`hybrid` `db-less` `traditional`	`hybrid` `cloud-gateways` `serverless`

Kong Gateway Plugins Compatibility

Help us make these docs great!

Still need help