Datakit: Route requests to different upstreams based on the authenticated caller - Plugin

Route requests to different upstreams based on the authenticated callerv3.14+

Map an authenticated credential to a named Upstream entity and override the backend per request. This example works together with the OpenID Connect plugin, which validates a bearer token and extracts a token claim (such as client_id) as a virtual credential. Datakit then reads that credential and uses its value to select an upstream.

This example contains the following nodes:

GET_CREDENTIAL reads the kong.client.credential object that the OpenID Connect plugin populated.
PICK_UPSTREAM uses a jq map to look up the credential’s .id field and return the matching upstream name. Unknown callers fall through to upstream-default.
SET_UPSTREAM writes the resolved upstream name to kong.service.upstream, overriding the backend for this request.

For a complete tutorial, see Route requests to different upstreams based on the authenticated caller.

Note: The OpenID Connect plugin has a higher static priority than Datakit, so it always runs first in the access phase. No explicit plugin ordering configuration is required.

Prerequisites

You have configured the OpenID Connect plugin with credential_claim pointing to a token claim (such as client_id) and consumer_optional: true.
You have created named Upstream entities for each caller and a fallback upstream.

Set up the plugin

Add this section to your kong.yaml configuration file:

kong.yaml

Copied!

_format_version: "3.0"
plugins:
  - name: datakit
    config:
      nodes:
      - name: GET_CREDENTIAL
        type: property
        property: kong.client.credential
      - name: PICK_UPSTREAM
        type: jq
        input: GET_CREDENTIAL
        jq: |
          {
            "caller-a": "upstream-a",
            "caller-b": "upstream-b"
          }[.id] // "upstream-default"
      - name: SET_UPSTREAM
        type: property
        property: kong.service.upstream
        input: PICK_UPSTREAM

Make the following request:

curl -i -X POST http://localhost:8001/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
controlPlaneId: The id of the control plane.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: datakit
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: 'true'
config:
  nodes:
  - name: GET_CREDENTIAL
    type: property
    property: kong.client.credential
  - name: PICK_UPSTREAM
    type: jq
    input: GET_CREDENTIAL
    jq: |
      {
        'caller-a': 'upstream-a',
        'caller-b': 'upstream-b'
      }[.id] // 'upstream-default'
  - name: SET_UPSTREAM
    type: property
    property: kong.service.upstream
    input: PICK_UPSTREAM
plugin: datakit
" | kubectl apply -f -

Copied!

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_datakit" "my_datakit" {
  enabled = true

  config = {
    nodes = [
      {
        name = "GET_CREDENTIAL"
        type = "property"
        property = "kong.client.credential"
      }, 

      {
        name = "PICK_UPSTREAM"
        type = "jq"
        input = "GET_CREDENTIAL"
        jq = <<EOF
{
  "caller-a": "upstream-a",
  "caller-b": "upstream-b"
}[.id] // "upstream-default"
EOF
      }, 

      {
        name = "SET_UPSTREAM"
        type = "property"
        property = "kong.service.upstream"
        input = "PICK_UPSTREAM"
      }    ]
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

Copied!

Add this section to your kong.yaml configuration file:

kong.yaml

Copied!

_format_version: "3.0"
plugins:
  - name: datakit
    service: serviceName|Id
    config:
      nodes:
      - name: GET_CREDENTIAL
        type: property
        property: kong.client.credential
      - name: PICK_UPSTREAM
        type: jq
        input: GET_CREDENTIAL
        jq: |
          {
            "caller-a": "upstream-a",
            "caller-b": "upstream-b"
          }[.id] // "upstream-default"
      - name: SET_UPSTREAM
        type: property
        property: kong.service.upstream
        input: PICK_UPSTREAM

Make sure to replace the following placeholders with your own values:

serviceName|Id: The id or name of the service the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/services/{serviceName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

serviceName|Id: The id or name of the service the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/services/{serviceId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
controlPlaneId: The id of the control plane.
serviceId: The id of the service the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: datakit
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  nodes:
  - name: GET_CREDENTIAL
    type: property
    property: kong.client.credential
  - name: PICK_UPSTREAM
    type: jq
    input: GET_CREDENTIAL
    jq: |
      {
        'caller-a': 'upstream-a',
        'caller-b': 'upstream-b'
      }[.id] // 'upstream-default'
  - name: SET_UPSTREAM
    type: property
    property: kong.service.upstream
    input: PICK_UPSTREAM
plugin: datakit
" | kubectl apply -f -

Copied!

Next, apply the KongPlugin resource by annotating the service resource:

kubectl annotate -n kong service SERVICE_NAME konghq.com/plugins=datakit

Copied!

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_datakit" "my_datakit" {
  enabled = true

  config = {
    nodes = [
      {
        name = "GET_CREDENTIAL"
        type = "property"
        property = "kong.client.credential"
      }, 

      {
        name = "PICK_UPSTREAM"
        type = "jq"
        input = "GET_CREDENTIAL"
        jq = <<EOF
{
  "caller-a": "upstream-a",
  "caller-b": "upstream-b"
}[.id] // "upstream-default"
EOF
      }, 

      {
        name = "SET_UPSTREAM"
        type = "property"
        property = "kong.service.upstream"
        input = "PICK_UPSTREAM"
      }    ]
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  service = {
    id = konnect_gateway_service.my_service.id
  }
}

Copied!

Add this section to your kong.yaml configuration file:

kong.yaml

Copied!

_format_version: "3.0"
plugins:
  - name: datakit
    route: routeName|Id
    config:
      nodes:
      - name: GET_CREDENTIAL
        type: property
        property: kong.client.credential
      - name: PICK_UPSTREAM
        type: jq
        input: GET_CREDENTIAL
        jq: |
          {
            "caller-a": "upstream-a",
            "caller-b": "upstream-b"
          }[.id] // "upstream-default"
      - name: SET_UPSTREAM
        type: property
        property: kong.service.upstream
        input: PICK_UPSTREAM

Make sure to replace the following placeholders with your own values:

routeName|Id: The id or name of the route the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/routes/{routeName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

routeName|Id: The id or name of the route the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/routes/{routeId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
controlPlaneId: The id of the control plane.
routeId: The id of the route the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: datakit
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  nodes:
  - name: GET_CREDENTIAL
    type: property
    property: kong.client.credential
  - name: PICK_UPSTREAM
    type: jq
    input: GET_CREDENTIAL
    jq: |
      {
        'caller-a': 'upstream-a',
        'caller-b': 'upstream-b'
      }[.id] // 'upstream-default'
  - name: SET_UPSTREAM
    type: property
    property: kong.service.upstream
    input: PICK_UPSTREAM
plugin: datakit
" | kubectl apply -f -

Copied!

Next, apply the KongPlugin resource by annotating the httproute or ingress resource:

kubectl annotate -n kong httproute  konghq.com/plugins=datakit

Copied!

kubectl annotate -n kong ingress  konghq.com/plugins=datakit

Copied!

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_datakit" "my_datakit" {
  enabled = true

  config = {
    nodes = [
      {
        name = "GET_CREDENTIAL"
        type = "property"
        property = "kong.client.credential"
      }, 

      {
        name = "PICK_UPSTREAM"
        type = "jq"
        input = "GET_CREDENTIAL"
        jq = <<EOF
{
  "caller-a": "upstream-a",
  "caller-b": "upstream-b"
}[.id] // "upstream-default"
EOF
      }, 

      {
        name = "SET_UPSTREAM"
        type = "property"
        property = "kong.service.upstream"
        input = "PICK_UPSTREAM"
      }    ]
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  route = {
    id = konnect_gateway_route.my_route.id
  }
}

Copied!

Add this section to your kong.yaml configuration file:

kong.yaml

Copied!

_format_version: "3.0"
plugins:
  - name: datakit
    consumer: consumerName|Id
    config:
      nodes:
      - name: GET_CREDENTIAL
        type: property
        property: kong.client.credential
      - name: PICK_UPSTREAM
        type: jq
        input: GET_CREDENTIAL
        jq: |
          {
            "caller-a": "upstream-a",
            "caller-b": "upstream-b"
          }[.id] // "upstream-default"
      - name: SET_UPSTREAM
        type: property
        property: kong.service.upstream
        input: PICK_UPSTREAM

Make sure to replace the following placeholders with your own values:

consumerName|Id: The id or name of the consumer the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/consumers/{consumerName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

consumerName|Id: The id or name of the consumer the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/consumers/{consumerId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
controlPlaneId: The id of the control plane.
consumerId: The id of the consumer the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: datakit
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  nodes:
  - name: GET_CREDENTIAL
    type: property
    property: kong.client.credential
  - name: PICK_UPSTREAM
    type: jq
    input: GET_CREDENTIAL
    jq: |
      {
        'caller-a': 'upstream-a',
        'caller-b': 'upstream-b'
      }[.id] // 'upstream-default'
  - name: SET_UPSTREAM
    type: property
    property: kong.service.upstream
    input: PICK_UPSTREAM
plugin: datakit
" | kubectl apply -f -

Copied!

Next, apply the KongPlugin resource by annotating the KongConsumer resource:

kubectl annotate -n kong kongconsumer CONSUMER_NAME konghq.com/plugins=datakit

Copied!

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_datakit" "my_datakit" {
  enabled = true

  config = {
    nodes = [
      {
        name = "GET_CREDENTIAL"
        type = "property"
        property = "kong.client.credential"
      }, 

      {
        name = "PICK_UPSTREAM"
        type = "jq"
        input = "GET_CREDENTIAL"
        jq = <<EOF
{
  "caller-a": "upstream-a",
  "caller-b": "upstream-b"
}[.id] // "upstream-default"
EOF
      }, 

      {
        name = "SET_UPSTREAM"
        type = "property"
        property = "kong.service.upstream"
        input = "PICK_UPSTREAM"
      }    ]
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  consumer = {
    id = konnect_gateway_consumer.my_consumer.id
  }
}

Copied!

Add this section to your kong.yaml configuration file:

kong.yaml

Copied!

_format_version: "3.0"
plugins:
  - name: datakit
    consumer_group: consumerGroupName|Id
    config:
      nodes:
      - name: GET_CREDENTIAL
        type: property
        property: kong.client.credential
      - name: PICK_UPSTREAM
        type: jq
        input: GET_CREDENTIAL
        jq: |
          {
            "caller-a": "upstream-a",
            "caller-b": "upstream-b"
          }[.id] // "upstream-default"
      - name: SET_UPSTREAM
        type: property
        property: kong.service.upstream
        input: PICK_UPSTREAM

Make sure to replace the following placeholders with your own values:

consumerGroupName|Id: The id or name of the consumer group the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/consumer_groups/{consumerGroupName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

consumerGroupName|Id: The id or name of the consumer group the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/consumer_groups/{consumerGroupId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "datakit",
      "config": {
        "nodes": [
          {
            "name": "GET_CREDENTIAL",
            "type": "property",
            "property": "kong.client.credential"
          },
          {
            "name": "PICK_UPSTREAM",
            "type": "jq",
            "input": "GET_CREDENTIAL",
            "jq": "{\n  \"caller-a\": \"upstream-a\",\n  \"caller-b\": \"upstream-b\"\n}[.id] // \"upstream-default\"\n"
          },
          {
            "name": "SET_UPSTREAM",
            "type": "property",
            "property": "kong.service.upstream",
            "input": "PICK_UPSTREAM"
          }
        ]
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
controlPlaneId: The id of the control plane.
consumerGroupId: The id of the consumer group the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: datakit
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  nodes:
  - name: GET_CREDENTIAL
    type: property
    property: kong.client.credential
  - name: PICK_UPSTREAM
    type: jq
    input: GET_CREDENTIAL
    jq: |
      {
        'caller-a': 'upstream-a',
        'caller-b': 'upstream-b'
      }[.id] // 'upstream-default'
  - name: SET_UPSTREAM
    type: property
    property: kong.service.upstream
    input: PICK_UPSTREAM
plugin: datakit
" | kubectl apply -f -

Copied!

Next, apply the KongPlugin resource by annotating the KongConsumerGroup resource:

kubectl annotate -n kong kongconsumergroup CONSUMERGROUP_NAME konghq.com/plugins=datakit

Copied!

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_datakit" "my_datakit" {
  enabled = true

  config = {
    nodes = [
      {
        name = "GET_CREDENTIAL"
        type = "property"
        property = "kong.client.credential"
      }, 

      {
        name = "PICK_UPSTREAM"
        type = "jq"
        input = "GET_CREDENTIAL"
        jq = <<EOF
{
  "caller-a": "upstream-a",
  "caller-b": "upstream-b"
}[.id] // "upstream-default"
EOF
      }, 

      {
        name = "SET_UPSTREAM"
        type = "property"
        property = "kong.service.upstream"
        input = "PICK_UPSTREAM"
      }    ]
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  consumer_group = {
    id = konnect_gateway_consumer_group.my_consumer_group.id
  }
}

Copied!

Datakit

Route requests to different upstreams based on the authenticated callerv3.14+

Prerequisites

Set up the plugin

Help us make these docs great!

Still need help?